MCP standardises how an agent finds and calls your tools. It says almost nothing about whether calling them is a good idea, which is where the real design work lives.
Tool descriptions are a user interface
The description is the only documentation the model gets, and it is read under time pressure alongside twenty others. Say what the tool does, what it will not do, and when to prefer a different one. Vague descriptions produce a model that calls the wrong tool confidently.
Keep the surface small. Twenty sharp tools beat sixty overlapping ones — every additional tool is another chance to pick wrong.
Scope credentials to intent
A single all-powerful token is the easiest thing to issue and the hardest to live with. Read-only, content-only and developer scopes let an operator connect an agent for a task without handing over the site. Scopes also make the audit log meaningful, because the credential itself records what was permissible.
Return errors a model can act on
“Error 500” produces a retry loop. “This engine cannot create a snapshot, convert the table or export manually” produces a model that explains the situation and stops. Error messages in an MCP server are read by something that will attempt recovery — write them as instructions, and include the remedy.
Make destructive operations refuse by default
File writes, code writes and restores should be separate opt-ins, off unless enabled. The correct default is the one where a misconfigured agent cannot ruin the afternoon. Operators who need more can say so explicitly, and that decision is then recorded.
Treat everything the server returns as untrusted
Content fetched from a site, file contents and third-party API responses are data, not instructions. An agent that acts on text found inside a document it read is exploitable by anyone who can write into that document. This belongs in the server’s own guidance to the model as well as in the client.
What to take away
MCP is a connector standard, and connecting is the easy half. Scope narrowly, describe precisely, fail informatively, default to refusal on anything irreversible, and log what happened. The protocol will not do any of it for you.