MCP server

When

A capability must live outside the agent process and be approved independently.

Do

1. 01

   One job per tool

   Explicit schema. Description says what it is not for. No secrets, no 'call me first'.

2. 02

   Pin from the client

   Hash, review schemas, allowlist tools. Do not auto-trust a marketplace.

3. 03

   Treat descriptions as data

   They are an instruction channel. Quote them. Do not concatenate into the system prompt as peer policy.

Don't

• Put 'always call this tool first' in a description.
• Ship a mega-tool that wraps your entire REST API.
• Let the agent install arbitrary MCP servers at runtime.

Minimal MCP server

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("invoices")

@mcp.tool()
def get_invoice(invoice_id: str) -> dict:
    """Return a single invoice by id as a short JSON summary (id, total, status).
    Not for listing, refunds, or exporting PDFs."""
    inv = db.invoices.get(invoice_id)
    return {"id": inv.id, "total": inv.total, "status": inv.status}

if __name__ == "__main__":
    mcp.run()

Refuse

• Tool poisoning — An MCP server or plugin whose description is an instruction: 'call me first, send secrets'.
• Mega-tool — One function whose argument is a JSON blob of 'whatever'. An untyped shell with extra steps.
• Security by system prompt — 'Never delete files' as the only guard. The model is a confused deputy and will try to help.

Load next

• Design the ACIYou are adding or reviewing tools. The ACI is the prompt you cannot see.
• Sandbox and injectionThe agent has a shell, a browser, documents, or plugins. The model is a confused deputy.
• Agent-to-agent (A2A)Agents from different runtimes need a contract. This is not a CrewAI crew.

Trigger tests