~/blog/tag/mcp
MCP
The protocol that lets agents reach out of the chat window. What it does, what it costs, and where it leaks.
What I write about here
MCP, the Model Context Protocol, is how an agent reaches outside its own conversation. Files, databases, browsers, your terminal, a remote service. The protocol gives a model a way to call tools the people who built the model never had to think about.
That's the promise. The reality is more interesting.
Posts under this tag look at MCP from two angles. The practical side: which servers earn their keep, how to wire them in without giving an agent more authority than your most senior engineer. And the critical side: what happens when a protocol designed for convenience inherits all the trust assumptions of the user that runs it.
I am not anti-MCP. The protocol is useful and most of my workflow depends on it. I am sceptical of the way it is being adopted, which is roughly the same way every powerful tool gets adopted at first. Convenience first, audit later, surprise eventually.
Read these posts expecting opinions on specific servers and patterns. Some MCPs earn their stars. Some do not. The protocol itself is fine. What people build on top of it is the question.
If you want the wider story about agents and access, start with the MCP and security guide.
best entry points
- The MCP supply chain is the new npm, and it is already poisoned
The piece that sets the tone. An RCE baked into every official SDK, which the maintainers call expected behaviour. Read this before you install another server.
- MCP vs CLI for coding agents: what your tools actually cost
What a tool surface costs, measured rather than quoted: 49 tools, the schema that is most of the bill, and why the multiplier everyone repeats describes a client you are probably not running.
- Build an MCP server, then ask whether it should exist
The building side. Twenty lines of FastMCP and a working server, then the question the tutorials skip: does it earn its place?
MCP server security scores are review prompts, not verdicts
An MCP server security score looks like a verdict. Measured across 74,101 servers, most of what a scanner tells you is a heuristic, and the state it almost never shows you is that nobody read the source.
read →MCP vs CLI for coding agents: what your tools actually cost
Every comparison quotes a multiplier. Mine came out at 88.9x, and my client had already answered the question that number was asking. What a tool surface costs now, and what still separates a schema from a command.
Claude Code /doctor: the health check became a context audit
What /doctor actually checks in Claude Code now: ten checks, and only two of them care whether the thing is installed. The rest audit what you loaded.
MCP server authentication: OAuth, scopes and rate limits
You built an MCP server. The tutorial ended where security starts. How to add OAuth, scoped tokens and rate limits to your own server, with TypeScript and Laravel examples, so it does not join the 12,500 open ones.
AI writes the tests. Mutation testing checks if they work.
AI-generated tests hit high coverage in seconds, but coverage only proves a line ran. Mutation testing proves the tests would actually catch a bug, and Chaos-MCP puts that loop inside your agent.
How to give Claude safe access to your SQL database
A practical guide to giving an AI agent database access without losing sleep: SELECT-only mode, query validation, field redaction before rows reach the model, SSH tunnels and audit logging.
How to vet an MCP server before you install it
A pre-install security checklist for MCP servers: who really publishes it, what the tool descriptions tell your model, what it can reach, and why you should pin the version. Ten minutes that would have saved three hundred organisations.
Log in to MCP servers from your shell
Claude Code v2.1.186 added claude mcp login, a one-liner that runs an MCP server OAuth flow straight from the terminal. Here is how to use it, including over SSH.
An open MCP server is worse than an open database
Censys found 12,500 MCP servers on the public internet and 40% accept unauthenticated requests. We spent fifteen years learning not to expose databases. MCP re-ran the whole mistake in eighteen months, except this endpoint has verbs.
Build an MCP server, then ask whether it should exist
A working MCP server is twenty lines of FastMCP. That is exactly the problem. A build tutorial, and the test for whether your server earns a place in the tool list at all.