Topic · 4 posts
Model Context Protocol
Servers, hosts, tools, resources, prompts, sampling — and the trust boundaries that decide who is allowed to do what.
- 6 min
A stateless MCP tool re-embeds its corpus on every call
The documents arrive as an argument, so the obvious implementation encodes all of them again each time the agent asks a question. That was 1,040 ms per search. A cache keyed on the exact string took it to 1.2 ms.
- 7 min
8 allowed at 13.0¢. 5 refused at $0.00.
MCP sampling lets a server spend your money using your API key. A gate that reasons about estimated cost before the call means a refusal is free — and that changes what you gate on.
- 7 min
A server-supplied danger hint is not a permission model
MCP lets a server declare its own tools destructive. If your approval gate reads that flag, any server can walk through your gate by lying. The fix is thirty lines and it lives entirely on the host.
- 5 min
An MCP server is one Next.js route handler
No framework, no scaffolding, no SDK ceremony. Four tools, a resource, and a prompt in a single file — and the one line in it that decides whether your tool ever gets used.