mcp-design

Topics in the source

• An MCP in four tools
• The four tools
• Destruction asks the person
• The agent never decides for the person
• Grow the guide, not the tools
• Prove it

An MCP with one tool per endpoint grows without end, fills the agent's context, and drifts from the product. Four tools over the routes the product already has stay small and never fall behind. | Tool | Does | Maps to | |---|---|---| | guide | Returns the table of routes and operations: path, method, what it does, its arguments. The agent reads it first. | Nothing; it is documentation generated from the route table. | | read | Reads anything the person could see on screen. | GET routes | | write | Creates and changes. | POST, PUT, PATCH routes | | delete | Destroys, after the person confirms. | DELETE and destructive routes | Every call enters the same handler the screen uses, with the person's identity and permissions. No parallel logic, no separate checks: what the screen allows, the MCP allows, and nothing more. delete takes two calls. The first returns confirmRequired with what will be destroyed and a short-lived confirmation code (an HMAC over account, method, path and body, valid for 10 minutes). The agent shows this to the person. Only a second call carrying that code and an explicit confirmation acts. Count as destructive: DELETE, and routes whose last segment is a destruct

This is an excerpt. Refer to the complete source and its current requirements.