Why it matters
An MCP server offers named tools with structured inputs and results to AI clients. It gives customers a way to use your product from compatible assistants without teaching every assistant your private API shape. The tools should describe meaningful customer tasks and call the same authorized product operations as your API and CLI.
This is a server integration for clients such as Claude, Codex, and ChatGPT where they support MCP; it is separate from WebMCP tools offered by a page in the browser. A local adapter may reuse CLI code, while a remote server will usually call a shared typed client or API directly. The API contract helps define tools, but a long list of raw endpoints is rarely a useful tool catalog.
Decisions to make
- Choose the first customer tasks worth exposing as tools and which should stay read-only.
- Define concise tool names, input schemas, structured results, and actionable errors.
- Choose local, remote, or both modes based on where customers use their assistants.
- Decide how each client obtains delegated user access and how scopes and tenant context are enforced.
- Mark which tools change state and choose where a person must review or confirm the action.
- Set tool versioning, rate limits, audit visibility, and a way to revoke a connection.
Build checklist
- Start with a small set of read operations and one clearly scoped write workflow.
- Implement each tool through the same validated product operation used by the API or CLI.
- Validate inputs and enforce authorization in the product service for every tool call.
- Return concise structured results with identifiers and links the customer can verify.
- Record which user, client, tool, tenant, and target were involved in each action.
- Test denied access, wrong-tenant inputs, stale credentials, retries, and client confirmation behavior.
Common mistakes
- Exposing every endpoint as a tool without task descriptions or a manageable catalog.
- Using one broad service credential for every customer and AI client.
- Assuming the AI client’s approval UI replaces server-side permission checks.
Tools & references
3 starting points to compare or study. Check fit, maintenance, terms and current capabilities before choosing one.
