Model Context Protocol: Stop Writing Bespoke Tool Glue
One protocol so any assistant can talk to your database, your files, your ticketing system. Write the server once.
Before the Model Context Protocol, every assistant that needed to read your database required its own custom integration. Five assistants meant writing the same connector five times, in five different shapes.
MCP makes that a protocol problem instead of a per-vendor problem. Write one server; any client that speaks MCP can use it.
The mental model
An MCP server exposes three kinds of thing:
- Tools — actions the model can invoke (query a database, create a ticket, send an email)
- Resources — data it can read (files, records, documentation)
- Prompts — reusable templates the user can trigger
The client handles discovery and invocation. You describe capabilities; you do not write per-assistant glue.
Why it changes what you build
The interesting shift is that integration becomes an asset rather than a cost. A server that exposes a client's booking system is written once and works with whatever assistant that client adopts next year.
For my work the obvious candidates are project-specific: query the bookings database in a safe read-only way, look up a material in the catalog, check deployment status. Small, well-scoped servers beat one server that does everything.
Security is the whole conversation
This is where I want to be direct, because the failure mode is severe.
An MCP server is an API with a language model as its client, and that client can be manipulated by whatever text it reads. If a tool can delete records, assume a prompt injection will eventually try to.
Rules I hold to:
- Read-only by default. Write access is a deliberate exception with a strong justification.
- Scope the credential. The server gets a database user with access to exactly the tables it needs. Never an admin connection.
- Validate arguments server-side. Tool arguments come from a model influenced by untrusted input. Treat them exactly like an HTTP request body.
- Log every invocation. You want the record when something odd happens.
- Vet third-party servers before installing. A community MCP server runs with whatever access you grant it. Read the source or do not install it.
The convenience is real, and so is the fact that you are handing tool access to something that can be talked into misusing it.
Resources
- Reference servers: modelcontextprotocol/servers
- Spec and docs: modelcontextprotocol.io
- Video walkthroughs: YouTube: MCP server tutorial
- Related: The blast radius of an autonomous agent
Need this built properly?
I build secure, fast, bilingual platforms for clients across Egypt, Saudi Arabia, the UAE and Kuwait.
