Seven lessons from building real-world MCP servers beyond the demo stage

·1 views

A developer who built multiple Model Context Protocol (MCP) servers — spanning personal, product, and enterprise use cases — has shared recurring design principles that separate production-ready servers from fragile demos. Key findings include keeping tool counts low to conserve context window space, and using MCP's native resource primitives for reading data instead of burning tool definitions. The developer also emphasizes that authorization should fail closed while rate limiters should fail open, and that tool annotations like readOnlyHint and destructiveHint help clients distinguish safe from destructive operations. Optimistic concurrency control, using content hashes to prevent silent data overwrites, proved essential when multiple agents or users write simultaneously. For enterprise deployments, the developer stresses defaulting to read-only access, logging every tool call, and masking PII in responses to satisfy security audits.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Cuts Browser Bookmarks from 47 to 5, Reports Clearer Focus

A developer shared on DEV Community how they deleted nearly all 47 of their browser bookmarks after realizing most had gone untouched for months or years. The cleanup was guided by a single rule: if a bookmark had not been opened in the past six months, it was removed. The author noted that the discomfort of deleting faded quickly, replaced by a sense of mental clarity and greater intentionality. They observed that digital hoarding — saving bookmarks, PDFs, courses, and tabs — creates an illusion of productivity without resulting in actual learning or action. The experience led them to keep only five bookmarks, each meeting strict criteria such as regular use or difficulty of rediscovery.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Slopsquatting: How AI Package Hallucinations Are Enabling Supply Chain Attacks

A new cyberattack technique called slopsquatting exploits AI coding assistants that confidently recommend non-existent software packages, which attackers then register to deliver malicious code. The term was coined by Seth Larson of the Python Software Foundation and brought to wider attention by Andrew Nesbitt of Ecosyste.ms in 2025. Unlike typosquatting, which relies on human typing errors, slopsquatting targets developers who trust and copy AI-generated package names without verification. A USENIX Security 2025 study found that nearly 20% of packages recommended by 16 large language models across 576,000 code samples did not actually exist. Critically, 43% of hallucinated package names reappeared consistently across repeated prompts, giving attackers a reliable list of high-value fake names to register in advance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Turkish Author Ibrahim Ataman Explores Conscience and Identity in Late-Career Novels

Ibrahim Ataman is a Turkish author who began publishing fiction later in life, releasing three novels after the age of sixty. His debut novel, 'Bir Nehirden Geçmek,' follows a lawyer and academic whose life is upended by an official decree, forcing him and his family to flee Turkey across the Meriç River. His second novel, 'Bir Kasabanın Vicdanı,' examines how individual choices shape collective moral responsibility, while the third, 'Azaptan Azbe: Kürsüden Kıyıya,' interweaves themes of law, exile, and human dignity. Across all three works, Ataman focuses on ordinary people struggling to retain their humanity amid large historical events, rather than on the events themselves. He has described writing not as a means of making arguments or passing judgment, but as a shared search for meaning in lived experience.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Retry Storms Crash C# Services and Why Exponential Backoff with Jitter Fixes It

When a backend service briefly fails, naive retry loops in client code can trigger a 'retry storm,' where thousands of clients bombard the server simultaneously and prevent recovery even after the original fault clears. A four-second database blip in one documented scenario stretched into a forty-minute outage because 5,000 clients were firing millions of requests per second at a service already under strain. Simple fixed-delay retries reduce request rate but still synchronize clients to retry at the same instant, leaving peak concurrency — the metric that crashes connection pools — unchanged. Exponential backoff addresses this by progressively lengthening wait times between attempts, while adding random jitter spreads retries across the full interval so no two clients hit the server at the same moment. Together, these techniques in C#'s HttpClient implementations allow struggling services to drain their backlog and recover rather than being pinned in a failed state by the very clients trying to reach them.

0 comments Read more at DEV Community