Home · MCP Developer
MCP developer notes
I have built two Model Context Protocol servers that run in production: .NET 10 on Azure Container Apps, 22 tools between them, deployed with Bicep. This page is what that work involves. What the protocol is for, how the auth is put together, and where the security holes are.
01 · What is MCP?
The plumbing that lets AI reach your systems
The Model Context Protocol, MCP, is a common way for an LLM or an AI agent to reach into your world: your CRM, your internal tools, your databases, your file storage, whatever runs the business. Before MCP, every one of those hookups was a custom, one-off integration built for a single assistant. MCP standardises it, so you build the connection once and any MCP-aware model or agent, Claude, ChatGPT, or your own internal agent, can use it. It is the difference between an AI that can talk about your business and one that can operate inside it.
02 · How they are built
Most MCP demos fall over on real data and real permissions
Getting a server to answer is an afternoon. The parts below are what the rest of the time went on, and they are the parts a demo never shows you.
The model never touches a credential
Auth parameters are stripped out of the tool schemas the model sees, then re-injected server-side on the way through. The model cannot leak a token it was never shown, and it cannot be talked into asking for one. Token introspection runs through OpenIddict.
The allowlist, because the naive version is an SSRF
An MCP server that fetches whatever URL an agent hands it is an open proxy into your own network. Outbound requests go through an explicit allowlist instead.
Results are sanitised and capped at 50KB
A tool that happily returns an entire table will blow the context window and bill you for the privilege. Truncation is a cost control as much as a correctness one.
Caching the caller, per sub
Resolving the calling user on every single tool call was the first thing that got slow. User ids are now cached per sub claim.
03 · FAQ
Frequently asked questions
What does an MCP developer do?
An MCP developer builds the connections that let AI models and agents reach a company’s own tools, data and systems. In practice that means designing and building MCP servers: the tools the server exposes, the data it can touch, and the boundaries around what an agent is and isn’t allowed to do, so an LLM can work inside your business instead of just talking about it.
What is an MCP server?
An MCP server is a standardised connector built on the Model Context Protocol. You build the connection to a system once, and any MCP-aware model or agent, Claude, ChatGPT, or your own internal agent, can use it. Before MCP, every one of those hookups was a custom, one-off integration built for a single assistant.
How do you keep an MCP server from leaking credentials?
Keep the credential out of the model’s reach entirely. Auth parameters are stripped from the tool schemas the model is shown, and re-injected server-side when the call is made. The model cannot leak a token it never received, and no amount of prompt injection makes it produce one. Token introspection is handled by the identity layer, in my case OpenIddict.
What stops an agent reaching internal systems it should not?
Two things. An explicit allowlist on outbound requests, because a server that fetches any URL an agent supplies is a server-side request forgery hole pointed at your own network. And a deliberate choice about which tools exist at all: the boundary is what you decline to expose, not what you filter afterwards.
04 · More
More on how I build
MCP is one part of the work. The rest is iOS and macOS apps, full-stack builds, and writing about what the tooling is really like once it meets production.