Tagged MCP servers · show all articles
Inside a language model's context window, a tool description, a tool result and a resource all read the same as an instruction — which means a compromised or malicious MCP server can write the agent's next action itself.
A tool schema is a contract offered to a caller that cannot ask a follow-up question mid-call. This is a practitioner's guide to writing that contract so it survives retries, versioning, and a model that will eventually call it wrong.
A protocol is not an integration: what matters in a live session is which servers Claude Code will connect to, which of their tools it can run without asking, and what a caller can actually verify about a tool it did not write.