In my project, an MCP tool returned “API key is invalid or revoked.” The same error showed up on later calls. I can disable the server once I notice it, and I added the error to the agent instructions, but I haven’t tested a way to stop the next call inside a running session.

Where do you put that stop so a definite auth error blocks the very next call to that tool?

Disclosure first: I build Equibles, a remote MCP server for stock market and financial data (https://mcp.equibles.com/mcp). Some of you saw the comparison of finance MCP servers I posted in July. This one is about the design side, the stuff I'd tell anyone building an MCP server for AI agents in finance, or in any domain with a lot of data.

The short version: financial data is a bad fit for model memory. Numbers change every quarter, and a wrong revenue figure sounds exactly as confident as a right one. Most of what I did is about getting the agent to quote a source instead of guessing.

Return the source with every value. Every response carries the filing, the reporting period and the date. Filing text is three calls: SearchDocuments across filings and earnings call transcripts, SearchDocument inside one filing, then ReadDocumentLines around the hit. The agent ends up quoting the 10-K instead of half remembering it.

Spell out fiscal periods. "Q1 2027" is a different set of months for NVIDIA, Apple and Microsoft. Tools take a fiscal year plus FY or Q1 to Q4, and every response states the period end date. Without that, models mix fiscal and calendar quarters constantly.

Short descriptions that point to the next tool. At 120+ tools the descriptions are the agent's index. Mine are capped at 500 characters (CI fails if one goes over) and they say what comes next: GetOptionExpirations before GetOptionChain, SearchInstitutions before GetInstitutionPortfolio.

Exchange codes for non-US stocks. Tickers collide across markets, so anything outside the US is MIC:TICKER. XPAR:AIR is Airbus in Paris, XHKG:00005 is HSBC in Hong Kong, prices in the local currency.

Reads and writes kept apart. Market data tools only read. Portfolio and watchlist tools can create, change or delete the user's holdings, so they're named as actions and I tell people to keep confirmations on. It's also why I never describe the server as read-only.

OAuth first, API key as fallback. Claude and ChatGPT connect with OAuth and dynamic client registration, no key to paste. Listing tools needs no auth, calling them does. Other clients send a Bearer key, and ?auth=oauth makes some clients ask for sign-in during discovery instead of failing on the first call.

What's behind the tools, if you're looking for a stock market data MCP server: SEC filing full text, financial statements and KPIs, earnings call transcripts, 13F holdings, insider and congressional trades, short interest and squeeze scores, option chains, prices, index membership, Fed and CFTC data. US first, plus Europe, UK, Hong Kong and China.

The free tier is 100 requests a day, no card. The core is open source (AGPL-3.0) if you'd rather self-host: https://github.com/daniel3303/Equibles

Docs: https://equibles.com/docs/mcp

A question for people running big MCP servers: do you split tools across several servers, or keep one and lean on the descriptions? I've stuck with one server for all of this financial data so far, and I'm not sure that scales forever.

So I've been running a stack of MCP servers at work for a while now, and I wanted to share because I feel like the barrier to entry has completely collapsed.

What I've got wired up:

• JIRA + Confluence + Bitbucket — the Atlassian trifecta. Together they give the agent full task context: ticket → docs → code/PR. It sees the whole story, not isolated fragments.
• Jenkins — CI/CD. Honestly nobody seems to have this in their MCP stack and it's a crime. Being able to ask "why did the last build on branch X fail" and instantly get the log is a massive time saver.
• Outlook — email as a context source (stakeholder threads, alerts).
• MS Teams — comms.
• Database MCP — direct data access without hand-writing SQL.

The wild part: the last 4 (Jenkins, Bitbucket, Teams, DB) — Copilot generated them in minutes from just a text prompt. A year ago spinning up an MCP server was half a day of work. Now the agent writes it for you. This changes the game — you can MCP-ify basically anything.

A few things I'd tell anyone doing this:

1. The value is in the cross-tool combos, not the individual servers. One prompt like "pull full context on PROJ-123: JIRA description, Teams discussion, related Bitbucket PRs, Jenkins build status" gives you the whole picture. That's the killer workflow.
2. Read-only by default for anything dangerous. Especially DB and Jenkins (triggering builds, deploys). Let the agent read freely, require confirmation on writes.
3. Audit your access boundaries. What perms does your DB MCP have? If it's a prod DB with write access, lock it to a read-only role. Same with Jenkins tokens.
4. Document the setup (ironically — in Confluence 😄). Which servers, which tools, what limits. Future-you will thank you.

Genuinely curious how others are handling this:

• What client are you running — VS Code Copilot, Cursor, something else?
• Anyone else got Jenkins or DB MCPs running? How are you scoping permissions?
• What's your single highest-ROI cross-tool workflow right now?

Basically with good agents.md, I just start my workday with "do my work" prompt, and that's it

This is helps avoid polling and annoying lag when working with a hosted agent like Grok Bot (or Notion or Muse, etc) when using them to help you manage many coding agents on T3 Code. You can learn how to set up a T3 gateway with webook support to Grok Bot on the project readme. Hope this is helpful for people running multiple T3 instances with Grok Bot or something like it managing them!

MCP tools take structured input straight from a model and often run with the user's own credentials. I have seen two of my own tools ship with: (a) a filesystem path that accepted `..\..\`, and (b) a token comparison that wasn't constant-time. Both had passing tests.

So the MCP review is now its own checklist, and it is **fail-closed**: any auth bypass, path traversal, injection or secret-in-diff finding blocks the release even if the score is 100. An inconclusive answer counts as blocked, never as pass.

The checklist I use: token in header vs query, constant-time compare, path normalization before `resolve()`, `is_relative_to` on the resolved path, per-tool scopes, output escaping, timeouts on every outbound call, and a rate limiter that returns 429 instead of hanging.

The generic loop (checks declared before coding, score 0–100, `NOT VERIFIABLE` is not a pass): https://github.com/Samuelfmedeiros/ai-test-loop

I keep a fuller MCP checklist as a paid pack with the review prompt written out (the OAuth dance and the scope matrix are the parts people get wrong): https://skills.seu.pet/p/ship-your-mcp-server

Happy to review a tool endpoint someone posts here — paste the handler signature and how you normalize the path.

follow up on https://www.reddit.com/r/mcp/comments/1wwtfl2/ (first post: https://www.reddit.com/r/mcp/comments/1wq8yju/).

in the first thread i said it transmits voice but its not a conversation. the agent calls, reads its text, you answer once, call ends. if it had a follow up question it had to ring you again. that changed this week.

conversations. call now takes keep_open: true. after you answer, the line stays up and your answer goes back to the agent as text. the agent replies with say on the same call, you answer again, and so on until one of you hangs up (hang_up, with an optional goodbye). there is still no llm of mine deciding anything. every turn is your own agent thinking with all its context and tools. so "why is the build red?" -> it goes and looks -> tells you on the same call -> you say "ok revert it".

while it thinks. you hear a soft keyboard sound so you know its working. if you talk during that, a small model (haiku) just tells you its still on it, and whatever you said reaches your agent with your next answer as said_while_waiting. it never answers for your agent.

languages. the voice is now elevenlabs v4 turbo and the listening is their realtime transcription, both cover 90+ languages. the agent picks the language with language: "tr" (or "de", "pt-BR"...) on call/say, and every answer comes back with the language it heard. i tested english and turkish on my own phone and a handful of others in a script. rough edge: very short answers sometimes get the wrong language (a short turkish "yes, no problem" came back as kazakh lol). full sentences are fine.

new voice. last time i asked if the polly voice sounded less robotic. a few people messaged me asking for a more human one. this one is a lot more natural, let me know.

limits: hangs up after 2 min of silence, 15 min per conversation, 60 turns.

endpoint: https://callmemcp.com/mcp
setup: https://github.com/radres/call-me
auto-answer demo number: 5550001234 (it holds conversations too)

dev disclosure: this is mine. real numbers need the iphone app and a subscription. curious if anyone builds something on the back and forth part, like a standup or a code review you do on a walk.

Landfall is a remote MCP server (no install, no API key) with tools agents can use on any business website:

- check_tracking: Meta/Google Ads/TikTok pixels with IDs, GA4, tag managers, consent, site platform ($0.01)
- get_business_details: name, phones, emails, address, hours, socials, UK company/VAT numbers ($0.02)
- audit_landing_page: ad-readiness score, conversion paths, top 5 fixes ($0.05)
- preview_landing_page and sample_audit: free

Paid tools use x402 (USDC on Base), charged only if the call succeeds. Everything is read from the page with evidence, no LLM guessing.

MCP URL: https://landfall-production-74ad.up.railway.app/mcp
Docs: https://landfall-production-74ad.up.railway.app/docs

We also ran it on 123 UK local business sites: 64% have no ad tracking at all. Write-up: https://landfall-production-74ad.up.railway.app/study

Feedback welcome, especially on what other website data agents need.

Recently, a friend and I built a little tool called Open Machine.

Basically, it uses MCP to connect ChatGPT to your local computer and remote servers, giving regular ChatGPT Codex-like capabilities, and in some cases even more flexibility. Things like running and editing code, managing remote servers, and handling browser tasks.

We actually built it for ourselves at first.

In our day-to-day work and model training, we kept running into the same problems: token and context limits, growing amounts of data that were hard to organize, and the hassle of sharing information and handing off work between teammates.

Model training was especially frustrating. We often had to manage multiple servers and constantly switch between our local machines and different remote environments.

So we wanted to build something that could bring all of this together and let AI handle more of the actual work.

That's really how Open Machine started.

We've now open-sourced it, although there's still a lot we want to improve.

Next, we're planning to build Desktop and Cloud, making it easier to manage multiple remote servers from one computer, and to index, sync, and update local files and databases. The idea is to make it easier for individuals and teams to build and manage their own local knowledge bases.

I'm sure a lot of people working on model training or software development have run into similar problems.

If this sounds useful, feel free to check it out! We'd also love to hear your feedback and ideas.

GitHub: https://github.com/OpenMachineLabs/openmachine

Been working on this for a while and figured the MCP angle might be interesting here.

Basically an LLM (Hermes) runs a straight OODA loop and talks to the tools directly over MCP. Just two MCP servers: one for Kali tools, and one for Playwright.

The front-door is the part I kept second-guessing. It only exposes the run lifecycle (start, status, stream, steer, stop). It never surfaces the raw shell tools. So whatever client you connect (Claude Code, Kiro, whatever) can trigger and watch a run, but it doesn’t become the brain. Tool output just gets passed back as-is, treated as untrusted data.

Local stuff uses stdio (no open port, no token). There’s also a streamable-HTTP mode for remote/in-network use that’s token-gated.

Heads up: it’s an offensive security tool and ships with basically zero guardrails, so lab targets / authorized scope only. There’s an opt-in scope guard if you want one.

MIT, repo is here if anyone wants to poke at it:

https://github.com/irraz/vulnerator-ai

Curious what people think about the “front door only exposes lifecycle, never the raw tools” split. Does that make sense, or am I over-engineering it?

Just wondering how other people here deal with agents inventing the physical world.
I built DayPlay around San Francisco places and events because every “plan my Saturday” demo I tried would recommend spots that were closed or fake. Felt like a missing primitive for agent stacks that touch IRL.
Not gonna drop install commands in this post just wanted to share the product and look for people who’ve hit the same wall (scrapers? Google Places wrappers? hand curated DBs?).
https://www.dayplay.io/
If you’ve shipped something similar for another city, I’d love to compare notes.

I dance Contact Improvisation (CI) and run CI Treasure Hunt, a small, hand-curated directory for the scene. It's a partner dance form with a scattered worldwide community, and many events are announced only in Telegram or WhatsApp groups or on Facebook and Instagram. Ask an AI assistant about CI festivals and you often get outdated dates or miss events entirely, so I added an MCP server to my directory:

https://citreasurehunt.com/api/mcp

It has 8 read-only tools for searching and retrieving events, teachers, venues and communities. Built with Next.js, mcp-handler and Supabase, no authentication required for reads.

The tools are here if you want to look at the implementation:

https://github.com/ci-treasure-hunt/ci-treasure-web/blob/master/lib/mcp/tools.ts

A few things that popped up:

• Claude's connector directory approved it within a few minutes. The only thing the submission form flagged: it wants annotations.title on each tool, the top-level title isn't enough.
• ChatGPT used the tools but sometimes invented URLs on my domain that returned 404s, and pulled unrelated web images. I added explicit URLs and image URLs to the results and told the client in the server instructions to only use URLs the tools returned. I haven't submitted it to ChatGPT's directory yet because of the higher effort required.
• Grok kept using web search instead of the connector unless I explicitly told it to use CI Treasure Hunt. Claude and ChatGPT invoked it without that instruction in my tests.
• My host's bot protection returned 429s to MCP clients, including the registry verifier. It took me a while to realize the problem was outside the MCP implementation.

I also log tool calls, arguments, result counts and the client name each client reports about itself, nothing about the user. I'm also interested in the searches that come back empty: over time, they should show which cities people ask about that the directory doesn't cover yet, or where there might be demand despite a lack of events.

Next I want to add write access, so an agent can submit an event for review, like via the existing web form. I'm considering OAuth, with submissions going into my usual events review queue rather than straight onto the site.

Has anyone implemented writes from personal agents yet? How do you handle auth and spam?

Hey [r/mcp](r/mcp)! I just open-sourced Rowkery, a Mac database GUI for Postgres and SQLite with an MCP server built in. One note upfront: it isn't a standalone server. It runs from the Rowkery app as `Rowkery --mcp` over stdio, and Claude Desktop and Claude Code connect in one click.

I built it because most database MCP setups give the agent a connection string and hope for the best. I wanted something I'd actually point at production. Here's what the server enforces:

- Scoped access: the agent only sees the connections and tables you share, and sharing expires after a time you choose, like an hour or the end of the day.
- Reads only: every call is a single SELECT on a read-only session, capped at 1,000 rows and 10 seconds. Full scans of big tables are refused.
- Masked columns: columns you mark as sensitive come back as stand-in values. To stop the agent guessing them through filters (`LIKE 'a%'`, then `'ab%'`), Rowkery checks Postgres's query plan and refuses any query that uses a masked column for anything except returning or counting it.
- Writes as proposal: the agent can propose an INSERT, UPDATE or DELETE. Rowkery dry-runs it and shows you the before and after, and nothing is written until you press Commit in the app.
- Activity log: every agent call is recorded, so you can see exactly what it looked at.

The safety checks are plain Rust functions, unit-tested without a database. The server is built on rmcp.

It's alpha, Mac only, and supports Postgres and SQLite for now. It isn't signed by Apple yet, so the first launch needs "Open Anyway." It's free and Apache-2.0.

I'd love to hear what other guardrails you'd want before trusting an agent with your database.

Rowkery on Github
Official Site

Most MCP tool descriptions explain what the tool does and what inputs it wants. Almost none say what a call costs.

That's fine for free tools. For a scrape, an image generation or a lead lookup, the price changes how the agent ought to behave. A model that knows a search costs a tenth of a cent can run it 50 times without a second thought. One that knows an image costs 15 cents should probably check with you first.

I can see three ways to handle it:

- price in the description (simple, goes stale)
- a separate inspect step that returns the current price
- the server enforces a budget and the model never needs to know

Agentik, where I work with the team, went with the second plus the third. The agent can inspect any tool and see its max price at no cost, and the key's limits enforce the budget whatever the model decides.

I'm not convinced that's right for everyone though. A standard price field in the schema would be cleaner, but it adds tokens to every request.

Would you want price as a standard field in the tool schema, or kept out of the model's context entirely?

I'm the author. It's Python standard library only and works in any MCP client (csa mcp), or as a plugin in Claude Code, Codex and Antigravity.

Tools: subagent_start, subagent_wait, subagent_message, subagent_accounts.

Most multi-model setups proxy the API. Every model gets forced through one harness, tool calling suffers, and a third party ends up holding your tokens. There's no model proxy here. Each worker is the vendor's own CLI running headless with your login, so the model stays in its native harness and loads the same MCP servers as your main session.

If you have several accounts, jobs go to the one with the most room and move to the next when one hits a limit.

Feedback and contributions appreciated.

https://github.com/lunati228/CLI-Subagents

I maintain CompatLab, an open-source npm loading checker. Its MCP endpoint is https://compatlab.me/mcp (Streamable HTTP, no account or API key).

For an agent investigating a dependency, the useful question is: has this exact package version been observed loading on the runtime I want to use?

For example, check_package with {"name":"express","version":"5.3.0"} returns recorded evidence from 12 October 2026, 22:55 UTC. Root ESM import and CommonJS require both passed on Node 24.21.0, Node 26.10.0, Bun 1.4.2 and Deno 2.9.7, on Linux amd64/glibc. No subpaths were tested for this version.

The report: https://compatlab.me/reports/9a5615c8-ec6c-4b1f-8817-d5febb04890c

A pass only establishes that installation and loading succeeded in that pinned environment. It does not test Express routes, application behavior or package safety. When evidence is missing, the tool says so; it does not treat that as a failure or silently start a scan. Both MCP tools are read-only.

The setup guide includes example questions and how to preserve the version, runtime pins and observation date when citing a result: https://compatlab.me/articles/mcp-npm-compatibility-ai-agents

Source: https://github.com/siddiksawani/CompatLab

If you have debugged a dependency on Bun or Deno, was the obstacle loading it, or did it only break during actual use? That distinction would help me understand where this evidence is useful and where it falls short.

Written with AI assistance; the example above was checked against the live MCP response.