The Model Context Protocol is the plug that connects an AI agent to real capabilities. Instead of every client inventing its own way to call your tools, an MCP server advertises a list of tools, resources, and prompts over a standard JSON-RPC 2.0 interface, and any MCP client (Claude Code, Cursor, an agent built on the Claude Agent SDK) can discover and call them. That standardization is the whole point, and it is also where the danger lives: the moment you expose a tool, you are handing a language model a lever it can pull on your systems. Over three projects I built a server, scoped one down to per-client permissions, and wrote a scanner to catch the mistakes. Here is what actually mattered.
Building a server: the transport is simpler than it looks
My first server, casebook-mcp, turns AgentPostmortem (a public registry of documented AI-agent failures) into something an agent can query mid-investigation. The idea: every team debugging an agent incident is rediscovering failure modes someone already wrote up. So the server exposes four tools: search_cases for ranked full-text search, get_case for full case detail, similar_failures to match an incident description against the corpus, and list_tags.
