MCP at 90+ tools: the catalog breaks before the server does
Exposing one internal tool over the Model Context Protocol is a weekend project. Exposing ninety of them to humans and agents, without turning the MCP endpoint into a credential dump and the audit log into a fire hazard, is a platform problem. This post is the short version of how I'd design that platform. The one-line answer: treat the MCP server as a tool broker in the same family as your LLM…
The article discusses the challenges and solutions for managing 90+ tools through the Model Context Protocol (MCP). The key points are:
1. Treat the MCP server as a tool broker, similar to an LLM gateway, with the same identity rules, metering, and audit discipline.
2. Organize the tool catalog by category, not tool, using a naming convention like {category}.{verb}_{object}. Each tool should have its own permission, audit, and test, and be versioned separately.
3. Implement tool design patterns such as idempotency keys for retryable writes, error taxonomy normalization for upstream failures, and bounded lists with cursor pagination to prevent context-window bombs.
4. Use OAuth 2.1 + PKCE for authentication, with different access token lifetimes for interactive clients and workloads, and no refresh tokens for agents.
5. Implement envelope encryption for stored secrets, with a per-category DEK and per-user DEK under the category DEK to limit the blast radius. Mask PII in tool results and audits to protect sensitive data.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
