I've built a handful of MCP servers. Here's what separates a good one from a demo.

Short summary

The author distills lessons from building three MCP servers (personal, product, enterprise) into seven recurring principles that separate production-grade servers from flashy demos. Key insights: minimize tool definitions since they consume context on every request, use resources instead of tools for reads, fail closed on auth but open on rate limits, use optimistic concurrency for writes, and always populate server instructions. Enterprise servers should default to read-only with full audit logging.

• •Fewer broader tools beat many narrow ones — every tool definition costs context on every request
• •Use MCP resources for reads (zero context cost) and tools only for actions
• •Enterprise MCP servers need read-only defaults, audit logging, PII hashing, and optimistic concurrency control

Generated with AI, which can make mistakes.