Wiring MCP Tools In: Auth, Schemas, and Idempotency

Wiring a tool into an agent looks trivial in a demo: define a function, hand it to the model, watch it call it. The trouble starts when that tool touches something real. Now the function needs credentials it must not leak, a schema the model must not misread, error handling that survives partial failures, and idempotency so a retried call does not cause a second irreversible effect. This post is about that unglamorous wiring — the four concerns that separate a tool that demos from a tool you can run against production: auth, schemas, error handling, and idempotency.

The setting is a Claude agent talking to MCP servers. Model Context Protocol is the open standard, introduced by Anthropic in November 2024, that lets an agent discover and invoke external tools through a uniform interface, with each server acting as the adapter between the agent and one specific system. Because the server is the adapter, it is also the right home for every concern below. Get the server plumbing right and the agent on top of it inherits the reliability.

Authentication: the server holds the keys, never the model

The cardinal rule of wiring auth is that credentials live in the MCP server's environment, not in the prompt, not in the tool arguments, and never in the model's context. The model emits an intention to call charge_card; the server, which already holds the scoped API key, performs the charge. This keeps secrets out of transcripts, logs, and any document the model might later be tricked into echoing back. A leaked conversation should never be a leaked credential.

Scope the credential to the minimum the server needs. An MCP server that reads order history should authenticate with a read-only role; one that issues refunds should hold a key scoped to refunds and nothing else. This is least privilege applied at the server boundary, and it bounds the blast radius if any single server is compromised. For user-specific access, pass an opaque identity token through the call and let the server resolve it to permissions server-side — the model carries an identifier, never the entitlement itself.

Schemas: the contract the model actually reads

A tool's JSON schema is not paperwork; it is the primary interface the model uses to decide whether and how to call the tool. Treat field descriptions as instructions. "amount": number with no description invites guesses about units and sign; "amount": "refund amount in whole cents, positive" removes the ambiguity. Mark required fields, constrain enums, and give examples in the description where the format is non-obvious. The clearer the schema, the fewer malformed calls you have to reject downstream.

flowchart TD
  A["Claude emits tool call"] --> B{"Schema-valid?"}
  B -->|No| C["Return validation error to model"]
  B -->|Yes| D["Server authenticates with scoped cred"]
  D --> E{"Idempotency key seen before?"}
  E -->|Yes| F["Return prior result, no re-effect"]
  E -->|No| G["Execute against system of record"]
  G --> H{"Success?"}
  H -->|No| I["Return structured error + reason"]
  H -->|Yes| J["Persist result by key, return"]

Validate twice. The harness should validate arguments against the schema before dispatch, and the server should validate again on receipt, because the server is the real trust boundary and must never assume upstream checks ran. Validation at the server is also where you enforce business rules a JSON schema cannot express — "refund amount may not exceed the original charge" — returning a clear rejection the model can understand rather than letting an invalid effect through.

Error handling: failures the model can recover from

Agents fail constantly in small ways, and how you report failures determines whether the agent recovers or spirals. Return errors as structured data with a stable, categorizable reason code: { "ok": false, "reason": "insufficient_funds" }. The model can branch on a reason code; it cannot branch on a 500. Distinguish the three failure classes clearly — invalid input (the model should fix its call), business rejection (the model should explain or escalate), and transient infrastructure failure (the harness should retry).

That last class is the harness's job, not the model's. Transient failures — a timeout, a 503 — should be retried with backoff by the harness before the model ever sees them, because a model asked to "retry" tends to do so blindly and without backoff. Only surface a failure to the model when it is something the model can actually act on. Keeping infrastructure retries out of the model's loop makes runs both more reliable and cheaper.

Idempotency: making retries safe

Idempotency is the property that performing the same operation more than once has the same effect as performing it once. It is non-negotiable for any tool with side effects, because agents retry — on timeouts, on ambiguous results, on loop quirks. The pattern is to generate an idempotency key for each logical action in the harness, pass it through the tool call to the MCP server, and have the server record completed operations by key. A second call with the same key returns the stored result instead of acting again.

Where the backing system supports native idempotency keys — many payment and provisioning APIs do — forward yours straight through and let it deduplicate. Where it does not, the server maintains its own short-lived record of seen keys and their results. Either way, the agent gains a crucial guarantee: a retried cancel_subscription never cancels twice, and a re-issued charge never double-bills. This single discipline removes the most damaging category of agent-caused production incidents.

Putting the wiring together

These four concerns reinforce each other. Scoped auth bounds what a misbehaving call can do; strict schemas reduce how often calls misbehave; structured errors let the model recover from the ones that slip through; idempotency makes the inevitable retries harmless. Wired together at the MCP server boundary, they turn a fragile tool into one you can point at a system of record without holding your breath.

The mindset that ties it together is to treat the MCP server as a hardened gateway, not a thin wrapper. Every call passes through validation, authorization, deduplication, and structured reporting before it reaches your real system, and every result comes back in a shape the model can reason over. The agent gets the flexibility of an LLM; your production system gets the discipline of an API gateway. That balance is what makes reaching production with MCP feel safe rather than reckless.

Frequently asked questions

Where should API credentials for a tool live?

In the MCP server's environment, scoped to the minimum permission the tool needs — never in the prompt, the tool arguments, or the model's context. The model emits an intention; the server holds the key and performs the action, so a leaked transcript never leaks a credential.

Why validate tool arguments in both the harness and the server?

The harness catches malformed calls early to save a round trip, but the server is the real trust boundary and must never assume upstream checks ran. The server also enforces business rules a JSON schema cannot express, returning a clear rejection the model can act on.

How should transient failures be handled?

By the harness, with backoff, before the model sees them. Models asked to retry tend to do so blindly. Only surface failures the model can actually act on — invalid input it should fix, or a business rejection it should explain or escalate.

What makes a tool idempotent in practice?

An idempotency key generated per logical action and recorded by the server, so a repeated call returns the prior result instead of acting again. Where the backing system supports native idempotency keys, forward yours through; otherwise the server tracks seen keys itself.

Hardened tools, now on your phone lines

CallSphere wires voice and chat agents to real systems with exactly this discipline — scoped auth, strict schemas, structured errors, and idempotent writes — so an agent can act mid-conversation without risking a double charge or a leaked key. See it handling live calls at callsphere.ai.

---

Source & attribution: This is an independent, original explainer inspired by Anthropic's coverage on the Claude blog. Claude, Claude Code, Claude Cowork, Claude Opus, and the Model Context Protocol are products and trademarks of Anthropic. CallSphere is not affiliated with or endorsed by Anthropic.