Production MCP servers for AI agents that safely act on your systems.
Your agent nails the demo. Then it has to act on a real internal tool — and the hand-rolled MCP server starts falling over. I turn that flaky integration into a production-grade server your team can trust, in a fixed-scope sprint.
The SDK wrapper is the easy part. The reason yours won't page you at 2am — fail-soft behavior, scoped auth, pinned versions — is the part I build.
Where AI builders show their work — losses included.
Trading bots, agents, MCP tools, content pipelines — real logs, real war stories, from people who actually ship. The same harness discipline this whole site is built on, now a community.
-
Auth that isn't scopedOne over-broad credential and the agent can do anything that token can — across every tool surface. No isolation, no trust boundary.
-
No fail-soft behaviorA backend dies, the server throws, and the agent session crashes with it. One dead dependency takes the whole agent offline instead of returning a clean error.
-
Nothing pinnedUnpinned deps and an unpinned upstream API version mean the backend can silently change response shape — and the integration breaks with no warning.
-
No tests, no docs, no handoffIt runs on one laptop. No test suite on a clean checkout, no setup docs a teammate can follow — so it's not something your senior people should be babysitting.
Hand-rolled MCP servers break at 2am.
“Just call the API” stopped being enough — your agent has to act on internal tools. Someone wired up an MCP server under deadline; it sails through the happy path, then a backend hiccups and takes the whole agent down with it. The hard parts are exactly the ones that got skipped.
The production layer — itemized.
One of your internal tools, shipped as a production-grade MCP server your team can run and trust. The scaffold is the fast start; the hardened layer on top is the deliverable — exactly what the commodity gigs leave out.
Fail-soft handling
A design, not a try/except. Backend-down, rate-limit, 401/403/404, malformed input, timeout — each returns a clean structured error that tells the agent when to retry, never crashing the session.
Auth-scoping
Per-tool scoping and a trust boundary that's proven, not asserted — tested against a resource the token can see and one it can't, so you know the boundary actually holds.
trust-tier isolationVersion-pinning
Two axes, not one: the dependency lockfile and the upstream API-version header — so a fresh install reproduces and the backend can't silently change response shape under you.
deps + API versionTest suite
Hermetic tests that pass on a clean checkout — covering the tool surface and the real failure set — so reliability is something you can re-verify, not take on faith.
green on clean checkoutSetup docs
A README a teammate can follow to run it unaided — env, install, register, run. No “works on my machine,” no single point of failure on the one laptop it was built on.
teammate-runnableHandoff walkthrough
One live walkthrough, registered and running in your environment, accepted against an explicit Definition of Done — plus a 14-day support window on delivered scope.
accepted vs. DoDWhy this is the whole point
Anyone can wrap the SDK and pass the happy path. The hardened layer above — the boundary that holds, the failure set that's handled, the install that reproduces — is what turns a demo into something your senior engineers don't have to babysit.
Don't take my word for it — read the code.
The capability is public and checkable: an open-source engine with a real test suite, and a production read-only server built end-to-end against the exact delivery process below.
Walkthrough, under 90 seconds
Watch the engine go from a YAML manifest to a live MCP serve call — the fastest way to see exactly what a sprint delivers, no checkout required.
Watch the demomcp-factory
A manifest-driven MCP server scaffolder and runtime hub. Write a YAML manifest, get a Claude MCP server scaffold — with batch registration and a live routing hub. The hardened production layer is built on top, per engagement.
View on GitHubgithub-mcp
Read+write over a real external API — the exact common client ask. A public GitHub REST API MCP server built against the same delivery kit: write tools off by default, typed rate-limit handling, fail-soft + version-pinned.
Read the case studyCase studies — no fabricated client wins.
These are my own public, tested builds — and an honest look at how I validate (and kill) systems. Every number links to the repo or write-up that backs it.
// reliability-retainer
The audit that catches the lie your dashboard can't: a portable Week-1 audit for dead-but-green agent fleets. The static hazard scan over-flags by design (>98% raw noise, proven on real repos) — the expert triage that prunes it to the handful of findings that matter is the actual deliverable. From ~$5k, one week, standalone. (Source repo is private — the count is self-verified, not independently checkable.)
// mcp-factory
A manifest-driven MCP scaffolder + runtime. 348 passing tests, public repo, and a Loom demo of a live test run in under 90 seconds.
Read the case study// github-mcp
Read+write over a real external API — the exact common client ask. Write tools off by default, typed rate-limit handling, 97 passing tests, public repo.
Read the case study// desktop-mcp
OS-level control when there's no API: screenshot, windows, input, screen-recording. Input off by default, rate-capped, 139 passing tests, public repo.
Read the case study// rag-mcp
Retrieval-augmented search exposed as an MCP tool. Local ONNX embeddings, fail-soft, 264 tests, $0 inference cost.
Read the case study// mcp-security-scanner
A static security scanner for MCP servers. Seven detector families run across Python and JS/TS; reachability + tool-parameter taint grading is Python-only, and JS/TS findings are reported ungraded rather than guessed. An honest confidence on every finding. 781 passing tests, public repo. Then on 2026-07-29 I measured it blind against ground truth fixed before the scan (per-item record not retained) — it came back 0/69 on recall, so I pulled the paid tier that same day rather than sell it. A recall fix the next morning took the same five targets to 88 findings, 2 of which survived a hand audit, 1 of real-world consequence. Pooled recall has not been re-scored since, so I quote no current number. The case study carries the full record.
Read the case study// rails-mcp
A default-deny agent-governance rail: an action registry + spend ledger + CLI-only sign-off audit trail, exposed as MCP tools. One invariant that can never be configured away; sign-off deliberately never reachable as a tool. 106 passing tests, public repo.
Read the case study// vllm-ops-mcp
Read-only ops/health for a local vLLM server: two-tier health (liveness vs real generation), GPU/VRAM, systemd status, live serve-flag introspection with secret redaction. Read-only, no lifecycle control, 95 passing tests, public repo.
Read the case study// discord-mcp
Read+write over the Discord REST API: 5 always-on read tools, 7 write tools gated at the route layer (not just the tool wrapper) and OFF by default. The destructive one (delete_channel) gets no separate, looser bar. 162 passing tests, public repo.
Read the case study// bus-mcp
Coordination tools for a fleet of AI agents: lane leases, threads, refutation votes and a shared task board over a self-hosted bus. 24 tools, writes off by default, operator-only routes never wrapped. 352 passing tests, public repo.
Read the case study// video-digest
Video in, working material out: keyframes + timestamped transcript + structured markdown digest, fully local, $0 cloud cost. Every subprocess/model/HTTP call dependency-injected and mocked in tests. 148 passing tests, public repo.
Read the case study// honest validation harness
The reliability story: how I forward-test systems honestly and retire the ones that don't earn their keep. Rigor, not returns.
Read the case study// one day of fleet reliability
A live ~30-lane agent fleet: a caught-and-fixed false visual PASS, a bus that self-healed 22 outages, an 8-day-dead bot revived by evidence chain, 4 registries smoke-tested before a stranger found the break.
Read the case study// an invisible position, same-day fix
A reconciler bug silently made a live paper position invisible to every exit path. The root cause, the same-day hardening, and the tests that prove it — no client name, no P&L figure, own fleet.
Read the case studyNotes on building MCP servers well.
Standalone write-ups on the parts of MCP work most tutorials skip. Useful on their own — no email required.
// the fleet audit methodology
The 7 detector families behind the reliability audit, where the tool stops and human judgment starts, and a self-audit that caught the tool's own blind spot.
Read the article// 13 servers, 1,170 findings, 1 real bug
I scanned 13 popular public MCP servers with my own scanner and hand-reviewed every P0/P1 flag. Aggregate results only -- no repo named, no scope list published.
Read the article// build a custom MCP server
A complete walkthrough for one internal tool — auth-scoping, fail-soft errors, and version-pinning included, not just the happy path.
Read the article// MCP server testing
A five-layer testing framework, a real fail-soft test, and the harder discipline: writing your kill bar down before you see the results.
Read the article// self-host your data layer?
What data sovereignty actually buys you, what it costs in ongoing engineering, and a real decision path — including "not yet."
Read the article// I found a CVE with a scanner that misses
A code injection bug in an AWS MCP server, now CVE-2026-85654 at CVSS 7.8. The tool that found it has a published recall of 0 out of 69, and that is the more useful number.
Read the article// auth-scoping patterns that hold
Trust-tier isolation, concretely — why one fat API key behind every tool keeps failing in public, and the scoped-credential pattern that contains a compromised call.
Read the article// what does MCP integration cost?
The wider market's real numbers, why the range is so wide, and our own flat published tiers — no sales call required to see them.
Read the article// liveness beyond uptime
A real false-PASS incident — dead agents rendering as live ones — and the liveness discipline that catches it before a stranger does.
Read the articleDay 0 to handoff, without improvising.
A repeatable flow: scope → build → harden → handoff. Fixed scope, an explicit Definition of Done, and a 2-day buffer held for the inevitable auth or edge-case surprise.
Scope & kickoff Day 0
Signed SOW + access. A scoping questionnaire picks the one tool, the actions that matter, the auth model, and what failure should look like. Kickoff call confirms it; we write the manifest.
Scaffold & build Days 1–3
Scaffold via mcp-factory, then implement the handlers for your tool. (If the API is undocumented, an explicit discovery line-item maps endpoints, auth, and real response shapes first — that's the real risk axis.)
Harden — the production layer Days 4–6
Where the value lives: auth-scoping, fail-soft across the real failure set, version-pinning on both axes, and error messages that tell the agent when to retry.
Test & validate live Days 7–8
Test suite green on a clean checkout, then live hub validation in your environment — including the auth-scope boundary proven against a private resource pair.
Handoff & accept Days 9–10
Setup docs, a live walkthrough, and acceptance against the Definition of Done — then a 14-day support window on delivered scope.
Priced by scope, not by the hour.
The number comes after a short scoping questionnaire, never before. The ladder below is the shape; we land on the right rung once we've seen your one tool, its auth model, and whether the API is documented.
- Recommended tool surface + auth strategy
- 3 risk flags + your estimated sprint tier
- Or a working read-only spike, same price
- Fully credited toward a sprint
- Auth-scoping, fail-soft, version-pinning
- Test suite, setup docs, handoff
- 1–2 weeks · 50% / 50% terms
- 14-day support window
- Multiple tools / data sources
- Scoped as its own engagement
- Reliability retainer available after
AI Agent Reliability Retainer.
Same discipline, pointed at your agent instead of ours: a validation harness gets built, proven live, and left running in your repo — then kept honest as your agent, model, and prompts drift. The harness is the deliverable, not a slide deck about one.
- Same harness discipline that backs this site's own proof numbers
- Delivered as a repo with a live, running pass/fail count
- Single-agent builds start near $5k; multi-agent / eval-pipeline builds scope to $50k+
- Regression suite run and triaged on every material change
- Eval-pipeline upkeep as models and providers rev
- Monthly written report — pass/fail counts, not vibes
- Running MCP servers specifically? See Managed MCP Watch
Not ready for an engagement? Start with the kit.
The same harness discipline, packaged to use on your own — plus a free 10-minute self-score to see where you actually stand before you spend anything. Both are instant downloads; the checklist just needs your email.
- 3 server templates: raw SDK, FastMCP, Node
- 9-chapter Honest Harness Playbook + a complete worked example
- 3 real packaging bugs, each with root cause + fix diff
- 6 dimensions, 18 questions, plain-language score bands
- An explicit "what this does NOT tell you" section
- Markdown + print-friendly HTML, no credit card
Follow the fleet, not the highlight reel.
A build-in-public engineering membership: the same harness discipline behind this whole site, written up as it happens — including the parts that don't work. No trading advice, ever; this is a record of engineering process, not a signals feed.
- Daily build-log — real commits, real losses, honest kill-verdicts
- Weekly fleet report card across every live system
- Member digest — the week's decisions distilled
- Member-only channels in the community Discord
FAQ
Do you work hourly?
No. Work is fixed-scope sprints, scoped and quoted flat after a short call. The entry point is a $1,500 MCP Readiness Audit (written report, no code), credited toward a Sprint if you proceed within 60 days.
How long does a Sprint take?
A typical Integration Sprint ships a working, tested server in about two weeks. Multi-source and self-hosted builds are larger and scoped separately.
What if I already have an MCP server?
The audit covers that too — a read of the existing server for auth-scoping gaps, fail-soft handling, version-pinning, and test coverage, delivered as a written risk log. The MCP spec is still moving; existing servers will need updates as it changes.
What stack do you support?
Python and Node MCP servers over REST, on cloud or self-hosted / on-prem. Auth via API-key, OAuth, or session-scoping. If your tools speak HTTP, they can be wired.
Can I see proof before committing?
That's the whole point. mcp-factory is public with 348 passing tests, and there's a Loom demo, under 90 seconds showing the test run, auth-scoping, and fail-soft handling live.
Do you have client testimonials?
Not yet — and I won't fabricate any. Instead I publish tested code you can check yourself and a case study on how I validate systems honestly (including killing ones that don't work). That's the trust signal, in place of borrowed logos.
Got an agent that needs to touch an internal tool?
Tell me the one system you'd wire in first. I'll send a short scoping questionnaire, set the tier, and you'll know exactly what you're getting before anything is signed.
No call required to start — a working repo and a clear scope beat a sales pitch.