What problem does it solve? Exposing application capabilities to AI agents through an MCP endpoint requires careful decisions about tool design, authorization scopes, service-layer boundaries, and testing, and mistakes create security holes or confusing agent behavior. ## Core Features & Use Cases - Tool Design Guidance: Decides whether a capability should be a tool at all, favoring user-level steps over raw endpoint exposure and search over unbounded list operations. - Structured Tool Implementation: Enforces Zod input schemas, output schemas with structuredContent, behavioral annotations, and audited registration in src/lib/mcp/server.ts. - Scope and Consent Management: Splits OAuth scopes when a tool's blast radius differs, updating the consent screen labels so users understand what they grant. - Use Case: When adding an archive_note tool, the skill walks through extending the service layer, registering the tool with audited() logging, writing integration tests via the mcp-request helper, and documenting the change in the architecture docs. ## Quick Start Add a new MCP tool that lets agents search notes by keyword, following the service-layer boundary and registering it with audited logging.
