MCP turns assistants into operators—plan accordingly
Model Context Protocol and similar tool layers let models call services that return live data. That is the difference between plausible prose and grounded answers—and it is also a new attack surface. If a model can query infrastructure, an attacker who influences the model may try to influence those queries.
The fix is not to ban tools; it is to apply the same rigor you would apply to any production API: authentication, authorization, rate limits, structured responses, and observability from day one.
Schema-first responses
Models handle JSON with stable keys far better than free-form paragraphs that pretend to be tables. Define schemas for tool outputs, validate server-side, and return errors the model can interpret. When something fails, prefer explicit failure over confident guessing about production state.
Read before write
- Ship read-only integrations first; prove value and safety before enabling mutations.
- Require approval workflows or human confirmation for destructive or far-reaching operations.
- Log every tool invocation with correlation IDs tied back to user, session, and model request.
- Allowlist hosts and methods; treat new tools like new microservices in your SDLC.
Failure modes worth rehearsing
Prompt injection attempts that try to exfiltrate through tools. Over-privileged credentials on a tool server. Stale data presented as current. For each, have a play: block, degrade, alert, or escalate. The teams that ship safely are the ones that red-team the assistant, not just the firewall.
Azure and hybrid environments
In Azure-heavy estates, tie tool permissions to managed identities and subscription scope. Avoid long-lived secrets in tool servers where Managed Identity can do the job. Where data spans cloud and on-premises, be explicit about which queries cross boundaries and how latency affects the user experience.
Hybrid does not mean “hope the VPN holds.” It means documented paths, monitored health, and fallbacks when a link degrades.
Governance and versioning
Tools change as fast as models. Version your tool schemas, publish deprecation notices, and monitor error rates when upstream APIs shift. Assistants amplify failures: a broken tool surfaces as confident nonsense unless you validate responses and surface errors to users clearly.
I treat tool catalogs like internal product APIs—with owners, SLAs, and changelogs—because that is what they are.
Pulling it together
MCP and tool-calling are force multipliers when you treat them as production systems. The assistant is the UX; the tools are the backend. Invest accordingly.
If you would not ship a REST API without auth and monitoring, do not ship a tool without the same. The blast radius is just as real.