Lessons from shipping a remote MCP server with per-user keys
Salt_Bike898 · reddit · 2026-11-10
A developer shares five hard-won lessons from building GramClaw's remote MCP server with per-user keys:
- Tool descriptions are your UX: the model only knows what the description says; explicitly stating "return approvalrequired, tell the user to click Approve, don't retry with different arguments" killed many weird retry loops.
- Treat tool output as untrusted: tools return chat messages where anyone can write anything, so content is labeled untrusted in descriptions and results.
- Writes should be idempotent: a repeated call with identical arguments should report "already executed" instead of firing twice.
- Scopes beat one big key: read / send / write / campaign lets users start read-only and grow in.
- Some MCP directories require a public repo even for hosted servers — solved with a README-only repo.
The author is also asking for auth advice: currently using a key in the URL and wondering when OAuth becomes worth it.
More from coding & agent
- He Vibe-Coded a Calorie Tracker to Avoid Paying: 'Most Apps Have No Moat' — weswinder · 2026-11-10
- From Frameworks to Full Agent Platforms: Who Wins the Agent Platform Market — prasannaalahoti · 2026-11-10
- Hermes Agent Matches Claude Code on Benchmarks but Costs More per Task — EXM7777 · 2026-11-10
- Invest in engineering, not agent factories: Geoffrey Huntley says Nix and fast builds get uplifted by model drops — sloppenheimer · 2026-11-10
- Coding tip: tell the new model "This codebase is yours" to make it bolder, plus always read the model card — sloppenheimer · 2026-11-10
- Local Qwen judges stream clips for free: a zero-token auto-clipping pipeline — TangeloOk9486 · 2026-11-10