Building a Remote MCP Server for Real SaaS: OAuth 2.1, 70 Task-Shaped Tools
djskrilled · reddit · 2026-11-12
A developer of Perfect HOA, a vertical SaaS for HOA management, shares design lessons from shipping a remote MCP server: 70 task-shaped tools instead of route-shaped ones for more reliable tool selection; OAuth 2.1 with PKCE and dynamic client registration so one CLI command opens browser sign-in; scoped tokens that can only narrow dashboard permissions; destructive write annotations with confirm-before-write; prices returned before paid actions; audit logs attributing every write as 'user via MCP'; Idempotency-Keys to prevent double-recorded payments; and making ambiguity a bug by returning explicit fields like balancestatus instead of sign conventions models must infer.
More from coding & agent
- Nearly one-shot: Fable 5.2 with Opus subagents creates Taj Mahal explainer video — CurieuxExplorer · 2026-11-12
- Princeton & Anthropic find the Memory Trap: agents skip verification on a $1.2M payment — aigclink · 2026-11-12
- DataTalks.Club launches free 5-week course on production AI agents for generative media — Al_Grigor · 2026-11-12
- Claude designs 3 working gadgets from one-paragraph prompts, specs to firmware in a day — JafarNajafov · 2026-11-12
- Dev uses hourly "Ok" scheduled task to keep Claude's 5-hour usage window always fresh — umeshonai · 2026-11-12
- Security engineer: MCP servers' generic execute tools break granular tool controls — kai · 2026-11-12