---
title: "MCP servers · Agent Wranglers"
url: https://agentwranglers.se/playbook/agents-as-users/mcp-servers
parts: 9
tokens_total: 8559
updated: 2026-10-22
tokens: 1070
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# MCP servers

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agents as users](https://agentwranglers.se/playbook/agents-as-users.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

> Build MCP servers to the 2026-07-28 specification. No sessions, metadata documents for clients, checked headers, small tool lists, cache hints and tasks.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/agents-as-users/mcp-servers">Agent Wranglers agents as users playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- AGT-12 [Check the caller's rights on every handle](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/check-handle-owner.md) · 923 tokens · updated 2026-10-22
  A handle that one tool returns and another accepts names data, it does not grant access. Check on every call that the caller's token may use it.
- AGT-14 [Reject MCP requests whose headers disagree with the body](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/mcp-header-validation.md) · 1,099 tokens · updated 2026-10-22
  Require `MCP-Protocol-Version`, `Mcp-Method` and, on tool calls, resource reads and prompt requests, `Mcp-Name`. Refuse any request whose headers differ from its JSON body.

## Recommended

- AGT-11 [Build the MCP server without sessions](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/stateless-mcp-server.md) · 948 tokens · updated 2026-10-22
  Answer every MCP request from that request alone. Read the protocol version and client capabilities from its `_meta`, and keep state across calls only behind handles passed as tool arguments.
- AGT-13 [Register MCP clients with Client ID Metadata Documents](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/client-id-metadata-documents.md) · 1,067 tokens · updated 2026-10-22
  Let MCP clients you have never met use an HTTPS address as their client ID. Fetch the metadata document there and check it, instead of open dynamic registration.
- AGT-15 [Keep the tool list within a token budget](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/tool-list-budget.md) · 980 tokens · updated 2026-10-22
  Set a token budget for the whole `tools/list` answer and fail the build when it grows past it. Each tool's description says when to use it and when not to.
- AGT-16 [Report bad arguments as tool results instead of protocol errors](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/tool-errors-as-results.md) · 764 tokens · updated 2026-10-22
  Return bad arguments, missing records and business rule failures as a tool result with `isError: true`. Keep JSON-RPC errors for unknown tools, malformed requests and server faults.
- AGT-17 [Send cache hints and a stable order with every list](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/list-cache-hints.md) · 905 tokens · updated 2026-10-22
  Return list results in the same order while the set is unchanged. Give each cacheable result a `ttlMs`, and a `cacheScope` of `private` whenever it depends on who asks.
- AGT-18 [Sign the state you hand back for a second round](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/signed-request-state.md) · 1,119 tokens · updated 2026-10-22
  When a tool needs more input, return an `input_required` result. Sign any `requestState` you include, and check the signature on the retry.

## Optional

- AGT-19 [Run long work as tasks](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/mcp-tasks.md) · 754 tokens · updated 2026-10-22
  When a tool call takes longer than 30 seconds, return a task handle through the MCP Tasks extension. Return it only to clients that declared the extension.

- Previous: [Delegated access and consent](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent.md)
- Next: [Safe actions](https://agentwranglers.se/playbook/agents-as-users/safe-actions.md)
- [All chapters](https://agentwranglers.se/playbook/agents-as-users.md)