MCP Server & Tool Definition Guidelines

Every tool definition must declare explicit JSON data types, strict value constraints, and set additionalProperties: false. Never accept generic untyped object or any parameters.

Tool descriptions instruct model reasoning. Write strictly functional descriptions detailing capabilities and required input formats; never include persona rules or behavioral directives that can be manipulated via prompt injection.

Cryptographically hash and sign tool definitions upon registration. The LiteLLM gateway verifies active tool hashes against registry records prior to execution to prevent "rug pull" attacks (unauthorized post-approval definition modifications).

Remote MCP servers must enforce OAuth 2.1 with mandatory PKCE for client authentication.

Assign permissions per individual tool function (mcp:database:read) rather than server-wide (db:*). An agent granted file read access must not inherit file deletion authority.

Do not store static credentials in environment variables or configuration files. Fetch short-lived tokens at runtime via Google Cloud Secret Manager.

Production MCP servers must deploy to unprivileged Google Cloud Run containers executing with non-root user contexts (uid 10001) and read-only root filesystems.

Route server traffic through private VPC networks with strict egress allowlisting via VPC Service Controls to prevent SSRF or unauthorized internal IP access.

Standard I/O (stdio) transport is restricted to local development environments. All remote production connections require TLS 1.3 encrypted HTTP/SSE connections.

Any MCP tool executing data creation, modification, deletion (INSERT, UPDATE, DELETE), or financial transactions must pause execution and emit an event to the Pub/Sub HITL topic.

Unapproved or timed-out tool calls automatically fail after 300 seconds and return a structured execution failure to the orchestrator.