MCP Client and Tool Integration

Pathrule3 Rules • 2 Memories • 1 Skill

An MCP client connects model decisions to external tools and resources, so server discovery, capability negotiation, user consent, authentication, transport lifecycle, schema validation, cancellation, and untrusted result rendering become application security boundaries. This pattern constrains tool invocation and result trust, records connection and capability ownership, and supplies a client integration verification workflow. It complements MCP server authoring by focusing on the host or client that discovers servers, presents tools to a model, obtains approval, executes calls, and renders returned content.

Suggested path map

Pathrule places each piece on the matching path, so your assistant only sees it where it belongs. This is the scoping you get on import; you can adjust it in your workspace.

/ workspace root

verify-mcp-client-integration

src/

tools/

Authorize each tool call at the moment of effect

Tool descriptions are model affordances with product ownership

mcp/

Validate discovery and results as untrusted protocol data

Retry tool calls only when effect semantics permit it

Connection lifecycle owns authentication and capability state

Rules

Authorize each tool call at the moment of effect/src/toolshighstrictCombine server trust, declared tool schema, current user intent, target scope, and write risk before execution.

1	Connecting a server or listing a tool does not grant blanket authority. Tool descriptions are server-controlled content and can understate the real effect or change over time.
2
3	- Classify tools as read, local write, external write, sensitive read, destructive, or privileged and apply the product's consent policy to the actual call.
4	- Show the user or policy engine the resolved server, tool, arguments, target, and expected effect before approval where required.
5	- Do not allow model text or a server response to broaden credentials, paths, recipients, or resources beyond the active user request.
6	- Record approval and execution outcome with bounded arguments and identities while redacting secrets and unnecessary personal data.
7
8	See /src/mcp for the adjacent decision or procedure that completes this constraint.

Validate discovery and results as untrusted protocol data/src/mcphighstrictCheck capability, schema, size, content type, resource URI, and result shape before exposing them to models or application renderers.

1	Servers can be buggy or malicious, and tool results can contain prompt injection, unsafe links, oversized payloads, or content types the client is not prepared to display.
2
3	- Accept only negotiated capabilities and protocol messages valid for the active connection and supported client version.
4	- Validate tool input and output against bounded schemas and reject unknown or oversized content before model context assembly.
5	- Treat text and resources returned by servers as untrusted data, not higher-priority instructions, and preserve provenance in model context.
6	- Render links, markdown, images, resources, and embedded content through application security policy without executing arbitrary HTML, scripts, or local paths.
7
8	See /tests/mcp for the adjacent decision or procedure that completes this constraint.

Retry tool calls only when effect semantics permit it/src/mcphighstrictUse deadlines, cancellation, stable operation identity, and explicit idempotency before repeating an interrupted call.

1	A transport close or timeout does not prove the server failed before performing the effect. Automatic retry can send the same message, create the same issue, or delete the target twice.
2
3	- Assign a deadline and propagate cancellation through the transport and tool execution path.
4	- Retry read-only or explicitly idempotent tools under a bounded policy and preserve the same logical operation identity.
5	- For ambiguous state-changing outcomes, query server or external state by operation identity before deciding whether to repeat.
6	- Surface unknown outcome separately from failure so the user can reconcile instead of receiving a false success or triggering another automatic action.
7
8	See /src/tools for the adjacent decision or procedure that completes this constraint.

Memories

Connection lifecycle owns authentication and capability state/src/mcpBind tokens, negotiated features, server identity, tool catalog, subscriptions, and pending requests to one connection owner.

1	Transport reconnect can change server version, authentication, tools, or capabilities. Reusing cached discovery blindly after reconnect makes the client call a stale or differently scoped surface.
2
3	- Authenticate through the approved flow and keep credentials scoped to server, user, audience, and required capabilities.
4	- On connection establishment, negotiate capabilities and discover the surfaces the client supports rather than assuming every server implements every feature.
5	- Cancel or reconcile pending requests on disconnect and clear subscriptions and progress handlers owned by the old connection.
6	- Rediscover after reconnect and make changed tools or permissions visible before the model can invoke them.
7
8	See /src/tools for the rule or workflow that puts this decision into practice.

Tool descriptions are model affordances with product ownership/src/toolsPresent concise accurate effects, arguments, limits, and failure behavior while keeping security policy outside server-provided prose.

1	Models select tools from names, descriptions, and schemas. Poor affordances cause wrong calls, but trusting a remote description to define security lets the server write its own permissions.
2
3	- Normalize tool names with server identity where collisions are possible and preserve the original protocol identity for calls.
4	- Expose descriptions and argument schemas within context budgets and omit tools unavailable to the current user or task.
5	- Keep approval, target restrictions, rate limits, credential scopes, and destructive-action policy in the client or host.
6	- Measure tool selection and failure evidence without storing sensitive argument values, then improve affordances through reviewed client configuration.
7
8	See /tests/mcp for the rule or workflow that puts this decision into practice.

Skills

verify-mcp-client-integration/rootTest MCP discovery, consent, auth, transport, schemas, cancellation, retries, result rendering, and reconnect behavior.

1	---
2	name: verify-mcp-client-integration
3	description: Verify an MCP server connection or tool integration in an AI client.
4	---
5
6	# Verify Mcp Client Integration
7
8	Run this procedure when the affected surface changes, before the result is promoted to production. Record evidence for every step instead of accepting a plausible-looking result.
9
10	1. Connect with valid, expired, wrong-audience, missing, and revoked credentials and negotiate supported and unsupported capabilities.
11	2. Discover duplicate, changed, malformed, oversized, and unauthorized tools and resources and confirm policy filters them before model exposure.
12	3. Invoke read, external-write, destructive, invalid, slow, cancelled, ambiguous, and idempotent calls and verify consent and retry semantics.
13	4. Return prompt-injection text, unsafe links, unexpected content types, large resources, and malformed structured results and confirm provenance and safe rendering.
14	5. Disconnect during pending calls and subscriptions, reconnect to a changed catalog, and prove stale tools, handlers, credentials, and outcomes are cleared or reconciled.
15
16	## Exit criteria
17
18	The change is complete only when the expected behavior, failure behavior, and rollback path have all been exercised with representative data. Preserve the evidence with the change so the next operator can repeat the same checks.

Why this pattern

AI agents often auto-approve discovered tools, persist broad tokens, trust server result text as instructions, or retry a side-effecting tool after an ambiguous transport failure.

Built for Teams building AI hosts, assistants, editors, or agents that connect to Model Context Protocol servers.

Keeps your assistant from:

Giving a newly discovered server silent external-write authority
Executing a tool call outside the user's intended scope
Treating returned content as trusted application instructions
Duplicating a side effect after transport interruption

View as markdown

License: Apache-2.0
Version: 1.0.0
Updated: 2026-08-25