Great observation Kartik! The rule of thumb I'd use: expose actions, not infrastructure. A provider should publish what it can do (search flights, book, cancel, check status), not raw database access or internal system internals. The boundary is capability vs infrastructure.

And this is actually a real security conversation happening right now. If a provider exposes too much through an MCP, a poorly-scoped agent could read data it shouldn't, trigger unintended actions, or become an attack surface for prompt injection. Production teams are genuinely cautious about this — which is part of why adoption has been slower than the hype suggests.

There's also an interesting industry shift happening: until recently, there was a whole ecosystem of startups, consultants, and freelancers whose job was to build the custom product or infra layer for your specific AI usecase — designing how AI plugs into your business end to end. MCP is quietly threatening that. When the protocol is standardised and any AI can discover what your service does, that bespoke integration business gets a lot harder to justify.

Going deep on this in the MCP dedicated post later in the series.