The interesting part isn't really the single MCP URL; it's the separation between discovery, paid data access, and verification. That gives the agent a much better control surface than letting it freely search and reveal everything in one step.
The same pattern applies beyond people data: keep cheap exploration separate from irreversible or billable actions, enforce limits outside the model, and make repeated operations idempotent. The polling example is a good detail here if the agent doesn't understand operation identity, a retry can quietly become a second paid action.
I’d also treat the OAuth boundary as part of the tool’s security contract. The model should be able to request an operation, but the MCP server should independently enforce identity, scope, credit limits, and access to the underlying data. That distinction becomes increasingly important as MCP tools move from read-only retrieval into actions with real cost or external side effects.
The interesting part isn't really the single MCP URL; it's the separation between discovery, paid data access, and verification. That gives the agent a much better control surface than letting it freely search and reveal everything in one step.
The same pattern applies beyond people data: keep cheap exploration separate from irreversible or billable actions, enforce limits outside the model, and make repeated operations idempotent. The polling example is a good detail here if the agent doesn't understand operation identity, a retry can quietly become a second paid action.
I’d also treat the OAuth boundary as part of the tool’s security contract. The model should be able to request an operation, but the MCP server should independently enforce identity, scope, credit limits, and access to the underlying data. That distinction becomes increasingly important as MCP tools move from read-only retrieval into actions with real cost or external side effects.