Two weeks is realistic, and I think the reason it is realistic is worth stating plainly: the scope is one clearly bounded problem. A fixed set of tools mapped to existing API endpoints, authentication that reuses what the product already has, and a short list of things it will not do yet.
The part I would add is a security pass before launch. Each tool should run with the narrowest permissions possible, write actions should be separate from read actions, and there should be per tenant rate limits so one assistant cannot hammer the API. Writing those into the definition of done keeps the two week estimate honest.
Which tools did you choose to leave out of the first version?
Exactly — the two weeks only holds because the scope is boxed in: existing API, a short tool list, and auth patterns that are already standard. The moment you add "and also build the missing endpoints" or multi-tenant permissions that the API doesn't model, it's a different project. That's why I write the one-page tool spec first: it's where the scope gets fixed. Thanks for reading!
Two weeks is realistic, and I think the reason it is realistic is worth stating plainly: the scope is one clearly bounded problem. A fixed set of tools mapped to existing API endpoints, authentication that reuses what the product already has, and a short list of things it will not do yet.
The part I would add is a security pass before launch. Each tool should run with the narrowest permissions possible, write actions should be separate from read actions, and there should be per tenant rate limits so one assistant cannot hammer the API. Writing those into the definition of done keeps the two week estimate honest.
Which tools did you choose to leave out of the first version?