The Octri Blog
News, guides & deep-dives
Product updates and practical writing on API documentation, SDKs, and developer experience.
Showing articles tagged #mcp.
Engineering3 min read
MCP or CLI? Run the same API workflow through both
Compare agent interfaces with the same task, permissions and outcome checks. Token counts mean little when one path does less work.
Engineering3 min read
Your MCP server authenticates users. Does it preserve their permissions?
Follow identity from MCP client to downstream API. Check token audiences, delegated credentials and tenant authorization at each boundary.
Engineering3 min read
Your API response is eating the agent's context window
Design bounded responses that preserve useful facts. Filter, select and aggregate before large intermediate payloads enter an agent's context.
Engineering3 min read
Your read-only MCP server can still carry a prompt injection
A tool can avoid writes while returning hostile instructions. Treat customer-controlled API content as untrusted data throughout an agent workflow.
Guides5 min read
Your MCP server needs documentation, and it is not your API docs
There is no spec format for MCP servers yet, so what an integrator gets is a README and a config snippet. Here is what actually has to be in it.
Engineering5 min read
How many tools should an MCP server expose?
Exposing your whole API to an agent makes it worse, not more capable. Tool choice is a selection problem, and every extra option makes the selection harder.
Engineering5 min read
MCP vs OpenAPI: they answer different questions
The comparison is framed as a replacement and it is not one. One describes an API to people and compilers. The other hands a running agent a set of things it may do.
Engineering6 min read
Giving an agent write access to your API: what to exclude first
A tool call is a real request against a real API. Before you connect one, the question is not which endpoints to expose. It is which ones an agent must never reach.
Engineering5 min read
Why coding agents invent endpoints you never shipped
An agent asked to integrate your API will recite one it saw in training or guess from the name. Both produce code that looks right and does not run. The fix is not a better prompt.