https://mcpdone.com/blog Notes on building with Claude Code: MCP servers, hooks, agents, and the operational side of shipping AI-first workflows. en Tue, 02 Jun 2026 00:00:00 GMT https://mcpdone.com/blog/mcp-stdio-vs-http https://mcpdone.com/blog/mcp-stdio-vs-http Tue, 02 Jun 2026 00:00:00 GMT An MCP server can talk to its client over stdio (subprocess) or HTTP/SSE/streamable-HTTP (network). The choice changes your auth model, your attack surface, your multi-tenancy story, and the kind of bugs you ship. Most builders default without thinking — here's the decision matrix, the operational consequences of each transport, and when "start stdio, migrate later" is the right move. mcp transport architecture claude-code security https://mcpdone.com/blog/badhost-mcp-servers https://mcpdone.com/blog/badhost-mcp-servers Thu, 28 May 2026 00:00:00 GMT BadHost (CVE-2026-48710) is a Starlette flaw where a single crafted Host header bypasses path-based authorization — and Starlette powers FastAPI, vLLM, LiteLLM, and most HTTP-transport MCP servers. Here's the precise blast radius for MCP operators (stdio servers aren't exposed, HTTP/SSE servers are), how to check in 30 seconds, the fix, and why credential-rich MCP servers make this worse than its CVSS 6.5 suggests. mcp security starlette fastapi vulnerability claude-code https://mcpdone.com/blog/testing-fastmcp-servers https://mcpdone.com/blog/testing-fastmcp-servers Wed, 06 May 2026 00:00:00 GMT A taxonomy of the layers in a FastMCP server, what your existing tests probably cover (and don't), and the minimum test set that would have caught every wrapper-layer bug we've shipped. Concrete patterns for each layer — assert tool shape, exercise the protocol, lint the anti-patterns — with copy-pasteable code. mcp fastmcp python testing claude-code https://mcpdone.com/blog/shipping-four-mcp-servers https://mcpdone.com/blog/shipping-four-mcp-servers Wed, 06 May 2026 00:00:00 GMT Concrete patterns that emerged across mcp-content-opportunity, mcp-sqlite-query, mcp-gmail-reader, and mcp-twitter — what surprised us, what we'd do differently, and the seven non-obvious lessons that should be in any FastMCP project from the first commit. mcp fastmcp claude-code lessons-learned architecture https://mcpdone.com/blog/mcp-server-build-cost https://mcpdone.com/blog/mcp-server-build-cost Wed, 06 May 2026 00:00:00 GMT A grounded breakdown of the four cost dimensions of an MCP server — API call billing, hosting, build time, ongoing maintenance — with real numbers from four shipped servers in 2026. When DIY makes sense, when hiring is cheaper, and the hidden costs most teams don't price in. mcp claude-code pricing cost-analysis build-vs-buy https://mcpdone.com/blog/fastmcp-wrapper-layer-bug https://mcpdone.com/blog/fastmcp-wrapper-layer-bug Tue, 05 May 2026 00:00:00 GMT A FastMCP @mcp.tool() with sync def + asyncio.run() inside passes every unit test, then breaks at the first protocol call with "asyncio.run() cannot be called from a running event loop." Here's why, the fix, the AST lint that catches it across any FastMCP project, and the broader principle — test the wrapper layer, not just the inner functions. mcp fastmcp python testing bugs asyncio https://mcpdone.com/blog/skills-agents-slash-commands https://mcpdone.com/blog/skills-agents-slash-commands Sat, 25 Apr 2026 00:00:00 GMT Three customisation mechanisms in Claude Code that people conflate constantly. When to reach for each, what they cost, and the one anti-pattern that ruins all three. claude-code skills agents slash-commands https://mcpdone.com/blog/production-mcp-servers https://mcpdone.com/blog/production-mcp-servers Fri, 24 Apr 2026 00:00:00 GMT A field guide to building MCP servers you'd actually put in a team's shared config. Error handling, testing strategy, deployment patterns — and the failure modes I see in almost every MCP server on GitHub right now. mcp claude-code python testing production https://mcpdone.com/blog/mcp-server-to-triage-my-sales-inbox https://mcpdone.com/blog/mcp-server-to-triage-my-sales-inbox Fri, 24 Apr 2026 00:00:00 GMT A case study in deliberate constraint. Building a Claude Code MCP server for Gmail that reads one label, drafts replies to the Drafts folder, and has no capability to send or delete — three independent safety layers, 55 tests, and a design I'd trust on a shared account. mcp claude-code gmail imap python security https://mcpdone.com/blog/claude-code-hooks-that-dont-break-your-workflow https://mcpdone.com/blog/claude-code-hooks-that-dont-break-your-workflow Thu, 23 Apr 2026 00:00:00 GMT Four rules for writing Claude Code hooks that catch real problems without annoying you into disabling them. With two working hook scripts (secret-blocking + bash logging) you can drop in today. claude-code hooks python workflow https://mcpdone.com/blog/the-claude-code-deny-list-most-teams-skip https://mcpdone.com/blog/the-claude-code-deny-list-most-teams-skip Wed, 22 Apr 2026 00:00:00 GMT Why a five-line deny list in your .claude/settings.json is the cheapest foot-gun protection in Claude Code, what to put in it, and how it interacts with hooks. claude-code security settings hooks https://mcpdone.com/blog/i-built-an-mcp-server-to-plan-this-blog https://mcpdone.com/blog/i-built-an-mcp-server-to-plan-this-blog Tue, 21 Apr 2026 00:00:00 GMT A walkthrough of building a Model Context Protocol server that mines Hacker News and Reddit for content opportunities, ranks them with a simple 5-signal heuristic, and surfaces ten unanswered questions developers are asking about Claude Code and MCP. mcp claude-code python indie-building