Most of the MCP discussions I come across are about connecting AI models to tools. At work, our team used it for something a little different.

We built a cloud migration cost estimation pipeline using three MCP servers and Python, without an LLM or an AI agent involved.

The interesting part is that MCP handled the interaction with the tools, while the actual estimation stayed deterministic. No model interpreting the request or generating an answer; just defined inputs, tool calls and calculations.

I work at CloudKeeper, and our team recently wrote up the implementation. It got me thinking about whether MCP could be useful in regular backend services and automation too, rather than only in AI-powered applications.

Has anyone here tried using MCP this way? I'm curious what other non-AI use cases people have found for it.

I sometimes manage my products’ social accounts between sets at the gym. An idea comes up, I message Hermes on Telegram, and review what it makes when I check my phone again.

Here’s the setup if you want to try something similar:

1. Connect Hermes to Telegram
   Hermes Agent is an open-source agent by Nous Research. Its messaging gateway lets you talk to it through Telegram while it uses tools on the machine where it’s running.

2. Give it a small brand brief
   Save the product description, audience, tone, things to avoid, and which accounts belong to the product as a reusable skill. This saves you from explaining everything again for every post.

3. Connect creation and publishing tools
   I use fal.ai for image generation/editing and PostSider for scheduling and publishing. Disclosure: I’m building PostSider, so this is also how I use my own product. It exposes an API and MCP tools the agent can call.

4. Ask for a concrete deliverable
   For example:

Create a Drake-style meme for Local Waifu: rejecting cloud AI, approving local AI. Write a short caption for its X account. Show me the image and exact caption. Don’t publish or schedule anything yet.

Hermes can find a source image, prepare the asset, write the caption, and send it back through Telegram. Simple text overlays don’t necessarily need image generation.

1. Review, then approve a specific action
   Once the result looks right:

Schedule this approved image and caption on Local Waifu’s X account tomorrow at 18:00 Europe/Warsaw. Confirm the account, time, and scheduled status afterward.

A few things worth getting right:

• Keep creation permission separate from publishing permission.
• Specify the exact brand account, not just “post to X.”
• Start with one platform before adding more.
• Have the agent check the returned post status. “Scheduled” doesn’t mean “published.”
• Keep API keys out of prompts and saved brand instructions.

The biggest benefit for me isn’t generating a huge volume of content. It’s turning an idea into a finished post without opening an editor, downloading files, and switching to a scheduler.

I still decide what’s worth posting. The agent handles the steps between the idea and publication.

I’m one of the founders of DronaHQ. We kept seeing the same thing: teams build internal tools fast with Claude Code or Cursor, then get stuck at hosting, auth and database credentials.

So we built the DronaHQ MCP. From your IDE, the agent can:

• deploy front-end apps into a hosted runtime
• push JSON configs that become live APIs, webhooks, scheduled jobs or workflows
• bind to SQL, NoSQL, REST or gRPC connectors whose credentials stay in a vault, so generated code never holds a secret

Everything lands behind SSO, role-based access and an audit trail. Admins control which users get which apps, which devs can build for which teams, and which apps can reach which data. It runs on our cloud or self-hosted.

I’m doing a live build tomorrow (Fri Oct 16, 3–4 PM PT). also you can signup and try build app for your enterprise. The first 10 people to ship to prod & submit will get a chance to win AirPods 4. Challenge and theme to be posted tomorrow when I open the page. https://luma.com/ps4ti0oh

Been looking into MCP integrations and the banking side is pretty interesting.

I can see the value in connecting Claude to a business account to check transactions, track expenses or flag payments that need attention.

But giving an agent permission to actually move money feels like a completely different thing.

Personally I'd be fine with read-only access but anything involving transfers or payments should need approval.

Anyone here experimenting with financial MCP servers?

How much access would you trust an agent with?

The MCP server I created: https://glama.ai/mcp/servers/seleniumbase/SeleniumBase is #1 this week for browser automation (https://glama.ai/mcp/best/browser-automation). It lets you automate browsers and do web-scraping while bypassing bot-detection. It includes a tool for handling CAPTCHAs.

The SeleniumBase MCP server files are located at https://github.com/seleniumbase/SeleniumBase/tree/master/mcp_servers, with the main GitHub page at https://github.com/seleniumbase/SeleniumBase.

I also created a YouTube video about it: https://www.youtube.com/watch?v=wQI3hUO9qmA

Bellman is a hosted MCP server for multi-agent rooms. Claude Code, Claude Desktop, claude.ai, ChatGPT, Cursor and Gemini CLI sessions, on different machines and owned by different people, join one room, message each other, and share a canvas. There's a public room open now if you want to point a client at it (links at the bottom).

Some things that might be useful if you're building something similar:

MCP has no push, so the room is a log you poll. Every room is an event log in a Cloudflare Durable Object. Clients read it with a long poll that's capped at 25 seconds, because that's under the strictest client tool-call timeout I found. The log is the only source of truth. Every faster path is just a convenience.

A local bridge for clients that can idle. Claude Code connects through a small stdio bridge that proxies the remote tools, queues peer events locally, and lets the agent block on a local wait tool instead of re-polling. When several sessions on one machine are in the same room, they share one WebSocket over a Unix socket rather than each polling. A Stop hook hands queued events back to the agent, so it doesn't have to remember to check.

OAuth was required, not optional. claude.ai, Claude Desktop connectors and ChatGPT only accept OAuth for custom connectors, so the server is its own authorization server, signing in with GitHub or Google. Clients that can send a header just use a bearer key.

Permissions are enforced by the server, not by the prompt. A room's manifest gives each role a fixed set of verbs: send, invite, revoke, request_actions, respond_actions, write_surface. A call outside your role gets refused. Every peer message reaches your agent wrapped as untrusted data, and any action request one agent makes of another is approved by the receiving *human*, not their agent.

MCP Apps for the UI. One `ui://` resource renders the join preview, a room monitor and the canvas in hosts that support MCP Apps. Hosts that don't get the same results as text.

The public room. It's called the Lobby. Guests can only send text: no action requests, no files, no canvas writes. A hosted agent asks the room a question every six hours. The whole log is readable without signing in, so you can watch before you join.

Read it: dash.bellman.sh/r/the-lobby

Join: bellman.sh/j/BELL-ABC8-NJ-GUEST

Server (MIT): github.com/bellman-sh/bellman

Endpoint: https://mcp.bellman.sh/mcp

Disclosure: I built it. Joining is free. I'd especially like to hear from anyone who's dealt with push in MCP, or with how hosts handle MCP Apps resources over proxies, because that's where I hit the most walls.

Hey everyone,
I've been using LLM for binary analysis tasks, especially for malware, but when it came to larger file or multiple files, I couldn’t find a lightweight, non-GUI focused MCP server that fit my workflow. To scratch my own itch, I spent some time pairing with AI to build one that matches my requirement. It bridges LLMs with Rizin, RzGhidra, and Mandiant capa, allowing the model to interactively analyze local binaries without uploading sensitive artifacts to external clouds(Well, if you use local LLMs). Architecture & Capabilities The server exposes several tools to the LLM context:
open_and_analyze: Executes Rizin's `aaa` for auto-analysis.
decompile_function: Fetches C pseudocode using rz-ghidra.
get_capa_analysis: Runs Mandiant capa against the binary to map capabilities to MITRE ATT&CK or malware behaviors.
list_functions / get_binary_info: For structural inspection (entry points, function sizes, sections).

Looking to Learn & Maintain
This is my first time maintaining a specialized MCP server in the open-source space. The initial setup works fine for my specific environment, and I'm sharing this here because I want to actively learn how to maintain an open-source repo. My main goal right now is to practice debugging, managing issue workflows, and refining the tools based on real-world use cases. If you are into reverse engineering, malware analysis, or CTFs, I'd highly appreciate it if you could give it a spin.

Repo: https://github.com/kd992102/rizin-mcp
License: MIT (Totally free, local, and open)
If you encounter any environment crashes, syntax bugs, or have ideas on how to optimize the tool schemas, please open an Issue on GitHub. I'm looking forward to diving into the logs and squashing some bugs. Thanks!

Is there a video tutorial that I can watch? I saw there's a new update that changes everything, like stateless or something. I don't know much. How do I start?

hey! im exploring different ways to let my ai agents interact with email and mcp seems like an interesting option. Really looking into searching emails, replying messages and getting notified when new emails come in would be very useful. for those who are building with ai agents fo you prefer to have a seperate inbox for it or just letting in go directly to your own inbox, any good thoughts as well for an alternative email inbox ideal for ai agents? been hearing multiple mentions of agentmail, hostinger agentic mail and nylas, pros and cons?

hey guys, does anyone have a spare claude guest pass? been using chatgpt lately but want to try claude code before subscribing. if anyone has one available, id really appreciate it. thank you

Hey everyone, I'm a solo founder. I sell private label on Amazon EU, and I got tired of running my account across ten different reports. So I built something for myself, and now I'm opening it up.

It pulls everything you need to manage an Amazon account into your own AI agent (Claude, ChatGPT or Cursor): PPC, organic rank, Brand Analytics, inventory and margin. The best part is that you add your own skills, your own rules, and the agent applies them to all that data.

Example: for one keyword, the agent sees how much you spent on ads, what it brought in, and that its organic rank went up 10 spots. Your skill checks that against your rules and tells you whether to push the change or not. Nothing touches Amazon until you approve it.

I'm not asking you to buy anything. If you know someone doing Amazon FBA, please share this with them. I'd really appreciate honest feedback too, here in the thread.

Thanks for reading 🙏

I built vibe-testing because an agent saying 'done' wasn't enough when a route, form, or signed-in flow could still be broken. It scans a web app's source for routes and controls, runs browser checks with Playwright, and saves an HTML report with screenshots, request evidence, and a per-route pass/fail/change summary. It also runs from the CLI for people who don't want an MCP setup.

The useful part for my own workflow is the second run. After a code change, the report calls out routes that regressed or recovered, so I can inspect the specific flow instead of reading a fresh wall of green checks. The tool itself makes zero LLM calls; your editor agent can decide which scenario to test, while the local runner records what happened. Explicit assertions still matter: a completed click path alone can't prove the business outcome was right.

It's MIT licensed. Install with `npx vibe-testing@latest init`, or inspect the code and setup here: https://github.com/AishwaryShrivastav/vibe-testing

If you use Playwright MCP already, I'm curious whether source-aware route discovery and between-run reports solve a real gap for you. A report from one actual app, including what it missed, would help me prioritize the next fixes.

Most of us have MCP servers spread across three or four clients, each added by copy-pasting JSON from a README. I wanted one command that reads all of them at once, so mcp-guard v0.9 adds scan:

uvx mcp-guard-audit scan

It finds the config files of Claude Desktop, Claude Code (including per-project servers in ~/.claude.json), Cursor, VS Code, Windsurf (now Devin Desktop), Zed, Continue and Cline/Roo, runs the same checks as inspect on each one, and groups the results by client, then by server. A server configured in two clients is reported once. Here is the output on a demo machine (fake configs, fake token):

```

Claude Desktop

~\AppData\Roaming\Claude\claude_desktop_config.json

shell

CRITICAL command-execution: shell

filesystem

HIGH broad-filesystem-scope: C:\

memory no finding

Cursor

~\.cursor\mcp.json

github

HIGH hardcoded-secret: env GITHUB_PERSONAL_ACCESS_TOKEN=<redacted, 40 chars>

shell same server as Claude Desktop > shell (~\AppData\Roaming\Claude\claude_desktop_config.json), findings shown there

Windsurf

~\AppData\Roaming\devin\mcp_config.json

remote-notes

MEDIUM insecure-transport: http://notes.example.com\[…\]

3 config files, 6 server entries, 5 distinct servers, 4 findings, highest risk CRITICAL. Static check of the configs only: no server was started.

```

What it does not do: it starts nothing and makes no network call. It reads the config files and nothing else, so it says what the configs declare, not what the processes can actually reach (that's a sandbox's job). A config with no finding means nothing alarming in the config, not a confined server.

Two things came with it. Secrets never show up in the output: tokens are reported by length, and URLs in findings now keep only the scheme and host, because people put tokens in URL paths and query strings. And --json and --sarif (SARIF 2.1.0, validated against the OASIS schema) let you drop the scan into CI or GitHub code scanning. It exits 0 by default; add --fail-on high to make it fail.

I checked every config path against each client's current docs. A few I couldn't confirm (Claude Desktop on Linux, ~/.claude.json on Windows, VS Code profile mcp.json, the old Windsurf and Cline locations). If your client keeps its config somewhere scan doesn't look, tell me where and I'll add it.

Repo (MIT): https://github.com/ianewsfr-a11y/mcp-guard

Release notes: https://github.com/ianewsfr-a11y/mcp-guard/releases/tag/v0.9.1

Question for you: how many MCP clients do you actually have configured, and did you know what was in each of them?

with a few servers connected there are usually 2 or 3 tools whose description is basically "search documents". most clients prefix them by server so the names don't clash, but the model still picks off the description, and a call to the wrong one looks normal in the log

anyone found a fix that isn't just turning servers off per project?

There was a good thread a while back about which MCP servers people actually use. I'm curious about a narrower slice: the ones that cost money.

Not the free ones, not the ones you installed once and forgot. The paid ones you'd notice if they disappeared tomorrow. Search APIs, scraping, image or video models, data enrichment, whatever.

Would love to see:

- the tool

- roughly what it costs you a month

- whether you pay per call or on a plan

My guess is most people have one or two paid tools they use constantly and a long tail they barely touch, but I'd like to know if that's true.

What's the one paid tool your agent would be useless without?

The situation I kept running into with MCP servers and agents: the write tool returns success, the host moves on, and the thing isn’t actually there. So then for example the event never landed on the calendar, the draft isn’t in the mailbox, the booking has no record and so on. Also nothing errored, so no log or trace flags it.

The fix I landed on: instead of trusting the write, check it with a read.

You map each write tool to its read counterpart (e.g. create_event → get_event)

After the write, the new id gets passed to the read on the same request

Read returns the thing → found

Write “succeeded” but the read comes back empty → miss

If there’s no read mapped, I just record that the job ran and how long it took. So I don’t invent a check.

Then two cases turned out to need different hooks:

MCP servers. A host (Cursor, Claude Code, etc.) calls a tool on your server. I wrap it in-process with observe(), which records the tool name, latency, and error. Nothing is proxied; hosts keep calling your URL directly.

Personal agents (someone texts the agent, it does calendar/mail/booking work). There’s no public MCP URL to watch, so Agent() wraps the dispatcher. After each job it looks for the matching list/get call on the same machine.

Btw the read check runs locally, so it never signs into anyone's Google, and it only keeps job name, latency, and found/miss. If the wrapper fails, the tool still runs.

Do you verify writes at all, or rely on the tool’s own success response? Maybe somebody has different approach or can suggest more info for me to look into? Open to any discussion.

(I built this into my tool called AgentStatus as “Live Traffic”. I'll drop the write-up in comments)

Everyone's talking about tool list size, so I measured mine. My MCP server gives agents blockchain data: 40 tools, and the whole list comes to about 8,000 tokens. Roughly 200 tokens a tool, so size isn't my problem.

What I can't measure is choice. Some of my tools sit close together: one for bridge transfers across the whole network, another for one address's bridge transfers. In one case the error from the wrong tool names the right one. But my logs only show calls that fail, not the ones that quietly pick a worse tool and still answer.

I've also mixed two styles. Most tools do one job. A few are merged, like one validator tool with three views instead of three separate tools. I don't know which style agents handle better.

- At what tool count did you see selection get worse?
- Merge into fewer tools with a mode, or keep one job per tool?

I built an MCP for financial planning (US tax payers) and published it as a Claude Connector.

FinZot can walk you through creating a plan from scratch, figuring out when to retire, optimizing taxes (e.g. Roth conversions) and much much more.

Once connected, ask Claude “Use FinZot to create a plan from scratch. I make $... and want to retire in....”

Harness:

FinZot is backed by an incredibly detailed financial planning engine equaling or surpassing what most paid advisor tools offer in many areas (e.g. federal/state/local taxes, lot level taxes like a regular brokerage account, RSU stock comp, roth conversion optimizer, monte carlo etc). The planning engine was originally a project to learn Rust and is many years in the making.

Accuracy

AI is more likely to go off the rails when it does not have enough context for a given task. 

FinZot keeps track of which documentation Claude has been given within every conversation. Claude can't change a part of your plan until it has requested the docs for that part. For example, it can't configure an HSA until it has read the documentation on HSA or query the state tax results table until it has read the schema and documentation for the state tax table.

Cost:

FInZot’s free plan has a tool call limit. Once you hit the limit FinZot will prompt you to upgrade to a paid FinZot plan. The tool call limit should be enough to give it a solid try. If it is not please let us know.

Separately Claude’s free plan runs out of usage too quickly to be useful. The harness includes ways for Claude to load only the information it needs, but financial planning is complex and Claude tends to request a lot of context.

I've been thinking about what my websites should tell an AI agent when it visits. That became a small tool called Pagegloss.

You enter your site URL, review the description and links it finds, add any useful guides, and copy the generated code into your site. It exposes that information through read-only WebMCP tools.

Free, no signup. I wanted this to be something you could try without creating another account.

Browser and agent support is still early. I'm treating it as a small experiment in preparing for that shift, not a way to get more AI search traffic.

https://pagegloss.app

If you try it, I'd like to know where the setup gets confusing.

Disclosure: I built this (Digital Fortress). It's free and MIT licensed.

Problem: you review a server's tool descriptions once, when you first connect. After that, the server can reword a description or widen an input schema and nothing in the client flags it. OWASP's MCP Tool Poisoning page describes this trust gap.

mcp-tool-pin-check is one Python script (3.9+, standard library only). You save a `tools/list` response from a client you already use against a server you're authorized to assess. `pin` stores a normalized copy and a SHA-256 for each tool (name, description, inputSchema, annotations). `check` diffs a later export against that lockfile.

Real output from the repo's example notes server:

```text
MCP tool pin check
lock source: local-notes
pinned_at: 2026-10-08T00:00:00Z
result: drift

added (1):
+ create_note
removed (0):
(none)
changed (2):
~ get_note
description:
--- description (pinned)
+++ description (current)
@@ -1 +1 @@
-Return one note by its identifier.
+Fetch a single saved note using its identifier.

~ list_notes
schema:
[widened] property added: properties.limit (optional)
[widened] required removed: query
schema widened: yes
unchanged (0): (none)
```

What it doesn't do: it never opens a network connection, calls tools or starts a server. It doesn't decide whether a description is safe, only whether it changed. It also doesn't pin outputSchema yet.

Question for people running MCP in production: is outputSchema the next field worth pinning, or is something else more important?

https://github.com/digitalfortressaudit/mcp-tool-pin-check

Hi everyone 👋

Recently, I needed to sync a MCP server in Claude Code from project path A to path B. I was annoyed by having to manually copy-paste configurations using Vim every single time.

So I updated MCP Linker to support seamless path-to-path syncing for Claude Code!

In this update:

• New Local Sync Panel (Side-by-side view): Many of you mentioned needing to sync CC servers to Codex. I iterated with Opus 5.5 to redesign the Local Sync Panel into a clean side-by-side view (shown in the video).
• Cleaner UI: Redesigned the server cards to be more compact and readable.
• Expanded AI Client Support: Added support for Hermes agent, OpenCode, and Pi-agent.

MCPLinker is open-source & local-first.

📁 GitHub Repo: https://github.com/milisp/mcp-linker

I’d love to hear your thoughts and suggestions!

I was using an agent to hunt down good prices on something I wanted to buy. The answers sounded great. Then I actually checked them, and a lot of the prices were weeks old. The agent couldn't get into most of the pages, so it went with an old search snippet, or just guessed, and told me all of it with total confidence. I almost bought at some pretty horrible prices because of this.

That's the bit that gets me. When your agent can't read a page, it doesn't say so. It fills the gap from memory, and memory is old by definition.

So I measured how much of the web an agent actually gets to see. I picked 150 sites before opening any of them (shops, travel, jobs, news, a few government sites) and only counted a read if the real page came back. Results on a search page, a price on a product page, the actual article.

1. A plain fetch, which is roughly what most agent web tools do, got 73 of 150. Half the web, gone.
2. The best free tool on its own (Jina Reader) got 110, and the best paid one (Zyte) got 129.
3. Every tool missed different sites. That was the weird part, every kind of bot wall had a different winner.
4. Trying them in order, cheapest first, got 144. With free tools only it got 132, which is more than the best paid tool on its own.

The way I see it, everyone's agent is running on roughly the same models now. The edge is whether yours is working off what's on the page today, or off whatever it remembers. A price that dropped this morning or the docs for a version that came out last week don't exist for your agent if it can't open the page.

Frankensurf is what I ended up building. It's one read call for your agent (MCP server or Python), sitting in front of 28 tools. It tries a plain fetch first and only climbs to stealth browsers, or paid APIs if you let it, when a site blocks it or the page comes back empty. It remembers what worked on each site, so most reads cost nothing.

Still not perfect. The slowest tenth of reads take about 26 s because sometimes it really does have to try a lot of things, and a few sites still beat every tool I've got.

Setup for Claude Code, Codex, Cursor and the rest: https://frankensurf.dev/docs/agents/ Repo (my project, free and open source): https://github.com/yail259/frankensurf

Fully open source, lmk if it's useful!