Build a minimal MCP server with a security boundary you can explain

The concrete problem: MCP server meets tool schema

The starting point is not a feature; it is an observable decision boundary.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c11 starts at stdio and treats Streamable HTTP as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before MCP server can trigger the intended effect around tool schema. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to Streamable HTTP, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by authorization and tool schema: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c11 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns stdio into a reviewable decision point with a named input and a retained output.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c12 starts at Streamable HTTP and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before tool schema can trigger the intended effect around stdio. To test authorization, fixture build-minimal-mcp-server-security-boundary-c12 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP server. Operations then observes the transition between MCP server and tool schema, while security checks that stdio receives neither implicit authority nor unnecessary data. If the tool schema verification fails, rollback restores the configuration around stdio, replays build-minimal-mcp-server-security-boundary-c12, and compares the new state with the control evidence from Streamable HTTP.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c13 starts at authorization and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before stdio can trigger the intended effect around Streamable HTTP. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to MCP server, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool schema and Streamable HTTP: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c13 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns authorization into a reviewable decision point with a named input and a retained output.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c14 starts at MCP server and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires stdio to emit an observable result before Streamable HTTP can trigger the intended effect around authorization. To test tool schema, fixture build-minimal-mcp-server-security-boundary-c14 contains both an allowed state and a rejected state; rejection must occur before any change attributed to stdio. Operations then observes the transition between stdio and Streamable HTTP, while security checks that authorization receives neither implicit authority nor unnecessary data. If the Streamable HTTP verification fails, rollback restores the configuration around authorization, replays build-minimal-mcp-server-security-boundary-c14, and compares the new state with the control evidence from MCP server.

Trust boundaries around stdio

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c21 starts at Streamable HTTP and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before tool schema can trigger the intended effect around stdio. If the tool schema verification fails, rollback restores the configuration around stdio, replays build-minimal-mcp-server-security-boundary-c21, and compares the new state with the control evidence from Streamable HTTP. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to authorization, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by MCP server and stdio: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c21 is labeled as a limitation or inference, never promoted to fact.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c22 starts at authorization and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before stdio can trigger the intended effect around Streamable HTTP. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns authorization into a reviewable decision point with a named input and a retained output. To test MCP server, fixture build-minimal-mcp-server-security-boundary-c22 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool schema. Operations then observes the transition between tool schema and stdio, while security checks that Streamable HTTP receives neither implicit authority nor unnecessary data.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c23 starts at MCP server and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires stdio to emit an observable result before Streamable HTTP can trigger the intended effect around authorization. If the Streamable HTTP verification fails, rollback restores the configuration around authorization, replays build-minimal-mcp-server-security-boundary-c23, and compares the new state with the control evidence from MCP server. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to tool schema, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by stdio and authorization: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c23 is labeled as a limitation or inference, never promoted to fact.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c24 starts at tool schema and treats stdio as an explicit boundary rather than an implicit assumption. The first control requires Streamable HTTP to emit an observable result before authorization can trigger the intended effect around MCP server. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns tool schema into a reviewable decision point with a named input and a retained output. To test stdio, fixture build-minimal-mcp-server-security-boundary-c24 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Streamable HTTP. Operations then observes the transition between Streamable HTTP and authorization, while security checks that MCP server receives neither implicit authority nor unnecessary data.

Prepare the starting state and prerequisites

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c31 starts at authorization and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before stdio can trigger the intended effect around Streamable HTTP. Operations then observes the transition between tool schema and stdio, while security checks that Streamable HTTP receives neither implicit authority nor unnecessary data. If the stdio verification fails, rollback restores the configuration around Streamable HTTP, replays build-minimal-mcp-server-security-boundary-c31, and compares the new state with the control evidence from authorization. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to MCP server, a concrete condition, and evidence instead of a generic assurance.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c32 starts at MCP server and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires stdio to emit an observable result before Streamable HTTP can trigger the intended effect around authorization. The conclusion stays bounded by stdio and authorization: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c32 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns MCP server into a reviewable decision point with a named input and a retained output. To test tool schema, fixture build-minimal-mcp-server-security-boundary-c32 contains both an allowed state and a rejected state; rejection must occur before any change attributed to stdio.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c33 starts at tool schema and treats stdio as an explicit boundary rather than an implicit assumption. The first control requires Streamable HTTP to emit an observable result before authorization can trigger the intended effect around MCP server. Operations then observes the transition between Streamable HTTP and authorization, while security checks that MCP server receives neither implicit authority nor unnecessary data. If the authorization verification fails, rollback restores the configuration around MCP server, replays build-minimal-mcp-server-security-boundary-c33, and compares the new state with the control evidence from tool schema. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to stdio, a concrete condition, and evidence instead of a generic assurance.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c34 starts at stdio and treats Streamable HTTP as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before MCP server can trigger the intended effect around tool schema. The conclusion stays bounded by authorization and tool schema: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c34 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns stdio into a reviewable decision point with a named input and a retained output. To test Streamable HTTP, fixture build-minimal-mcp-server-security-boundary-c34 contains both an allowed state and a rejected state; rejection must occur before any change attributed to authorization.

1. Step 1 — Configure MCP server, run verification build-minimal-mcp-server-security-boundary-step-1, and retain the observable result before continuing.
2. Step 2 — Configure tool schema, run verification build-minimal-mcp-server-security-boundary-step-2, and retain the observable result before continuing.
3. Step 3 — Configure stdio, run verification build-minimal-mcp-server-security-boundary-step-3, and retain the observable result before continuing.
4. Step 4 — Configure Streamable HTTP, run verification build-minimal-mcp-server-security-boundary-step-4, and retain the observable result before continuing.
5. Step 5 — Configure authorization, run verification build-minimal-mcp-server-security-boundary-step-5, and retain the observable result before continuing.
6. Step 6 — Configure MCP server, run verification build-minimal-mcp-server-security-boundary-step-6, and retain the observable result before continuing.

Execute the procedure and observe the result

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c41 starts at MCP server and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires stdio to emit an observable result before Streamable HTTP can trigger the intended effect around authorization. To test tool schema, fixture build-minimal-mcp-server-security-boundary-c41 contains both an allowed state and a rejected state; rejection must occur before any change attributed to stdio. Operations then observes the transition between stdio and Streamable HTTP, while security checks that authorization receives neither implicit authority nor unnecessary data. If the Streamable HTTP verification fails, rollback restores the configuration around authorization, replays build-minimal-mcp-server-security-boundary-c41, and compares the new state with the control evidence from MCP server.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c42 starts at tool schema and treats stdio as an explicit boundary rather than an implicit assumption. The first control requires Streamable HTTP to emit an observable result before authorization can trigger the intended effect around MCP server. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to stdio, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Streamable HTTP and MCP server: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c42 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns tool schema into a reviewable decision point with a named input and a retained output.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c43 starts at stdio and treats Streamable HTTP as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before MCP server can trigger the intended effect around tool schema. To test Streamable HTTP, fixture build-minimal-mcp-server-security-boundary-c43 contains both an allowed state and a rejected state; rejection must occur before any change attributed to authorization. Operations then observes the transition between authorization and MCP server, while security checks that tool schema receives neither implicit authority nor unnecessary data. If the MCP server verification fails, rollback restores the configuration around tool schema, replays build-minimal-mcp-server-security-boundary-c43, and compares the new state with the control evidence from stdio.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c44 starts at Streamable HTTP and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before tool schema can trigger the intended effect around stdio. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to authorization, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by MCP server and stdio: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c44 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns Streamable HTTP into a reviewable decision point with a named input and a retained output.

Failure modes, signals, and diagnosis

The starting point is not a feature; it is an observable decision boundary.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c51 starts at tool schema and treats stdio as an explicit boundary rather than an implicit assumption. The first control requires Streamable HTTP to emit an observable result before authorization can trigger the intended effect around MCP server. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns tool schema into a reviewable decision point with a named input and a retained output. To test stdio, fixture build-minimal-mcp-server-security-boundary-c51 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Streamable HTTP. Operations then observes the transition between Streamable HTTP and authorization, while security checks that MCP server receives neither implicit authority nor unnecessary data.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c52 starts at stdio and treats Streamable HTTP as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before MCP server can trigger the intended effect around tool schema. If the MCP server verification fails, rollback restores the configuration around tool schema, replays build-minimal-mcp-server-security-boundary-c52, and compares the new state with the control evidence from stdio. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to Streamable HTTP, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by authorization and tool schema: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c52 is labeled as a limitation or inference, never promoted to fact.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c53 starts at Streamable HTTP and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before tool schema can trigger the intended effect around stdio. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns Streamable HTTP into a reviewable decision point with a named input and a retained output. To test authorization, fixture build-minimal-mcp-server-security-boundary-c53 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP server. Operations then observes the transition between MCP server and tool schema, while security checks that stdio receives neither implicit authority nor unnecessary data.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c54 starts at authorization and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before stdio can trigger the intended effect around Streamable HTTP. If the stdio verification fails, rollback restores the configuration around Streamable HTTP, replays build-minimal-mcp-server-security-boundary-c54, and compares the new state with the control evidence from authorization. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to MCP server, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool schema and Streamable HTTP: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c54 is labeled as a limitation or inference, never promoted to fact.

Progressive rollout and rollback

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c61 starts at stdio and treats Streamable HTTP as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before MCP server can trigger the intended effect around tool schema. The conclusion stays bounded by authorization and tool schema: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c61 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns stdio into a reviewable decision point with a named input and a retained output. To test Streamable HTTP, fixture build-minimal-mcp-server-security-boundary-c61 contains both an allowed state and a rejected state; rejection must occur before any change attributed to authorization.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c62 starts at Streamable HTTP and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before tool schema can trigger the intended effect around stdio. Operations then observes the transition between MCP server and tool schema, while security checks that stdio receives neither implicit authority nor unnecessary data. If the tool schema verification fails, rollback restores the configuration around stdio, replays build-minimal-mcp-server-security-boundary-c62, and compares the new state with the control evidence from Streamable HTTP. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to authorization, a concrete condition, and evidence instead of a generic assurance.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c63 starts at authorization and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before stdio can trigger the intended effect around Streamable HTTP. The conclusion stays bounded by tool schema and Streamable HTTP: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c63 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns authorization into a reviewable decision point with a named input and a retained output. To test MCP server, fixture build-minimal-mcp-server-security-boundary-c63 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool schema.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c64 starts at MCP server and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires stdio to emit an observable result before Streamable HTTP can trigger the intended effect around authorization. Operations then observes the transition between stdio and Streamable HTTP, while security checks that authorization receives neither implicit authority nor unnecessary data. If the Streamable HTTP verification fails, rollback restores the configuration around authorization, replays build-minimal-mcp-server-security-boundary-c64, and compares the new state with the control evidence from MCP server. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to tool schema, a concrete condition, and evidence instead of a generic assurance.

Production decision criteria

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c71 starts at Streamable HTTP and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before tool schema can trigger the intended effect around stdio. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to authorization, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by MCP server and stdio: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c71 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns Streamable HTTP into a reviewable decision point with a named input and a retained output.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c72 starts at authorization and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before stdio can trigger the intended effect around Streamable HTTP. To test MCP server, fixture build-minimal-mcp-server-security-boundary-c72 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool schema. Operations then observes the transition between tool schema and stdio, while security checks that Streamable HTTP receives neither implicit authority nor unnecessary data. If the stdio verification fails, rollback restores the configuration around Streamable HTTP, replays build-minimal-mcp-server-security-boundary-c72, and compares the new state with the control evidence from authorization.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c73 starts at MCP server and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires stdio to emit an observable result before Streamable HTTP can trigger the intended effect around authorization. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to tool schema, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by stdio and authorization: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c73 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns MCP server into a reviewable decision point with a named input and a retained output.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c74 starts at tool schema and treats stdio as an explicit boundary rather than an implicit assumption. The first control requires Streamable HTTP to emit an observable result before authorization can trigger the intended effect around MCP server. To test stdio, fixture build-minimal-mcp-server-security-boundary-c74 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Streamable HTTP. Operations then observes the transition between Streamable HTTP and authorization, while security checks that MCP server receives neither implicit authority nor unnecessary data. If the authorization verification fails, rollback restores the configuration around MCP server, replays build-minimal-mcp-server-security-boundary-c74, and compares the new state with the control evidence from tool schema.

Controls that remain after launch

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c81 starts at authorization and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before stdio can trigger the intended effect around Streamable HTTP. If the stdio verification fails, rollback restores the configuration around Streamable HTTP, replays build-minimal-mcp-server-security-boundary-c81, and compares the new state with the control evidence from authorization. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to MCP server, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool schema and Streamable HTTP: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c81 is labeled as a limitation or inference, never promoted to fact.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c82 starts at MCP server and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires stdio to emit an observable result before Streamable HTTP can trigger the intended effect around authorization. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns MCP server into a reviewable decision point with a named input and a retained output. To test tool schema, fixture build-minimal-mcp-server-security-boundary-c82 contains both an allowed state and a rejected state; rejection must occur before any change attributed to stdio. Operations then observes the transition between stdio and Streamable HTTP, while security checks that authorization receives neither implicit authority nor unnecessary data.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c83 starts at tool schema and treats stdio as an explicit boundary rather than an implicit assumption. The first control requires Streamable HTTP to emit an observable result before authorization can trigger the intended effect around MCP server. If the authorization verification fails, rollback restores the configuration around MCP server, replays build-minimal-mcp-server-security-boundary-c83, and compares the new state with the control evidence from tool schema. This detail makes “Build a minimal MCP server with a security boundary you can explain” reviewable because each operational statement points to stdio, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Streamable HTTP and MCP server: anything not demonstrated by scenario build-minimal-mcp-server-security-boundary-c83 is labeled as a limitation or inference, never promoted to fact.

In “Build a minimal MCP server with a security boundary you can explain”, scenario build-minimal-mcp-server-security-boundary-c84 starts at stdio and treats Streamable HTTP as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before MCP server can trigger the intended effect around tool schema. That sequence serves this concrete job: Create a small server while explicitly separating transport, authorization, tool exposure and side effects. It turns stdio into a reviewable decision point with a named input and a retained output. To test Streamable HTTP, fixture build-minimal-mcp-server-security-boundary-c84 contains both an allowed state and a rejected state; rejection must occur before any change attributed to authorization. Operations then observes the transition between authorization and MCP server, while security checks that tool schema receives neither implicit authority nor unnecessary data.

Operational checklist

• The control around MCP server has an input, a rule, a rejection behavior, and evidence.
• The control around tool schema has an input, a rule, a rejection behavior, and evidence.
• The control around stdio has an input, a rule, a rejection behavior, and evidence.
• The control around Streamable HTTP has an input, a rule, a rejection behavior, and evidence.
• The control around authorization has an input, a rule, a rejection behavior, and evidence.