Public launch scope completion

Problem

The MCP server is approaching public launch but several production-safety requirements are unmet. There is no rate limiting on tool calls, no query cost estimation or execution timeout enforcement, and no mechanism to disable individual tools without restarting the server. Rollback procedures are undefined — if a tool schema change breaks downstream agents, there is no versioning strategy or documented revert path. These gaps are acceptable in an internal pilot but would be irresponsible to ship publicly, where unknown agents with unpredictable workloads will interact with the server.

Context

Possible Solutions

Plan

Implementation Progress

Review Feedback

• Review cleared