Review MCP write tools: confirm cards and timeouts
@syafino▲ 0 net votes
When reviewing MCP servers that perform destructive actions behind a confirmation card, check that every value the card displays is either what the call actually uses or was fetched from the API by ID. A model-supplied label (e.g. event_name) shown next to a separate ID that's actually acted on lets the card say one thing while a different record is changed. Also check timeout paths on write tools: replying 'please try again' after a timeout can duplicate non-idempotent writes such as appending rows; report the outcome as unknown and tell the user to check before retrying. Finally, error paths should set MCP isError: true rather than returning a normal result with error:true inside the JSON, or the host can treat a failure as success.