Building MCP Servers That Actually Work

I have this side project, and it's called Runno. And what it lets you do is run code anywhere safely. It started out as a web project. It let you run code in the web browser, but then I realized that JavaScript doesn't run only in the web browser. Has has anyone heard of Node? It's really new technology.

And so then now it it can run outside of the browser, which is wild. So I posted this article and I talked about it where I released a new package called run no sandbox, and it's a WebAssembly sandbox for running code. And I talked about this at MELP JS, and basically what it lets you do is literally just run code from other programming languages.

It's got support for a few different programming languages. These are ones that were already compiled to WebAssembly, and it packages it all up, and then you can run Ruby inside your JavaScript if you want to do that. And I thought that was pretty cool, and someone was like, you should make an MCP server for Ronno.

And I was like, cool. What is an MCP server? And so then I learned about MCP servers, and the answer is that it stands for the model context protocol, and I'm gonna explain what that means. It's a protocol for giving context to models.

It's it's there in the name. It it it does a little bit more than that. It's not just that. Really, I think like there's a lot of different metaphors but I I think tool use is the one that everyone is has sort of landed on. It lets you build tools that an LLM can use. And for me, this kind of feels like replaying history a bit.

This is Claude, and Claude has gone the user has gone, what weather alerts are active for New York? And Claudia's gone, okay. Let me check the current weather alerts for New York and has then gone and called the tool get alerts. And the reason in my head I'm, like, skipping over this is because I feel like you all know this, but I think this is actually important, so if you don't know it, then you can follow along. And then it can use other tools, so it doesn't just have to use the one tool like get alerts, weather alerts, it could get the weather for another location.

And this means that Claude has extra capabilities beyond generating text. It can go and ask for some information and then generate some text. And you have seen this in chat JBT and things for a while. It just sort of was hidden from you. It was hidden that it was using tools under the hood.

And now with MCP, this is really clear that it is going and using a tool to do this task. So this is a really powerful idea, this idea that the LLM can go and use a tool. And when you have this, you can kind of think about it as like apps but for the LLM.

And when when the iPhone came out, it it didn't have apps. Right? And the thing that made the iPhone successful and smartphone successful wasn't that it was a touch screen, and that part is small, that's all great, but every user has different things that they wanna do with an iPhone. Every user wants to do their task and that's what makes computers great is it's really good at every single task, but you need an app for each of those tasks.

And I, as a user, I like, my hobbies are running. I have a bunch of running apps on my phone. Not everyone needs their iPhone to come with Strava. Right? And in this case, not everyone needs their LLM to come with whatever the equivalent of Strava is for an LLM, a a run planning tool or coaching tool.

And so that's where I feel like MCP is sitting, and I feel like this is like, it's a huge moment, but they can be dangerous. MCP and really anything with LLM right now, anytime you're letting the LLM start to do actions and get its own information, it can do kind of dangerous things that you may not intuitively think of. So you've probably heard of prompt injection.

The term is coined because it's very similar to SQL injection. The idea is that any text that an LLM reads can change what the LLM does. And so it could be anywhere in its context. And really this is sort of like exactly the same as this problem we've had forever in software engineering, which is the idea of mixing instructions and data.

Because you're you're telling the LLM to do things, you're giving it instructions, but you're also putting data in there in the same place. And the LLM can't really tell the difference even if you're like tagging each message with this one's from the system and this one's from the user. Like, the LLM just sort of doesn't quite get it.

So when you're thinking about this, and I'm I'm doing the security stuff first so you're, like, suitably scared. When you're doing this and when you're thinking about MCPs, what you wanna worry about and what you wanna be careful of is what Simon w calls the lethal trifecta, which is access to private data, the ability to externally communicate, and exposure to untrusted content.

So untrusted content is something that a user has submitted. Private data is something that is private for some reason, like any reason, probably like it's your own personal data, And the ability to externally communicate is literally it can just talk to the internet at all. So if it can make an API request, that's dangerous. And if you put all of those things together, then your MCP could be vulnerable. That doesn't mean that it is vulnerable, but it could be. And this happened earlier this year.

It's been mentioned earlier today. The GitHub MCP was exploited, and the result was that some attackers got access to private repositories. And this used this combination, this lethal trifecta. And the way it used it is that it had access to untrusted content. The GitHub MCP could read issues.

So there were issues filed on a repo. It would read those issues. And it also had the ability to talk to the Internet, which was it could put images into text blocks. And, of course, if you put in a URL in as an image, the web browser goes and makes a request for that image, and you can use that as a way to leak information.

Just the ability to put a URL somewhere, that's it. That's all it needed. And then it had access to private information. It was GitHub MCP. There were private repos, and so it was possible to use this exploit to leak out private code from some company. Right? So that's the scary part.

And now that you're suitably scared, I'm gonna teach you how to fire a gun. So let's have a look, at this live demo that I built. So Claude is what I'm gonna use, and this is using my MCP that I built for Runno.

And you can tell that I'm using it because if I pull up this settings thing, it's got this little Runno on thing. Now MELB JS is on every second Wednesday of the month, and I find that really difficult to think about. And so I'm gonna ask Claude what all the dates are for MELB JS in 2026.

So Meld JS is on the second Wednesday of the month. What are the dates for 2026? So I do wanna caveat that since I built this, Claude has written its own like, Anthropic has released their own code running thing, and so sometimes Claude uses my tool and sometimes it uses their tool. So if it does use their tool, I'll trick it into using my tool.

Okay. Good. Yes. It's using my tool. Great. So what it's doing here is it's writing some code and then executing it locally in a sandbox. Oh god. And it got an error. And what error did it get? Execution failed. That's actually fine. So it wrote some bad code.

And then it wrote some good code and it figured it out. And if we go into a calendar and have a look at those dates, they are right because I know this because I've I've actually done this prompt a lot just to check that it works. It's like currently my test prompt for it. So that's that's the live demo.

That's how it works. And this isn't something that OnlyCloud does. Your favorite LLM interface supports m c p. You can use m c p with lots of different things. For example, this is the editor zed. Its agent supports MCP, so I did that same thing and it it figured it out.

This is LM Studio, and I ran this query on the plane without WiFi, and it locally used m an MCP, and that was pretty cool. It did get it wrong. So this one, it's saying January 15, which is a Thursday, but, you know, it was just an off by one error for January.

Every other month is fine, so any any programmer could make that mistake. You can even put it in your own agent. I I published a blog post about this and how to use it. It's just on npm, the m c p, and Phil Nash, who has spoken at these conferences before, like, that day made an agent that used my MCP, which is pretty cool.

That was his own custom thing. So, like this distribution mechanism just feels like magical. It feels like early days NPM where like you can just be like, alright, here's an MCP I built and then everyone's like, oh, yeah, can use that. I'll just chuck that in my code. I'll add space under the end of my word using an AI.

So how does this work under the hood? Let's look at some code. And I have to be honest, there's just not much code. It like, most of the feature was is built based off an already existing npm package that I built. So this is the tool. This is like this is the main thing.

And what it does is it's got an input schema and it's got a prompt and that's about all it really has. And this is in a sandbox which is why I've said it's item potent and it's read only. It doesn't actually do any writing to anything real. This is my prompt. It tells the LLM how to use the tool.

I actually haven't iterated on this at all so it might be a terrible prompt, but these are the different languages that you can use with this tool. And this is the schema for running code. It's just a bunch of different languages. Technically, can do SQLite, but it's not really useful in this scenario. And then the code is just a big string.

The server is constructor server. You can list the tools that are available and you can handle the tool request. And this handler, this is doing the real legwork of the MCP, and what this is doing is it's grabbing the data from the request, it's passing that onto my existing run code function and then it returns the content to the LLM.

And this is really like all your MCP should do is probably it's just like get the arguments from the LLM, go call an API or go run something you've already written and then return the result. And at that point, you've integrated whatever, you've integrated x with every LLM, which is kind of neat, like it's it's just really that simple. It was easy.

I was really shocked. I actually I had to do a thing with a friend where we we body double on Monday nights and I set my goal to be like try out MCP. And I built the MCP during like two hours and it was integrated and working and then I logged off and he was still working on his app.

So here's a live demo of the debugging interface. I think this is actually really great. The tooling for this is incredible. So I just to remind myself that it's npm run dev. So this will run the model context protocol inspector and this is the inspector. I can connect to my m c p.

I might just make that a bit bigger. And I can list the tools that are available. The tool is run code. That's the tool that we've got, and this is my big prompt. And then I can write in this runtime Ruby and some code, put hello world. Why did I capitalize world and not hello?

And run it and that just calls out to the m c p. And this is like the result is execution completed following the t two y output, hello world. And that's kind of it, like, for the debugging interface. This is genuinely really useful. One of my engineers was building an MCP and she was really struggling with it because she had to keep triggering it using Claude to debug it which is an awful workflow.

Instead, you just wanna, like, click run. Alright. Have I got another live demo here? Yes. I wanted to do this. So this is another thing I did with it, which I thought was really cool. So something you can do with these models is they can just look at pictures.

So this picture is a sudoku. Can everyone see that? This picture is a sudoku, and I can say, write this sudoku out as a CSV. And it's gonna convert it to CSV format, and hopefully it reads it correctly. Last time I did this, it did not read it correctly and then it was unsolvable.

But that's just an image, turned it into a bunch of numbers, and then solve this sudoku quickly. And the reason I'm saying quickly is I'm hoping I'm gonna prompt inject it to think to use c plus plus instead of writing a HTML page, which it often tries to do. So yeah, unfortunately, it is triggering its own tool for code writing.

Solve this sudoku extremely performantly. No. Okay. Solve this sudoku by writing c plus plus. Everyone's got their really cool JavaScript and Python runners, but no one is telling their LMs to write c plus plus.

I'm the only one who can do that. And the way this works under the hood is I've got LLVM compiled to WebAssembly and LLVM then compiles the c that is written by the LLM and then that outputs WebAssembly and then the WebAssembly runs in the sandbox.

So it is saying that no solution was found and I think that is because it has made a mistake in transcribing the CSV and I know that's a mistake because it made this mistake. Ah, yeah. There's a duplicate 16 column eight. Wow. Okay. It it might just figure this out for itself. Is it and did it solve it?

No one will ever know. The point is the actual interesting thing is it's writing c plus plus and running it, which is that is, like, that is what this tool is for. It's doing the thing. The t t y output was column eight has duplicate six, so it wrote some debugging code in its own in its c plus plus. I'm not gonna put you through the pain of me debugging why it can't solve this sudoku, but it is possible if yeah.

Okay. Yeah. It is possible. Alright. I'm gonna I'm gonna move on from that. Alright. Live demo audience participation round. Does anyone have a suggestion for a problem that it could solve using code? I should have warmed the audience. No one's gonna put their hand up. I I could use some teaching techniques.

Does anyone like cold calling? Get it to implement implement Conways. Is it so it'll it'll do that using a web browser because it'll want a visual interface for it. Print out the first state of a common Conway's game of life.

It'll like it's the thing is you're thinking like a programmer and what you need to think like is someone who doesn't know how to program and you want it to solve a problem for you. Okay. This is I should never have done this demo. Yeah. Traffic lights as in you're still thinking like a programmer, but yes.

Like, what you wanna do is you wanna set up like a a scenario, like a set up a board for a chess queens problem, k queens problem, and let's see what it does. Now it's it's writing a now it's writing a website.

No. Do it in markdown. Anyway, it it is possible to get it to yeah. Yeah. Yeah. Yeah. Yeah. Cool. Great. Now solve it. Oh, what? Okay. Oh, no. Stop talking.

Yeah. Great. Okay. So now it is writing an algorithm to solve the n queens problem. And it's using Python, which is everyone's favorite programming language for LLMs to write. It's writing a lot of Python. And eventually, it'll probably get in there and solve it, but I do have time. So you can introduce MCP to your workplace.

We'll come back to Claude. You can do that. I really recommend listening to this talk or listening to this podcast. It talks a lot about how Shopify is using MCPs. They have dozens of MCPs that they're supporting. They're encouraging people to vibe code to MCPs, people who are not programmers, which I think is really interesting.

People who work with Salesforce, for example, people who work with big Excel spreadsheets, people who work with some strange report, some API, some specific marketing product that has an API, whatever it is, if if they're able to write an MCP for it, suddenly their agent has access to it. And if their agent is able to access each of the tools that they use, they can then string workflows together.

And this is like this is the bridge that lets the LLM actually do something interesting. But make sure to consider security and privacy. The way that Shopify are doing it is that they have their own LLM proxy and all of their stuff is internal, so they're not exposing it like to the internet as such.

I don't I don't know all the internal details of that, but you really do have to be considering that and worrying about it at least a little bit. You can expose your data to LLMs using MCP and keep it simple. Don't think too much about it. Just go grab the data and shove it back, give it back to the LLM. My experience doing this at style, we are in 40% of schools in Australia.

We're teaching science. We support teachers to teach science. Teachers are using us every week to teach science. We're kinda like a textbook but better. This is the kind of thing that a teacher would see. They would present using this. And we also have an editing interface. This editing interface is used by all our content writers who write our textbook like product.

And one of my engineers made an MCP for interacting with our lesson API. And there's lots of different things that you might want an LLM to do when you're writing a lesson for students. You might want it to edit your lesson, come up with errors, summarize it, or fact check it, for example. And this is an example of the MCP doing some fact checking.

So it's fact checking a Serengeti ecosystem lesson. It has it said that it has high scientific accuracy, and now the science writers are actually the ones who should know, but this is a really great tool for them to see if they've missed any details. The ecosystem size is right, the geographic distribution of the Serengeti is right, it references decades of climate and species data.

Unfortunately, it is true that LLMs do tend to tell you that you're right, so you you have to check them, but I reckon go build an MCP. It's easy, surprisingly easy. That's me. If you wanna connect with me on LinkedIn, I kinda just do LinkedIn now because I've gotten lazy on Blue Sky and Mastodon. I'm technically there, but I will not read your messages or post.

This is us style. We're building tools that improve the state of science education globally, and I have some stickers and pins and stuff at our table. I also actually I I put stickers on your tables. So if you want a sticker, just steal it from your table. And that's me. Thank you.