Designing an MCP server agents can’t abuse

The MCP bridge turns PaneScale into a tool other agents can use. An agent in any pane — or any MCP client on your machine — can read the task board, create cards, move them, list workflows, send you a notification or call one of your managed MCP connections.

That is useful. It is also exactly the kind of surface that tends to grow until it can do everything. These are the rules we set before writing the first line.

#Off until you turn it on

The bridge doesn’t run by default. Turning it on is a deliberate switch in Settings, and turning it off closes it immediately.

#Loopback only

The server listens on 127.0.0.1 only, on a port between 41920 and 41929. Nothing on your network can reach it — not another computer, not a phone on the same Wi-Fi.

#A token for every request

Every request needs a bearer token. Tokens are 43 random characters, compared in constant time so response timing doesn’t leak how much of a guess was right. You can regenerate the token at any moment; every client using the old one stops working at once.

#No browsers

A web page you visit could try to send requests to localhost. The bridge refuses any request that carries a browser Origin header. Real MCP clients don’t send one; browsers always do.

#Small requests

Request bodies are capped at 1 MB. There is no legitimate reason for a board operation to be larger, and a cap makes some kinds of mischief impossible.

#A short tool list

Six tools, each doing one thing. There is no generic “run a command” tool, no file access and nothing that changes your repository. If an agent needs to work on code, it does so in its own pane, under its own rules.

#The column agents can’t reach

Agents can move cards to running, needs review, blocked, failed or stopped. They can’t move a card to done. That column is reserved for people, because “done” is a judgment, not a status update.

#Nothing that publishes

The bridge has no tool to approve, merge, push or publish. Those actions need signed one-time approvals that only come from clicks in PaneScale itself. An agent connected through MCP can ask you — with a notification — but it can’t say yes on your behalf.

#Managed connections, bounded

The bridge can call your own MCP connections by name. Those calls inherit the same limits PaneScale uses everywhere: a ten-second timeout, at most a hundred tools per server, results capped at 128 kB.

#The pattern

None of these rules is clever. Together they follow one principle: give agents capabilities that are useful when used well and boring when used badly. Reading and organizing a board is useful. Approving your own work is not something an agent should be able to do, no matter how politely it asks.