Client Best Practices changeddocs/2024-11-05/develop/clients/client-best-practices
Upstream edited this page at 28 Jul 2026 15:42 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 24 Oct 2026 11:07 UTC.
Upstream edited
Recorded here
Lines+3added
Lines−3removed
From line
122
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
The whole hunk
from line 122, old and new numbered
/
from line 122
122122 Host-->>Model: Server disconnected, context freed
123123```
124124
125This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as needed. Combined with [agent skills](/docs/2024-11-05/develop/build-with-agent-skills.md), a skill file can declare which MCP servers it needs, and the host connects them only when that skill is invoked.
125This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as needed. Combined with [agent skills](https://modelcontextprotocol.io/docs/2024-11-05/develop/build-with-agent-skills.md), a skill file can declare which MCP servers it needs, and the host connects them only when that skill is invoked.
126126
127127### Implementation Guidelines
128128
from line 271
271271
272272Programmatic tool calling introduces a code execution surface that requires careful sandboxing:
273273
274* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to direct calls (see [Tools: Security](/specification/2024-11-05/server/tools.md#security-considerations)). Approving the script does not grant blanket approval for every tool call it makes at runtime; hosts may grant categorical approval (for example, "allow `ticketing_createIssue` for this script run") rather than prompting per iteration, but the broker must still evaluate each call against that grant.
274* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to direct calls (see [Tools: Security](https://modelcontextprotocol.io/specification/2024-11-05/server/tools.md#security-considerations)). Approving the script does not grant blanket approval for every tool call it makes at runtime; hosts may grant categorical approval (for example, "allow `ticketing_createIssue` for this script run") rather than prompting per iteration, but the broker must still evaluate each call against that grant.
275275* **Cross-server data flow**: Tool results from one server are untrusted input to another. The broker should apply the same input-review policy to brokered calls as to direct ones; output truncation alone does not prevent exfiltration.
276276* **Network isolation**: The sandbox should have no direct network access. All external communication flows through the host broker, which enforces authorization and access control.
277277* **No credential exposure**: API keys and tokens are held by the host. The generated code calls typed functions; the host adds authentication when forwarding to servers.
from line 281
281281### Error Handling
282282
283283MCP tool errors arrive as a successful response with
284[`isError: true`](/specification/2024-11-05/server/tools#error-handling) rather than a transport
284[`isError: true`](https://modelcontextprotocol.io/specification/2024-11-05/server/tools#error-handling) rather than a transport
285285failure. Generated wrappers should convert this into a thrown exception so model-authored code
286286can use `try`/`catch`. If an uncaught error terminates the script, surface it as the script's
287287result so the model can self-correct; the model is responsible for reporting any partial side
No line in this hunk matches that.