MCP servers are how agents stop screen-scraping your product

The Model Context Protocol is doing for agents what REST did for web apps: a standard shape for exposing capability. I shipped an open-source MCP server that bridges a gnarly clinical data standard to AI agents, typed tools, reproducible evals, and reversible keyed de-identification so agents can work on realistic records without holding real identities. Building it taught me what agent-facing API design actually requires.

Rule one: the tool schema is the prompt. Agents read your parameter names, types, and descriptions as instructions; ambiguity there becomes wrong calls at runtime. Every field self-describes, every enum is closed, every response says what kind of thing it is. (My EDI/X12 integration experience finally paid off, that 47-year-old format's obsessive explicitness is exactly what LLM consumers need.)

Rule two: evals ship with the server. A tool an agent can call is a tool an agent will call wrong; reproducible eval cases pinned to the server define what correct usage looks like and catch regressions when either side updates. An MCP server without evals is an API without tests, published to the least predictable client population in software history.

Rule three: design for the data you can't show. Reversible keyed de-identification means the agent operates on stable pseudonyms and authorized consumers can map back, capability without exposure. Patterns like this are how agents get to work in regulated domains at all, and they need to live in the protocol layer, not in prompt-level pinky promises.