Hosts: connecting servers to a model

From MCP tool to model tool, and back

The host also acts as a translator, because MCP and the model API describe the same things in slightly different words. Going out, an MCP tool becomes a Claude tool: the cleaned name, the description, and inputSchema as input_schema. Coming back, a tools/call result becomes a tool_result block for the next user turn:

Every tool_use must get a tool_result with the same tool_use_id, even when the call failed or the user said no. Otherwise the next model request is rejected.

In plain words: every question the model asks gets an answer, even if the answer is "that failed" or "the user said no".

Approvals

The host stands between the model and the world. A good assistant signs for the small things and checks with you before writing a large check. Before running a tool, the host decides whether to ask the user. A reasonable policy:

• A tool from a trusted server marked readOnlyHint: true may run without asking.
• Anything else asks first, and the host shows the arguments, because data leaks out through arguments (an email address, a document's contents).
• If the user declines, return a tool_result with is_error: true saying so. The model can then explain, or try something else.

Annotations from an untrusted server don't relax anything. A malicious server can label its "exfiltrate everything" tool read-only.

Keeping context under control

Every tool definition goes into the model's context on every turn. Five servers with twenty tools each is a hundred definitions, maybe tens of thousands of tokens, before the user has said anything. Too many tools also make the model choose worse, the way a 300-dish menu slows everyone down.

Hosts fight this by letting users turn servers and tools on and off, and by loading tool definitions on demand: the model first sees short names or a search tool, and the full schema is added when it's needed. Phase 10 builds this.

Some model APIs can also act as the MCP client themselves: you pass a list of remote server URLs in the request, and the provider calls the servers during generation. That's convenient, but your code then gives up the routing, approval and logging this lesson builds, so check what control you still have.

import json

def to_tool_result(tool_use_id, result):
    texts = [b["text"] for b in result.get("content", []) if b.get("type") == "text"]
    if not texts and "structuredContent" in result:
        texts = [json.dumps(result["structuredContent"])]
    return {"type": "tool_result", "tool_use_id": tool_use_id,
            "content": "\n".join(texts), "is_error": bool(result.get("isError"))}

ok = {"resultType": "complete", "content": [{"type": "text", "text": "Retargeting: 3,940 clicks"}]}
data_only = {"resultType": "complete", "content": [], "structuredContent": {"stock": 12}}
failed = {"resultType": "complete", "content": [{"type": "text", "text": "No campaign cmp_999."}], "isError": True}
for i, r in enumerate([ok, data_only, failed]):
    print(to_tool_result(f"toolu_{i}", r))

Where people go wrong with hosts

The model never talks to a server. People often picture the model calling MCP directly. It can't. It only ever sees tool definitions and asks for calls. The host decides what to do, makes the call and passes back the result. That's why the host is the right place for every safety rule.

Names can clash. Two servers can both offer search. Without a prefix, one silently hides the other, and the model may send private data to the wrong one. Add the server's name to each tool, and keep a table that maps back to the real name.

A declined call still needs an answer. If a person says no, the conversation still contains a tool_use with no result, so the next API call fails. Send a tool_result that says the user declined. The model reads that and can take another approach.

Annotations come from the server. A tool that claims to be read-only might not be. Only skip approval for servers you trust. This is also a place to be strict: asking one extra time costs a click, while wrongly skipping can cost a lot more.