apigateway - Powerduck Blog

Your MCP Hub Exposes Every Tool to Every Agent. That's the Bug.

A shared MCP hub that lists all 40 tools to every connected agent is a convenience until the billing agent starts calling create_user. The fix isn't stricter prompts — it's a smaller tool list per agent, derived from the spec.

Oct 18, 2026 2 min read

Scope MCP Keys to the Human, Not to the Team

When you hand MCP gateway access to support and PMs, a team-wide key becomes the incident waiting to happen. Scope the key to the human, the role, and the three ops they actually use.

Oct 18, 2026 3 min read

Pin baseUrl in the Gateway, Not in the Agent's Prompt

The OpenAPI spec lists prod as the first server. Your agent reads it and calls prod on every test run. The fix is not another line in the system prompt.

Oct 18, 2026 2 min read