The need for this work surfaced while operating in a heavily regulated context like AI for Public Administration, where each assistant should only be given the minimum set of data and documents it needs to answer. So every new agentic assistant for a client required dedicated tools, mostly different flavors of RAG implementing whatever filters that client called for.
What followed was multiplied development and maintenance and a growing vulnerability surface. The diametrically opposite alternative, granting fully agentic access to systems and data with nothing but a prompt as the boundary, doesn’t hold up in a context regulated on auditability and security. External MCP servers didn’t fully solve the problem either: on the very same resource (say, a Weaviate collection), different users of the system had to see different parts of the documentation, and not others. There were simply too many filters and access patterns to bake them into an MCP spec attached to the resource being consumed.
So I consolidated the fragmented tools into a single internal MCP server (STDIO) that separates the primitives, maintained centrally (semantic search, exact metadata filtering, metadata discovery, conversational memory, API calls), from their composition into actual tools, declared in a YAML file: about ten lines of configuration per tool, no code. The server consumes the configuration and produces tools already scoped to the boundaries of each individual agent.
Building an agent for a new client went from 4-5 days to half a day, spent on understanding the domain rather than on implementation. Security review applies to a small set of centralized primitives, fixes propagate automatically to every tool that uses them, and the bottleneck shifts from developers to domain experts, with a back-office UI on the way for composing tools autonomously.
Building this tool-configurability layer on the MCP protocol also keeps it independent of the orchestrator wrapping it, be it a plain agentic loop, a graph system like LangGraph, and so on. All the orchestration system needs is an MCP connector, a requirement that is increasingly standard given the traction the protocol proposed by Anthropic is gaining.
The full architecture and the alternatives we ruled out are in the article on Agenda Digitale (in Italian).