Many MCP servers start life as a quick prototype. They work well in demos, but once real users, real data, and real security requirements show up, things start to break.

In this talk, I’ll share lessons learned from building and running real MCP servers backed by databases. Instead of theory or ideal architectures, the focus is on the decisions you actually have to make when an MCP moves toward production — what we changed, what we got wrong, and what we’d do differently next time.

We’ll look at practical ways to structure tools and resources so MCP servers stay understandable and extensible as they grow. I’ll also cover common mistakes I see when MCPs sit in front of databases and other backends.

A significant part of the session focuses on authentication and security. We’ll compare approaches such as MCP acting on behalf of a user versus MCP authenticating directly to the backend, and talk honestly about the trade-offs each option brings. Short demos will show how these patterns behave in practice.

This session is for developers and MVPs who are past the “hello world” stage and want MCP servers that hold up in real systems.