An MCP your users want

Rhys Sullivan’s practical guide starts with the jobs people already do in a product. It asks MCP authors to expose dashboard actions, keep code mode²¹ as a choice made by the agent’s client, and provide documentation search. It also covers links to specific product actions, groups of tools, and OAuth authorization. OAuth lets a person authorize a client to access a service.¶

The table compares his advice with rat-stack today. The gaps remain open; this page authorizes no changes.¶

Do what the dashboard can do.:
- rat-stack today: Each interface uses the same contract and handler. The public site exposes search and read; the CLI projects registered capabilities too.¶
- Verdict: Agree¶
¶
Keep code mode out of the default MCP²⁸ tool list.:
- rat-stack today: CLI mcp uses plain tools; --code-mode opts into code mode. The hosted site’s MCP includes execute because demonstrating the sandbox is the site’s job.¶
- Verdict: Agree in the template; the hosted site differs¶
¶
Ship search for docs and skills.:
- rat-stack today: The site’s search and read capabilities cover public content. Lore pages are included in the searchable documentation.¶
- Verdict: Agree¶
¶
Add a deep link into the product.:
- rat-stack today: No product-action deep-link tool appears in the hosted capability registry²⁷.¶
- Verdict: Gap¶
¶
Offer toolsets and permissions tied to the auth token.:
- rat-stack today: Contracts can require approval, and Approval gates execution. The hosted MCP has no user-token toolsets; auth.md says it accepts no credentials.¶
- Verdict: Gap¶
¶
Let clients use OAuth; an API spec and Client ID Metadata Document (CIMD) OAuth cover most agents.:
- rat-stack today: The auth cartridge³⁸ supports Better Auth¹⁶ sessions for an app, but ratstack.sh says it has no OAuth or access tokens.¶
- Verdict: Gap¶
¶

The comparison uses apps/site/src/capabilities/index.ts, apps/cli/src/command.ts, packages/capability/src/approval.ts, packages/auth/src/auth.ts, and the hosted site’s auth.md. See one capability, every surface¹⁸ and the cartridges³⁸ page for the contracts and auth boundary.¶

Sources

Rhys on X: "Here's Rhys' practical guide to shipping an MCP your users want: - Your MCP should be able to do everything your dashboard can Yes including things like deleting resources. The way to make this practical inside of an agent while not having things be unsafe is to deep link them into yo… / X. Rhys Sullivan. Practical MCP guide; used to compare dashboard actions, docs search, deep links, and OAuth. Accessed 2026-10-01.
rat-stack/apps/site/src/capabilities/index.ts at main · joelhooks/rat-stack · GitHub. GitHub joelhooks/rat-stack. Capability registry; used to check the hosted tool coverage. Accessed 2026-10-01.
rat-stack/packages/capability/src/approval.ts at main · joelhooks/rat-stack · GitHub. GitHub joelhooks/rat-stack. Approval service; used to check the safety boundary for actions. Accessed 2026-10-01.
rat-stack/packages/auth/src/auth.ts at main · joelhooks/rat-stack · GitHub. GitHub joelhooks/rat-stack. Auth service; used to distinguish current sign-in from MCP OAuth. Accessed 2026-10-01.

Last changed 2026-10-24 in c525d23. Source on GitHub. Change log.

Linked from

Agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.
An MCP your users want — Rhys Sullivan’s practical guide gives rat-stack a checklist for useful MCP tools.
Change log. What changed in the files served here, newest first.
An MCP your users want — edited: fix(site): replace published Markdown tables with lists and fence reader output
Full agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.
Rat Stack lore | rat-stack. Short, source-grounded notes on the ideas and decisions behind rat-stack.
An MCP your users want — Rhys Sullivan’s practical guide gives rat-stack a checklist for useful MCP tools.
Source change history (log.md). The generated change log as Markdown.
An MCP your users want — edited: fix(site): replace published Markdown tables with lists and fence reader output