An MCP your users want
Rhys Sullivan’s practical guide starts with the jobs people already do in a product. It asks MCP authors to expose dashboard actions, keep code mode21 as a choice made by the agent’s client, and provide documentation search. It also covers links to specific product actions, groups of tools, and OAuth authorization. OAuth lets a person authorize a client to access a service.¶
The table compares his advice with rat-stack today. The gaps remain open; this page authorizes no changes.¶
| Rhys’s point | rat-stack today | Verdict |
|---|---|---|
| Do what the dashboard can do. | Each interface uses the same contract and handler. The public site exposes search and read; the CLI projects registered capabilities too. | Agree |
| Keep code mode out of the default MCP tool list. | CLI mcp uses plain tools; --code-mode opts into code mode. The hosted site’s MCP includes execute because demonstrating the sandbox is the site’s job. | Agree in the template; the hosted site differs |
| Ship search for docs and skills. | The site’s search and read capabilities cover public content. Lore pages are included in the searchable documentation. | Agree |
| Add a deep link into the product. | No product-action deep-link tool appears in the hosted capability registry. | Gap |
| Offer toolsets and permissions tied to the auth token. | Contracts can require approval, and Approval gates execution. The hosted MCP has no user-token toolsets; auth.md says it accepts no credentials. | Gap |
| Let clients use OAuth; an API spec and Client ID Metadata Document (CIMD) OAuth cover most agents. | The auth cartridge supports Better Auth sessions for an app, but ratstack.sh says it has no OAuth or access tokens. | Gap |
The comparison uses apps/site/src/capabilities/index.ts, apps/cli/src/command.ts, packages/capability/src/approval.ts, packages/auth/src/auth.ts, and the hosted site’s auth.md. See one capability, every surface18 and the cartridges36 page for the contracts and auth boundary.¶
Sources
- Rhys on X: "Here's Rhys' practical guide to shipping an MCP your users want: - Your MCP should be able to do everything your dashboard can Yes including things like deleting resources. The way to make this practical inside of an agent while not having things be unsafe is to deep link them into yo… / X. Rhys Sullivan. Practical MCP guide; used to compare dashboard actions, docs search, deep links, and OAuth. Accessed 2026-10-01.
- rat-stack/apps/site/src/capabilities/index.ts at main · joelhooks/rat-stack · GitHub. GitHub joelhooks/rat-stack. Capability registry; used to check the hosted tool coverage. Accessed 2026-10-01.
- rat-stack/packages/capability/src/approval.ts at main · joelhooks/rat-stack · GitHub. GitHub joelhooks/rat-stack. Approval service; used to check the safety boundary for actions. Accessed 2026-10-01.
- rat-stack/packages/auth/src/auth.ts at main · joelhooks/rat-stack · GitHub. GitHub joelhooks/rat-stack. Auth service; used to distinguish current sign-in from MCP OAuth. Accessed 2026-10-01.
Last changed 2026-10-10 in 978dccc. Source on GitHub. Change log.
Linked from
- Agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.
An MCP your users want — Rhys Sullivan’s practical guide gives rat-stack a checklist for useful MCP tools.
- Change log. What changed in the files served here, newest first.
An MCP your users want — edited: docs: point live docs, skills and Brain pages at apps/site
- Full agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.
- Rat Stack lore | rat-stack. Short, source-grounded notes on the ideas and decisions behind rat-stack.
An MCP your users want — Rhys Sullivan’s practical guide gives rat-stack a checklist for useful MCP tools.
- Source change history (log.md). The generated change log as Markdown.
An MCP your users want — edited: docs: point live docs, skills and Brain pages at apps/site