Project case study · Agent systems

A security boundary for an AI-accessible wardrobe.

Wardrowbe MCP exposes a self-hosted wardrobe application to AI clients without exposing the database, leaking signed media URLs, or making writes implicit.

Language: Python
Surface: 22 MCP tools
Verification: 28 passing tests
Transport: stdio + streamable HTTP

verification run

$ pytest -q
............................  [100%]
28 passed in 1.42s

01 · The constraint

Useful access without an oversized trust boundary.

A wardrobe agent needs enough context to find items, inspect wear history, understand preferences, and suggest outfits. But a direct database connection would couple the agent to internal storage, widen its permissions, and make it easy to return secrets or unbounded payloads.

02 · Design

Read-only first; writes are explicit and typed.

Default

Read-only mode

Mutating tools are registered only when an operator opts in.

Boundary

HTTP API only

The server calls the application’s supported API, never its database.

Output

Bounded + sanitized

Response limits, redacted error details, and suppressed signed media URLs.

Auth

Rotatable tokens

Absolute-path token files can reload between requests without restarts.

03 · Verification

Tests exercise the protocol, not just helper functions.

The suite validates configuration safety, bearer-token handling, path traversal rejection, response limits, structured error sanitization, exact tool annotations, read and write behavior through the MCP protocol, and an end-to-end streamable HTTP transport.

22 registered tools across inventory, outfits, preferences, analytics, weather, and feedback.
28 tests passing locally, including async protocol and transport coverage.
Docker packaging, health checks, a security policy, and token-rotation tooling.

04 · Takeaway

Agent tooling is systems engineering.

The hard part was not wrapping endpoints. It was defining a narrow, observable contract between an AI client and a private application—one that remains useful without quietly accumulating authority.

View the upstream application ↗