Build1 distinct publisher3 min readPublished
A dev.to walkthrough collapses the path, query, header and body inputs of one project-management endpoint into a single tool schema. Most of that work is mechanical. Then you reach the header that governs retries.
The Engineer · Build desk

Compiled by The EngineerSomething wrong?How this is made
The adapter is where the flattening actually costs something. One flat object arrives from the model, and something server-side has to re-split it into a route, a query string, headers and a body. None of those destinations exist in the JSON the model produced. What carries that information instead is the description text on each property, so the tutorial's stated goal of not hiding the real contract [2] amounts to a claim about documentation strings rather than a property of the schema's types.
Count the surface of the update example. Three plus one plus one plus four is nine fields on one object [14]. Four of them are the floor for a valid call: the three path identifiers the route cannot be built without [10], plus one body property, because the body is required and declares `minProperties: 1` [15]. The rest are optional.
`Idempotency-Key` is the field where a mechanical mapping goes wrong. The spec marks it `required: false` [6], and a generator that respects that produces a tool a model can call correctly forever without ever setting it. Then a tool call times out, the harness retries, and the second PATCH is a second write. Deduplication only works when the retry carries the same value as the first attempt. That makes key generation a property of the logical operation rather than of the outbound HTTP request, and the adapter is usually the only component that can tell those apart. Minting a fresh UUID per request still satisfies the schema, even though it defeats deduplication entirely.
For this mapping to transfer to your API, a few properties of the example have to hold. The endpoint needs to name one resource and one action, or the naming guidance has nothing to work with; the tutorial's own alternatives, `update_task_status`, `assign_task`, `reschedule_task`, only separate cleanly because the underlying operations do [9]. Path identifiers have to be independently meaningful, which is the argument for keeping three fields instead of one [10]. Constrained values have to be constrained in the spec, like the four-value `status` enum [8], because the enum is the only thing stopping the model from inventing a status string that round-trips as a 400. Endpoints that take a verb in the body satisfy none of this, and flattening them yields one tool that can do anything, leaving the model effectively schema-less.
One limit on the source. The excerpt ends mid-schema, at the `required` array of the ticket-list example [17]. Path, query and body are worked through in detail. The header mapping, where both the Bearer token and the retry key live, sits on the other side of the cut, so the hardest third of the problem it sets up is not in the part I can read.
Ranked by verification strength, evidence, and original report placement.
The worked example is a project-management endpoint, PATCH /workspaces/{workspace_id}/projects/{project_id}/tasks/{task_id}, which updates one task.
That endpoint accepts path parameters for workspace_id, project_id and task_id, a query parameter such as notify_assignee, a request body with the fields to update, authentication through a Bearer token header, and an optional request header such as Idempotency-Key.
In the same snippet, Idempotency-Key is declared in: header with required: false and schema type string.
A dev.to tutorial states that an API operation can receive input from several places: path parameters identify the record, query parameters filter or paginate the result, headers carry metadata or authentication, and the request body contains structured data for create and update operations.
The tutorial's premise is that an MCP tool should give the AI client one clear input schema, and that the goal is to make the tool easy for an AI client to call without hiding the real API contract.
In the shortened OpenAPI-style snippet, notify_assignee is in: query, required: false, type boolean, with default false.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 28, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
Rate limit your MCP servers, because a retrying agent turns one error into a billing incident1 distinct publisher
security
An agent guard that runs on your laptop, and cannot tell you whether anyone keeps it on1 distinct publisher
build
Buy transactional email on recovery controls, not send price1 distinct publisher
build
Claude Code walks the whole process table to inherit one shell's environment1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Self-verifying snippets, nothing from outside
Every factual detail in this story can be read straight off dev.to's own page — the false default on notify_assignee, the four-value enum on status, minProperties: 1 on a required body, required: false on the idempotency header — and we checked each against the printed specification. That is why the descriptive claims hold. It is also the ceiling: no protocol specification is cited, no generated adapter is exercised against a live API, no second practitioner's mapping is offered for contrast, and the page runs out mid-rule on the one question the story is built around.
Nothing deployed, nothing counted
A tutorial has no install base, and this one reports none. The nearest thing to a real-world footprint is a paragraph stating that 0mcp supports API key, Bearer and OAuth pass-through with credentials supplied by the client at request time — a description of what a product does, not evidence that anyone is running it. We are not scoring uptake off a capability sentence.
Understated exactly where it matters
dev.to oversells nothing. The claims are small, the snippets back them, and the tone stays at the level of 'here is how the fields line up'. The imbalance runs the other way: Idempotency-Key is filed under headers that 'may still matter', left required: false in a write operation an agent will sometimes retry, and then the page ends mid-sentence on the rule that would have resolved it. A duplicated task update is a bigger consequence than the half-sentence it gets.
A vendor named inside the advice
Halfway through the security discussion the generic guidance acquires a proper noun: 0mcp, which supports API key, Bearer token and OAuth pass-through and, we are told, forwards credentials rather than storing them. The advice around it — keep secrets out of the tool schema, let the runtime hold them, let the upstream API keep enforcing permissions — is sound and would be sound without the name. But the passage telling you not to hold credentials in the schema is also the passage telling you whose runtime should, and no relationship is disclosed either way.
Sure what was said, unsure it was finished
Split verdict. What the tutorial states, it states in full — printed schemas leave little room for us to misread it, and the arithmetic on field counts and page sizes is ours to check. What we cannot judge is completeness: one publisher, no corroboration, and a body of text that terminates inside the sentence the headline depends on. High confidence in the transcription, low confidence that the argument was ever concluded.