What Backend Data Conditions Claude MCP Tools Require to Run Reliably

Claude MCP tools run reliably only when the backend makes identity, permissions, data, and event state explicit. The 2026 stateless protocol shift makes that foundation unavoidable. A tool connection can let Claude reach a system, but it cannot make that system’s data accessible, its permissions appropriate, or its failures traceable.

What the 2026 stateless shift actually changed for backends

The 2026-07-28 MCP specification removed the initialize/initialized handshake and replaced the session-based model with a stateless core. Under the old model, the transport session carried connection state, including user identity, capability negotiation, and session context, through the handshake and Mcp-Session-Id header. Without that session machinery, the backend must hold the state it needs to understand and authorize each request. Stateless memory needs a home of its own outside any one connection.

That change breaks designs that need hidden connection state to work correctly. A backend cannot rely on identity stored only in a connection, permissions cached at initialization, or a request returning to the same server instance. Instead, that information must live in an authorization layer, a persistent database, a cache, or request metadata. The distinction is between state that happens to be available and state that any authorized request can resolve. Only the latter survives the loss of session affinity.

Stateless requests can reach any instance behind a standard load balancer, while gateways can inspect headers to enforce policy. Each request can recover on its own, without needing a chain of session interactions to stay intact. That is a useful trade, but it is not free. The protocol sheds responsibility for state, and the backend picks it up.

The three protocol primitives and what each demands from the backend

Claude Code MCP documentation describes three primitives as the foundation of server capability, namely tools, resources, and prompts. They expose different ways for Claude to act or obtain context, so each puts a different demand on the backend. Tools need authority to act, resources need dependable access to data, and prompts need current parameters. This maps the backend requirements across a shared system. All three depend on state that can be retrieved without a session doing the remembering.

Tools invoke external services and APIs on behalf of the model. Their backend must resolve per-call authorization, limit write permissions, and leave a clear audit trail of who called, with what authority, and what happened. Resources make structured and unstructured data available as context. That data must be persistently stored, queryable by identifier, and available without reaching a particular server instance. A resource is not reliably accessible if its location depends on which server remembers the caller.

Prompts are standardized templates for frequent LLM operations, but their inputs may be anything but static. User identity, tenant configuration, and plan state must be retrievable when the prompt needs them. This ties prompts to the same identity and data foundations as tools and resources. The four backend conditions therefore cut across the primitive boundaries. Identity establishes the caller, permissions constrain the action, data accessibility supplies the context, and event state makes the result reviewable.

Identity: why per-call authorization replaced session-level trust

Per-call authorization starts with a simple rule that the backend must identify the caller from the proof carried by that call. Trust established on an earlier connection is not enough for a stateless request. The backend needs to resolve the user, their tenant, and their authority without relying on that connection’s memory. Identity is therefore the first dependency for every other condition. Until the caller is known, there is no sound basis for deciding which data or actions belong to them.

Each invocation must resolve what data is readable and whether the caller can write, delete, invoke external services, or trigger high-risk actions. It must also establish whether the call is logged with enough context. At the database layer, the floor is a Postgres role with the minimum grants required. A read-mostly setup usually needs rights to read widely and to write to a small set of tables for which those rights have been explicitly granted. An agent does not need the master keys just because finding the right key takes longer.

With the July 2026 artifacts update, users see the same boundary in the viewer-scoped authentication used for published MCP-backed artifacts on Pro/Max/Team/Enterprise. Each viewer authenticates through their own claude.ai connector OAuth, and the publisher’s credentials are never shared. Public sharing is blocked for MCP-backed artifacts on all plans because a public URL has no authenticated viewer through whom to broker OAuth. The principle is recognizable even outside the UI. Access belongs to the authenticated caller.

ZoomInfo’s MCP security page describes a stateless server whose requests pass through an MCP Gateway for authentication, entitlement enforcement, and routing. OAuth 2.1 does take more work for small teams to set up. However, that work is front-loaded, whereas hidden session trust creates recurring work whenever a failure requires identity to be reconstructed.

Permissions: scoping what an agent can read, write, and trigger

Once identity is established, the backend must constrain what that identity can do for the current task. Overbroad permissions are not merely a security concern. They let an agent alter state that its task was never meant to touch, which makes them a correctness problem too. Nothing in the protocol supplies the missing boundary. A successful tool call can still be the wrong action.

For that reason, permission checks belong at runtime. Task context changes between calls, so earlier authorization cannot decide what the caller may do in every later call. Write and delete grants should cover the smallest possible set of tables or API endpoints and be explicit in the backend’s role or token configuration. Convenience is not a useful permission tier. Inheriting a broad role saves work at setup but leaves production to bear the cost.

Vanilla Postgres MCP setups show the problem clearly because the agent inherits the role in the connection string. If that role can drop tables, so can the agent, and there is no intervening layer to enforce narrower grants at call time. High-risk actions, including external service calls, customer charges, access revocation, and record deletion, warrant a separate permission tier and ideally human approval. The Tasks extension, formalized in the 2026-07-28 specification, models long-running work through polling, mid-flight input, and durable handles. That supports asynchronous workflows, but does not replace their authorization boundaries.

Payment tokens apply the same rule to a particularly consequential action. A token can be issued per agent and constrained by merchant category, spending cap, and time window, with independent revocation. The agent gets that scoped token in place of raw credentials.

Data accessibility: why persistent, queryable, cacheable state is the reliability floor

Even a properly authorized call cannot produce a dependable result from inaccessible or malformed data. Nor can it depend on data held only by the server instance that handled an earlier request. A bad read can cascade because an agent uses tool output to decide what happens next. Durable storage is therefore only the beginning. The data must also be consistently addressable and structured for the questions the agent needs to answer.

Explicit state handles provide continuity without a session. A tool can return a basket_id, task_id, or browser_id for later calls to pass back, but the backend must resolve that handle durably. Resources need the same stability in their identifiers. A URI that changes between requests, or content that depends on one instance’s session memory, breaks the resource model. The handle is a forwarding address.

Cacheable list results in the 2026-07-28 specification depend on consistent results across instances. If the answer changes according to which server receives a request, caching preserves the inconsistency. Query structure matters just as much for useful answers. An opaque invoice total cannot explain a bill increase, while usage events with timestamps, feature identifiers, and tenant keys give the agent data it can query from live systems. A summary number tells the agent the bill’s total.

Accessibility also has a context-window boundary. An unscoped tool surface can fill the available context before the data needed for the task arrives, leaving the agent with a connection it is poorly equipped to use. This is not simply a cost concern. A smaller, intentional tool surface leaves more room for the content needed to complete the task. Reachable data is useful only when the agent can actually bring it into its working context.

Event state: the audit and observability condition every production tool needs

When a tool fails silently, what the agent believes happened can differ from what actually happened in ways that cause serious harm. If the agent assumes an action succeeded, later answers can be confidently wrong. Without a structured event log, the backend cannot reconstruct where that chain broke. Event state is what makes behavior reviewable and failures recoverable.

Error quality does not come guaranteed by the protocol. Server authors may return structured errors, opaque stack traces, or nothing useful, so the backend must enforce a consistent error structure across upstream APIs. A Layer 7 gateway between the identity layer and the MCP server provides a place to observe, filter, and record interactions. It can keep records of connection ID, scope grants, token lifecycle events, and revocation state. Provisioning identities or rotating secrets is not enough if requests then reach their targets unmediated, without a policy surface or audit record.

The integration layer can do that audit work without keeping customer payloads. In a zero-data-retention design, the managed MCP server translates the JSON-RPC tool call, injects the OAuth token in memory, and streams the upstream response back. Keeping customer data in transit separates the audit trail of the interaction from a stored copy of its contents, keeping the audit scope tractable.

The GDPR consequence follows from knowing what the system processes and where. Article 30 requires records of processing activities, including purposes, categories, recipients, retention periods, and security measures. It does not require a per-transaction log keyed to individual users and timestamps. Operational event logs and those processing records have related but different jobs. A coherent backend makes both easier to account for without confusing one with the other.

How a unified backend satisfies all four conditions without per-tool integration work

For solo founders and small teams, the hard part is meeting these conditions across a patchwork of single-purpose systems. Each additional tool adds synchronization work between identity, permissions, data, and event records. A unified backend brings those needs into one design, with no need for a separate integration project for each. When authentication, user data, billing events, and audit logging share a system, per-call authorization can use the same state as the operation it governs. There is no gap to reconcile between one system’s view of the user and another system’s billing record.

That shared foundation also allows a smaller tool surface. When authentication, payments, and analytics belong to one system rather than separate APIs, an agent needs fewer tools for a multi-step task. With fewer tools, there is less context-window pressure and each call is more likely to be accurate. The benefit is not merely fewer connections on an architecture diagram.

Payments make the architectural fit especially clear. A backend acting as Merchant of Record can handle tax compliance, chargebacks, and payment credential management in the same system as user identity. That puts the scoped token, audit log, and tenant record in one place, without a separate integration that must meet payment-card security requirements. European hosting and GDPR compliance at the infrastructure layer likewise bring data residency, Article 30 processing records, and SOC 2 audit scope into a shared backend decision. These are distinct obligations, but they need not become disconnected projects.

Integration work can follow the same approach. A backend that exposes an MCP server and supports command-line skill installation lets an AI agent do the connection work without having to read the documentation for every tool. That operational convenience matters only when the underlying conditions hold. A common backend surface can establish the caller, constrain the action, retrieve dependable data, and account for the outcome. MCP makes the call possible, while explicit backend state makes it reliable.