Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

MCP demos are easy. MCP in production, multi-tenant, for tens of thousands of users, is a different sport.

Connecting an MCP server takes an afternoon. Running one for real customers is where the interesting failures live. I’ll cover what actually holds up under load: stateless MCP transports on serverless (why an in-memory session map quietly kills horizontal scaling, and why request/response JSON just works), OAuth 2.1 connectors with PKCE, and on-demand data stores - with real numbers from a burst test.

Then the security landmines that are specific to this shape of app: a public per-tenant connector that will happily hand every customer’s name, email, and phone to any anonymous caller; forgeable session cookies that also mint an OAuth token; an unauthenticated endpoint that can wipe a tenant’s data; and the host-side constraints you simply cannot control - your connector’s icon is your domain’s favicon, and you can’t pre-fill the install dialog no matter what you try.

Every item comes with the fix, straight from a production readiness audit.