Everyone is shipping MCP servers right now. Almost nobody demos the boring part. The demo is always the same: connect the agent, watch it read your data, applause. The part that decides whether it ever reaches production is credentials. One set of tokens shared across every client is fine on your laptop and unacceptable the moment you have two customers. So when I built Munim, my open-source MCP server, the first design decision was not which tools to expose. It was that every client gets its own isolated credential store, and the server refuses to pass raw credentials through to the model. Eleven providers, OAuth where the provider supports it, 71 test modules covering the paths that would leak something if they broke. None of that is interesting in a demo. All of it is the reason an IT team says yes. If you are wiring an agent into real customer data, ask the person building it how credentials are isolated per client, and what happens when a token expires mid-call. The answer tells you whether you are looking at a prototype or a product. Munim is open source: github.com/vishalsg42/munim P.S. It was built with AI assistance, which is disclosed in the README. The design decisions above were not delegated.