Everyone is shipping MCP servers right now. Almost nobody demos the boring part. The demo is always the same: connect the agent, watch it read your data, applause. The part that decides whether it ever reaches production is credentials. One set of tokens shared across every client is fine on your laptop and unacceptable the moment you have two customers. So when I built Munim, my open-source MCP server, the first design decision was not which tools to expose. It was that every client gets its own isolated credential store, and the server refuses to pass raw credentials through to the model. Eleven providers, OAuth where the provider supports it, 71 test modules covering the paths that would leak something if they broke. None of that is interesting in a demo. All of it is the reason an IT team says yes. If you are wiring an agent into real customer data, ask the person building it how credentials are isolated per client, and what happens when a token expires mid-call. The answer tells you whether you are looking at a prototype or a product. Munim is open source: github.com/vishalsg42/munim P.S. It was built with AI assistance, which is disclosed in the README. The design decisions above were not delegated.

I just open-sourced my Contra MCP Starter Toolkit ⚡

Contra now has a native Model Context Protocol server, which means MCP-compatible AI agents can work directly with your Contra account — profile, services, portfolio, proposals, projects, invoices and more.

The problem: getting a coding agent properly connected still involves OAuth, PKCE, token refresh, MCP configuration and making sure the agent respects Contra’s prepare → confirm workflow.

So I packaged the setup I was using into an open-source starter kit:

👉 GitHub: https://github.com/alexandernevsky/contra-mcp-starter

What’s inside:

• One-command OAuth setup — run npm run auth, authorize Contra in the browser, and the local callback handles PKCE and token exchange.

• Zero dependencies — native Node.js 18+ only: fetch, crypto, http and fs.

• Automatic token refresh — the client catches expired sessions, refreshes the access token and retries the MCP request.

• Safe agent workflows — instructions for Cursor, Google Antigravity, Claude Code and Windsurf built around Contra’s native prepare → confirm protocol, including a full before/after review before any live mutation.

• Zero-code AI mode — copy-paste prompts for inspecting your Contra account, restructuring services, updating your profile and publishing portfolio case studies without writing JavaScript yourself.

• Content-as-Code templates — Markdown blueprints for profile positioning, flagship services, pricing, FAQs and structured case studies.

The interesting part for me isn’t just Contra.

It’s the workflow: your professional profile becomes something an AI coding agent can inspect, reason about and maintain through structured tools — while you keep final approval over every write.

Repo: https://github.com/alexandernevsky/contra-mcp-starter

Contra: https://contra.com/alexander_nevsky

If you use Contra + Cursor / Claude Code / Antigravity / Windsurf, try it and tell me what’s missing.