# agent-ready website

Published articles for agent-ready website.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Patching This Site's MCP Endpoint and Limiting What It Can Do

DevFeed: [Patching This Site's MCP Endpoint and Limiting What It Can Do](<https://devfeed.tech/articles/patching-this-site-s-mcp-endpoint-and-limiting-what-it-can-do-30870.md>)

Original publisher: [Read original article](<https://brent.leekley.me/blog/mcp-patch-and-limits/>)

Author: Brent Leekley

Published: 2026-09-08T00:00:00Z

Content type: tutorial

Language: en

Sources: [brent.leekley.me blog](<https://devfeed.tech/sources/brent-leekley-me-blog.md>)

Topics: [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [MCP Server](<https://devfeed.tech/topics/mcp-server.md>), [API](<https://devfeed.tech/topics/api.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [JSON](<https://devfeed.tech/topics/json.md>)

Tags: [aeo](<https://devfeed.tech/tags/aeo.md>), [agent-ready-website](<https://devfeed.tech/tags/agent-ready-website.md>), [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [agents](<https://devfeed.tech/tags/agents.md>), [api](<https://devfeed.tech/tags/api.md>), [api-security](<https://devfeed.tech/tags/api-security.md>), [clients](<https://devfeed.tech/tags/clients.md>), [json-rpc](<https://devfeed.tech/tags/json-rpc.md>), [logs](<https://devfeed.tech/tags/logs.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [model-context-protocol](<https://devfeed.tech/tags/model-context-protocol.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [rate-limiting](<https://devfeed.tech/tags/rate-limiting.md>), [retry](<https://devfeed.tech/tags/retry.md>), [server](<https://devfeed.tech/tags/server.md>), [streamable-http](<https://devfeed.tech/tags/streamable-http.md>), [webmcp](<https://devfeed.tech/tags/webmcp.md>)

### AI overview

This article explains how to patch a website's public, unauthenticated MCP endpoint. It covers updating to the current protocol revision while retaining compatibility with older clients, and applying limits including read-only tools, per-IP rate limiting, request-size caps, Origin checks, POST-only access, non-reflected strings, and privacy-preserving logs.

### Source excerpt

An MCP server on your website is a public, unauthenticated API. Bringing one to the current protocol revision while keeping older clients working, and the seven limits that bound it: read-only tools, a per-IP rate limit that always sends Retry-After, hard caps on body and argument size, an https-only Origin check, POST only, no reflected strings, and logs that store a salted hash instead of an address.