Add a per-tool kill-switch to your MCP server — minutes-to-seconds containment vs. hours-to-days fixes

Digital Applied·medium signal

Digital Applied's 2026 guide argues every MCP server needs a server-side toggle that disables one tool while the catalogue stays live, because patching a vulnerable tool takes hours-to-days but the kill-switch contains exposure in seconds. Store the flag outside your deploy cycle (env/config service/DB), check it at dispatch before the handler, emit an audit event on change, and test it quarterly. Most teams can add this in an afternoon and it's the single cheapest incident-containment control for an agent tool surface.