Most Model Context Protocol examples stop at a friendly toy tool: return the weather, echo a string, or fetch a tiny bit of sample data. That is useful for learning the shape of MCP, but it skips the harder question enterprise teams actually face: how do you expose real application capabilities to AI agents without turning your systems into an ungoverned side door? This session goes beyond the basics and treats an MCP server as a production integration boundary. Using C# and .NET, we will look at how to expose narrow, typed tools over realistic business capabilities, then harden that boundary with the concerns that matter once the demo leaves the laptop: input validation, deterministic structured output, safe error handling, redaction, least-privilege access, audit logging, timeout and cancellation behavior, versioned tool contracts, and clear separation between read-only tools and side-effecting operations. We will also cover MCP resources and prompts as design elements rather than magic shortcuts: where they help, where they create risk, and how to keep the model from receiving too much context or too much authority. Along the way, we will call out anti-patterns such as generic query tools, overbroad filesystem access, ambiguous natural-language parameters, and letting an LLM decide irreversible actions without policy. Attendees will leave with a practical architecture for building MCP servers that fit real .NET systems: discoverable enough for agents to use, constrained enough for security teams to tolerate, and observable enough for production operations.