FIELD NOTE · 2026-09-26
MCP for sleep data: a practical architecture
How to expose useful sleep tools to agents without turning MCP into an authorization bypass.
8 minStart with a small tool surface
Read-only operations such as latest report, report history, stages and events cover useful analysis without granting broad mutation capabilities.
The API remains the boundary
MCP should call the same authorized domain API as every other client. It must not query internal tables or invent a parallel permission system.
Skills are workflows, not credentials
A Skill can teach an agent to compare seven nights and cite missing dates. Tokens remain in the MCP process and every returned fact keeps its member and time range.
Planning a smart mattress product?Request an evaluation kit