Rate-limit tools by user and tenant

Agent loops can multiply calls quickly. Rate limits protect availability and cost, but a global bucket alone lets one tenant starve others.

Execute independent buckets

The MCP contract lab applies a two-call fixture limit.

from mcp_cases import rate_limit_case

result = rate_limit_case()
assert result["limit"] == 2
assert result["denied_indices"] == [2]
assert result["independent_buckets"] is True
print(result["allowed"])

The third request from T-1/U-1 is denied, while another user and tenant have separate buckets. No distributed limiter runs.

Layer budgets

Consider per-user, tenant, tool, credential and global limits plus concurrency and cost. Expensive writes may have lower quotas. Return structured limit status and retry-after without revealing other tenants’ usage.

Do not rely only on caller-provided IDs; derive keys from authenticated context. Coordinate limits across replicas using an appropriate consistent store. Agent total budgets should be stricter than service ceilings.

Test fairness and recovery

Simulate bursts, clock boundaries, retries, multiple replicas and tenant isolation. Measure denied legitimate work and overload protection. Define emergency overrides with audit and expiry.

The Generative & Agentic AI course links rate limits to loop budgets and operational observability.

Exercise

Implement user+tenant token buckets locally, test concurrent bursts and prove one tenant cannot consume another’s capacity.

Continue learning

This article is part of the MCP and integration contracts sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Handle pagination in an AI-facing data tool.
• Continue with Build contract tests for an external tool integration.

Reference: IETF RateLimit Fields RFC 9333.