Bernard's MCP Server

What the server exposes

Two tools and one resource. That's the entire surface.

Tool 1: get_latest_brief

Returns the current week's full issue of Bernard's Solved Game, including The Brief if your subscription is Pro or Founder.

• Read-only. Returns text.
• Cannot modify anything on your system, in your account, or anywhere else.

Tool 2: query_archive

Searches the full archive of past issues for content matching a topic or question.

• Inputs: a query string and optionally a date range.
• Returns: the most relevant passages from past issues, with citations back to the source issue.
• Read-only. No side effects.

Resource 1: weekly_digest

The current week's issue, exposed as an MCP resource (rather than a tool call). Some clients prefer resources for static content; this is for them.

That is the entire server. There are no write tools, no file-system tools, no code execution, no calls to external services, no scraping, no agentic behaviour. The server returns text from issues that have already been published.

How to set it up

Step 1. Subscribe to Pro or Founder. On payment, you'll receive an email containing your MCP API key. Keep this secret — it's tied to your subscription.

Step 2. Add Bernard to your AI client's MCP config.

For Claude Desktop, add to claude_desktop_config.json:

{{
  "mcpServers": {{
    "bernard": {{
      "url": "https://mcp.nonxerosum.studio",
      "auth": {{
        "type": "bearer",
        "token": "your_api_key_here"
      }}
    }}
  }}
}}

For Cursor, ChatGPT, Windsurf, Claude Code, and other clients, the equivalent config goes in their respective MCP config files. The URL and auth token are the same.

Step 3. Restart your client.

Step 4. Ask your assistant: "What tools do you have from Bernard?"

It should list get_latest_brief and query_archive. If it doesn't, the connection failed — check the API key, check the URL, and if it's still failing, email me.

Rate limits

If you hit a rate limit, the server returns a structured error your assistant can handle gracefully. Limits exist to prevent abuse, not to penalise heavy use. If you're a legitimate Pro subscriber bumping into the cap regularly, email me — I'll either raise it or move you to Team early.

What it costs you (token-wise)

When you mount any MCP server, your AI assistant loads the server's tool definitions into its context window every turn. That uses tokens, which your AI provider (Anthropic, OpenAI, etc.) charges you for. This is true of every MCP server, not just Bernard's.

Bernard's tool schema is deliberately small — under 500 tokens of overhead per turn. At Claude Sonnet 4.6 pricing, that's roughly $0.0015 per session of typical use. A few cents a month for normal users. Heavy agentic users (constant background workflows) might see $0.50–$2/month of incremental token cost from their AI provider.

Your $15/mo Pro subscription covers Bernard's hosting and content production. It does not cover the tokens your AI provider charges for context-loading or for the calls your assistant makes against Bernard. Those are separate, and they bill to your AI provider's account.

I'm telling you this because almost no other publisher will. The honest version is: mounting Bernard adds a small, measurable cost on top of your AI provider bill. If that's a problem, don't mount it — read the newsletter the old-fashioned way.

What happens when you cancel

Your API key is revoked the moment your subscription ends. Subsequent calls return a 401. Re-subscribing issues a new key.

Cancelled keys do not lurk. They die.

Versioning and changes

The server is versioned. You can pin to a specific version in your config if you want predictability, or run the latest if you want new tools as they ship. Every change to the server's behaviour — new tool, removed tool, modified output schema — is announced in the newsletter the week it ships. No silent changes.

Known limitations

• No real-time data. The archive ends at the most recently published issue. If you ask about something that happened yesterday and yesterday's issue hasn't shipped yet, Bernard won't know.
• Wednesday-skewed. The newest content lands on Wednesdays. Querying on a Tuesday gives you slightly stale freshness signals.
• English only. Bernard writes in English. Translations are not currently supported.
• No streaming. Responses are returned in full, not streamed. For most use cases this is fine; for very long archive queries it may add a second or two of latency.

Open-sourcing

The plan is to open-source the server's code by month three (around 2026-08-01). This is partly a trust signal and partly so subscribers can audit exactly what the server does. Until then, the security page documents the architecture in enough detail that a technically literate reader can verify the claims.

If you want early access to the source under NDA, email me. Founders get this on request.

Security model

This section exists because mounting any MCP server into your AI assistant is a real security decision, and almost no publishers shipping MCP feeds in 2026 are documenting their threat model.

Why MCP security matters

MCP (Model Context Protocol) is the standard that lets AI assistants connect to external tools, data sources, and services. It also has known, documented vulnerabilities. The most significant ones, as of early 2026:

• Prompt injection. A malicious server can embed hidden instructions in its responses that hijack your AI assistant.
• Tool poisoning. A server's tool descriptions can contain malicious instructions that manipulate behaviour.
• Over-permissioning. A server granted broad scopes can be tricked into using those scopes against you.
• Token theft. Bearer tokens or OAuth credentials, if stolen, allow an attacker to impersonate you.
• Supply-chain compromise. A previously-trusted server gets compromised, or its publisher decides to behave maliciously.
• Denial of wallet. A malicious or buggy server can drain your AI provider's compute budget.

How Bernard's server is designed

• No user-generated content. Bernard's MCP returns only text from issues I've already written and published. There is no input channel for attackers.
• Output sanitisation. Every response is run through a sanitiser before it leaves the server. The sanitiser strips zero-width characters and patterns that resemble prompt injection.
• Read-only by design. The server has no tools that can write, execute, or modify anything. Even if a prompt injection succeeded, there's nothing for the injected instruction to do through Bernard.
• Tool descriptions are short and audited. The full text of all tool descriptions is published and deliberately under 100 words combined.
• No dynamic descriptions. Tool descriptions are static. They don't pull from a database and don't include any user-derived content.
• Per-subscriber tokens, rotatab le at any time. Each subscriber's token is unique and scoped only to that subscriber's account. You can rotate your token from your dashboard at any time.
• Public changelog. Every change to the server is announced in the newsletter the week it ships. No silent updates.
• Open-source by month 3. Once open, you or anyone you trust can audit exactly what the server does.

For full details on every risk category and our mitigation strategy, read the full security page.

Questions

Email me. I read everything.

— Bernard R. Barthes