Lab build: an MCP server that gives Claude safe hands on ops data, every write a dry-run first

The problem

Handing an LLM real tools over an ops database is where agent demos get dangerous: 'just don't do anything destructive without asking' is a hope, not a guarantee, and two confirmed actions racing each other can quietly double-apply.

The approach

1. Exposes seven tools over a support-ops DB (tickets, customers, invoices): reads run instantly, every mutation defaults to a dry-run that previews the exact change without touching data.
2. Human-in-the-loop is enforced by the tool contract, not model goodwill: a mutation executes only when the model re-calls it with an explicit confirm, so nothing lands on a single unconfirmed step.
3. Race-safe under concurrency: two concurrent confirmed refunds resolve to exactly one that lands, proven by a dedicated concurrency test rather than assumed.
4. Zero-key quickstart (npx tessera-mcp --seed spins up a seeded database with no credentials), guarded by a deterministic 23-case tool-contract eval (npm run eval) including the concurrency check.

The results

An MCP server that lets Claude act on ops data without acting unsafely: reads are free, writes are preview-then-confirm by contract, and concurrent confirms can't double-apply, the whole guarantee covered by a deterministic suite that passes 23/23.