There are thousands of Model Context Protocol servers now. Most of them are the same server: a thin wrapper around somebody's REST API, every endpoint promoted to a tool, every tool granted every permission, and a README generated by the same model that will end up consuming it.
This post is about a different one: the server inside Hiberden, a desktop application for LTO tape archiving. That combination sounds like a joke (the oldest storage medium in active use, wired into the newest interface fad) but the design decisions in it are exactly the ones most MCP servers get wrong, and they are the same ones we bring to the local AI integrations we build for clients.
The Product, Briefly
Hiberden writes every copy an archive needs and reads each one back to verify it. You point it at a folder, and it writes copies to whatever destinations you have configured (tape, local disk, NAS, or S3-compatible cloud) in one operation. A unified catalog tracks every copy of every archive across all of them.
The tape part is why it exists. We have written before about LTO tape being the cheapest byte in storage, and Hiberden is aimed at exactly the people that economics attracts: video production houses and anyone else sitting on terabytes of finished work that must survive but will rarely be read. It writes tape in LTFS with a documented JSON sidecar format, so the data remains readable without the software. It runs on Windows 10 and later, Linux, and macOS.
None of that is why we are writing about it. The MCP connector is.
Why an Archive Catalog Is a Perfect Fit for MCP
An archive catalog is metadata all the way down: file names, sizes, checksums, which tape holds which copy, job history, verification state. It is the kind of data people ask questions about in plain English and then struggle to translate into a query. Which archives have only two verified copies? Is the 2023 client footage on tape somewhere, and which cartridge? What failed verification last month and has anyone re-run it?
That is the query shape language models are genuinely good at, and Hiberden's connector leans into it. Connect an assistant that speaks MCP (Claude or any of its peers) and those questions become answerable directly against your catalog.
The design decision that makes this safe is a hard line we drew on purpose: the connector answers from the catalog, and the archived files themselves are never handed to the assistant. When it verifies a copy, Hiberden reads that copy on your machine and reports the verdict, not the data. Your assistant can know everything the catalog knows about your archive without ever seeing a single archived byte. For a tool built for people archiving unreleased footage, that line is not a detail. It is the whole design.
The Tool Inventory
The read tier covers search, coverage, job history, verification status, and reporting. The tool names describe themselves: find_file answers the where-is-it question across every destination at once. coverage_status reports which archives meet their required copy count and which are exposed. archive_detail and tape_detail drill into a single archive or cartridge. list_archive_files returns manifest data with sizes and checksums. list_jobs and recent_activity cover what the software has actually been doing.
This is the unglamorous heart of good MCP design: small, composable, honestly-named tools that map to questions a user actually has, rather than endpoints an API happened to expose. An assistant given these can do real work: produce a coverage audit, chase down a missing file, summarize a month of verification history. No single tool does more than one thing.
The Permission Tiers Are the Standout
Most MCP servers ship all-or-nothing: install the server, get every capability it has. Hiberden ships three access levels, chosen in the application's settings, not buried in a config file.
- Read-only, the default. Search, coverage, job history, verification, and every report. Nothing about your archive can change, except that a verification records its own result.
- Archive, which adds housekeeping: create projects and collections, rename things, re-file archives. Organization changes, but no archived data is touched.
- Full, which adds destinations and policies, the decisions about where copies live.
And then the detail we would put in a textbook: deletion is not part of any tier. It sits behind a separate toggle, off by default, so that even an assistant with full access cannot remove anything until a human makes that one additional, deliberate decision.
The settings screen backs all of this with a record. Every change a connected assistant makes lands in an append-only audit trail, including the attempts the server refused: a delete attempted with the override off, a policy change attempted below the Full level, each logged as denied. A refused call is not an error that vanished. It is a line in the record.
This is least privilege implemented as user experience. The blast-radius conversation most teams have after an incident happened here at design time, and it produced a permission model a non-technical user can reason about in one sentence: the AI can read everything, change what you let it, and delete nothing unless you flip a switch that says otherwise.
Packaging Like It Matters
Distribution is where most MCP projects go to die: half-documented, cloned from GitHub, configured by hand. Hiberden treats the connector as a product surface. In the app, connecting an assistant is one action: it auto-configures Claude Desktop, Cursor, or Windsurf, and hands you the config to paste anywhere else.
Outside the app, the server is published to the official MCP registry as a versioned, checksummed bundle running over stdio. It is also listed in third-party directories like Glama, which is increasingly how MCP-capable assistants and their users discover servers at all.
The transport choice deserves a sentence of its own. This is a local stdio server reading a local catalog, and there is no Hiberden cloud in the loop: no relay, no hosted service in the middle, and nothing about the archive uploaded to Hiberden. For software whose core promise involves air-gapped tape on a shelf, extending that posture to the AI integration instead of breaking it for convenience is the consistent choice, and rarer than it should be.
The Trust Stack Underneath
Here is the part that matters most: an assistant's answer is only as good as the record it reads, and Hiberden's catalog is not a best-effort log.
Every archive gets a SHA-256 fingerprint when it is sealed. After every write, the software reads the copy back off the actual medium and checks it, rather than trusting that the write succeeded. Re-checks use BLAKE3 for speed, with full SHA-256 verification available on demand. A signed record of the fingerprints is written beside the archive itself, so a copy can be proven intact even offline, away from the catalog. Every copy carries one of four states (Verified, Failed, Missing, or Listed) and coverage only counts copies that have independently passed a read-back check. The whole model is documented in the Hiberden knowledge base.
This matters more for the AI integration than for any dashboard. A language model will summarize whatever substrate you give it, fluently and confidently, including garbage. The way to get trustworthy answers out of one is not a smarter model. It is a substrate that refuses to contain unverified claims. When an assistant connected to this catalog reports an archive as covered three-of-three, it is citing cryptographically verified state with timestamps, not optimism.
What to Steal
We build AI search and retrieval integrations for clients, and this connector is a compact checklist of the things we find ourselves repeating:
- Expose state, not storage. The assistant gets the catalog, never the payload. Decide where that line is in your system and enforce it structurally.
- Tier your writes, default to read. Most sessions only ever need questions answered.
- Make destruction a separate decision. Not the top tier. A separate, off-by-default one.
- Package like software, not like a repo. Registry entry, versioned bundle, checksums, one-click config for the common clients.
- Stay local when the data is sensitive. stdio is not a limitation. For a whole class of products it is the feature.
The Takeaway
The Model Context Protocol is in its gold-rush phase, and most of what is being staked is worthless. The servers that will still matter in two years look like this one: narrow tools that map to real questions, permissions a human can reason about, packaging that respects the installed base, and underneath it all, data worth asking about.
It is no accident that this design came out of tape archiving, a corner of computing that has been quietly doing verification, provenance, and durability for decades. The AI industry is currently rediscovering all three. Hiberden is on LinkedIn, the connector is documented at hiberden.app/mcp, and the 30-day trial includes a virtual tape drive, so you can connect an assistant to a working catalog without owning a single cartridge.
And if you are building an MCP server of your own, for your product or your internal data: steal this design. The bar is lower than it should be, and clearing it is mostly discipline, not genius.
Agave Information Solutions builds custom software, database systems, AWS infrastructure, and private AI search solutions for organizations with complicated data.