When should a production MCP client NOT retry a failed tools/call?

Attempt it

Quick reference

TL;DR

Do not retry a side-effecting tool when a transport failure leaves it ambiguous whether the original call already ran; a blind retry can double-charge or double-write.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Think about hitting Submit on a checkout page and the screen freezing. Did the payment go through, or not? If you click Submit again to be safe, you might get charged twice. The safe move is to check the order history first, not blindly resubmit. A production MCP client faces the same problem. When a tool call times out, the client cannot tell whether the server already ran the tool before the connection dropped. For a read like list files, retrying is harmless. For a write like send payment, retrying could fire it twice. So the rule is: retry freely when the action is safe to repeat, but never blindly retry an action that changes the world when you are unsure it already happened.

Key concepts

Idempotency Retry with backoff LLM tool use

Quick scan · 2–4 min

Everything important, quickly.

4 min: two failure classes (protocol vs tool isError) + the ambiguous-write hazard + idempotency keys + backoff with jitter + when to escalate instead of retry.

Side-by-side

Failure	Shape	Retry?
Transport timeout, read-only tool	No response / socket drop	Yes, with backoff
Transport timeout, side-effecting tool	No response / socket drop	Only with an idempotency key
HTTP 503 / 5xx	Server overloaded	Yes if safe to repeat
JSON-RPC -32601 / -32602	Protocol error object	No, permanent
Tool result with isError true	Valid result, logical failure	No, surface it

Real-world examples

Real products, models, and research that use this idea.

Stripe's API uses Idempotency-Key headers so a retried charge after a timeout settles exactly once; an MCP payment tool should mirror this.
Claude Code and Cursor MCP clients retry transient stdio and HTTP transport errors but surface isError tool results straight to the model.
Anthropic's MCP TypeScript SDK distinguishes JSON-RPC protocol errors from tool-level isError results, letting clients route each differently.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you design an idempotency key scheme so a retried side-effecting MCP tool call settles exactly once?

Sign in or go Pro to see the approach for this follow-up.

QHow do you keep exponential backoff from amplifying load during a server-wide outage?

Sign in or go Pro to see the approach for this follow-up.

QWhere does the retry decision live: the MCP client, the host, or the model?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.