What retry and backoff strategy should a production MCP client apply to tools/call failures?

Attempt it

Describe the retry and backoff strategy a production MCP client should use for tools/call failures. What is the critical safety constraint that distinguishes safe retries from dangerous ones?

Free · 2 AI evals / day

Quick reference

TL;DR

Retry transport-level JSON-RPC failures with exponential backoff and jitter, but never blindly retry a side-effecting tool; idempotency is the constraint that decides whether a retry is safe.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Imagine you mail a letter asking the bank to move $100, and you never get a reply. Did the bank get it or not? If you mail a second letter to be safe, you might move $200. That is the whole problem with retrying tool calls. Some requests are safe to resend, like asking 'what is my balance?', because asking twice changes nothing. Others, like 'send the money', are dangerous to resend, because the first one may have already worked. A careful client waits a bit longer between retries so it does not flood the bank, and it only resends the safe kind of letter. For the risky kind, it attaches a unique ticket number so the bank can spot a duplicate and ignore it.

Key concepts

Idempotency Exponential backoff with jitter Circuit breaker JSON-RPC error contract

Quick scan · 2–4 min

Everything important, quickly.

6 min: classify transport vs tool errors, map JSON-RPC codes to permanent vs transient, apply backoff with jitter, gate on idempotency with keys, then add a per-server circuit breaker and timeout budgets.

Side-by-side

Aspect	Transport-level failure	Tool-level failure
Shape	JSON-RPC error object or dead socket	Normal result with isError: true
Round trip	Did not complete cleanly	Completed; tool reported a domain error
Retryable?	Transient ones yes, with backoff and jitter	Usually no; same inputs give same error
Outcome certainty	Ambiguous; side effect may have committed	Known; the tool definitely ran
Right move	Gate retry on idempotency, use a key if needed	Surface to the model, do not swallow

Real-world examples

Real products, models, and research that use this idea.

Claude Code and Cursor wrap MCP tools/call dispatch with timeouts and bounded retries so a hung filesystem or Postgres server cannot freeze the whole agent session.
AWS SDKs popularized exponential backoff with full jitter, the same recipe an MCP client applies to transient JSON-RPC transport failures.
Stripe-style idempotency keys are the canonical pattern for safely replaying a non-idempotent side effect like charge_payment after an ambiguous timeout.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you make a non-idempotent MCP tool safe to retry after an ambiguous timeout?

Sign in or go Pro to see the approach for this follow-up.

QWhere should the model see a tool failure, and where should the client hide it behind a retry?

Sign in or go Pro to see the approach for this follow-up.

QWhy add a circuit breaker on top of per-call retries, and how do they interact?

Sign in or go Pro to see the approach for this follow-up.

QHow does the streamable HTTP transport complicate retry decisions versus stdio?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.