Best Practices

1. Controllers vs providers — tools/resources/prompts on controllers; business logic on providers.
2. Explicit DI — @injectable(deps=[...]) matching __init__. Never construct services inside a tool.
3. Pydantic descriptions — Field(description=...) so clients and Inspector show useful schemas.
4. Empty-string optionals — coerce Inspector "" with field_validator(..., mode="before").
5. Do not copy TypeScript — no Zod, no @McpApp, no UseGuards(), no React widget SDK.
6. Skills — rely on nitrostack-py init / upgrade rather than pasting TS skills.
7. Secrets — .env is never packed; ship .env.example.
8. OAuth — set OAUTH_REQUIRED in production; default allow-without-token is for Studio mocks.
9. Transports — stdio for desktop clients; http + MCP_STATELESS=true for Inspector; dual in production.
10. Validate before pack — nitrostack-py validate.