When an app becomes a server, the prompts you wrote for humans filling a form are what an agent reads to decide how to call it. That means vague field labels produce a badly-callable tool, and Dify says so. It also means the whole surface is yours to design rather than the vendor's. The security note is the important one: the URL carries the credential, so it belongs in a config file and not in a shared document.
Not a server but a publishing feature. Each app you build in Dify can be exposed as an MCP server with its own URL, and the tool surface is that app's own inputs — so there is no vendor tool catalogue by design.
Whatever your app takes as input, presented as tools. Dify's documentation advises writing clear input descriptions, because those descriptions are what a calling agent reads.
A Dify app and its generated URL. The credential is embedded in that URL — Dify warns to treat it like an API key and regenerate it if it leaks.