A slow database plus eager agent retries is an outage multiplier

A slow database rarely fails alone.

Queries take longer. Connection pools fill. Agent requests hit deadlines. Clients retry.

The retry traffic consumes the capacity the database needs to recover.

An MCP database server should interrupt that loop before connection acquisition:

• authorize and budget the request at admission time
• keep queues bounded by length and age
• isolate workload classes with bulkheads
• open circuits only on dependency-health signals
• shed expired, duplicate, speculative, and low-priority work first
• preserve capacity for cancellation, reconciliation, health, and operator access
• return typed retry guidance instead of an exception sentence

The half-open state matters as much as the open state.

Do not release the whole retry backlog as a recovery probe. Admit a few lightweight, time-bounded requests, add jitter across server instances, and require sustained success before closing the circuit.

Also count logical operations separately from attempts. If the client, gateway, tool wrapper, driver, and scheduler each retry independently, a single user request becomes a small denial-of-service attack.

Full guide: MCP database server circuit breakers and load shedding