03 — Protocol

MCP: Making AI Talk to Your Tools

Model Context Protocol (MCP) is an open-source protocol that lets LLMs discover and call external tools, query databases, access files, and perform real-world actions — not just generate text. Think of it as USB for AI.

What Is MCP?

MCP creates a client-server architecture between AI applications and external services. It builds on JSON-RPC 2.0 as its message format and was released as fully open-source by Anthropic in November 2024.

Host
The AI app the user interacts with (e.g. Claude Desktop, Cursor, Gemini CLI)
MCP Client
Built into the host; handles connection and communication with servers
MCP Server
Lightweight process exposing tools, resources, or prompts (GitHub, PostgreSQL, filesystem)
Transport
Two methods: STDIO (local) and HTTP+SSE (remote, over the network)

How a Conversation with MCP Works

1
Initialization
Host app starts, creates MCP clients, exchanges capability info via handshake
2
Discovery
Client asks each server: "What tools, resources, and prompts do you offer?"
3
Registration
Client registers available capabilities so the LLM can use them
4
LLM Decision
During conversation, the model decides to call a tool (e.g. query a database)
5
Request
Client sends a structured JSON request to the appropriate MCP server
6
Execution
Server performs the action (reads file, calls API, queries DB, runs code)
7
Result Return
Server returns structured JSON back to the client
8
Context Integration
LLM receives the result and incorporates it into its response

This entire cycle typically completes in seconds and is invisible to the user.

The Three Types of MCP Server Capabilities

Type Controlled By Description Example
Tools Model Functions the LLM can call to perform actions get_weather("Tunis"), run_sql_query()
Resources Application Data sources the LLM can read (no side effects, like GET) File contents, database schema, logs
Prompts User Pre-defined templates for optimal tool/resource usage "Summarize this repo's README"

Why Engineers Should Care

MCP unlocks agentic workflows — AI that doesn't just answer questions but takes actions:

  • Query your project's database mid-conversation without copy-pasting SQL results
  • Let AI monitor your deployment logs and alert on anomalies
  • Call your course project's REST API and interpret responses automatically
  • Read, write, and edit local files through Claude Desktop or Cursor
  • Chain multiple tools in sequence: search → filter → write to Notion — all in one prompt
  • Build agents that work across tools without writing any glue code
  • Claude Desktop can connect to multiple MCP servers simultaneously
  • MCP separates what to do (LLM decision) from how to do it (server execution)

MCP-Compatible Clients

Client Description
Claude Desktop Anthropic's native desktop app; the original MCP host
Cursor VS Code fork; supports MCP servers directly in the IDE
Gemini CLI Google's command-line AI interface
Windsurf AI IDE with MCP integration for multi-file agentic coding
VS Code + AI Toolkit Microsoft's AITK extension adds MCP support with a Visual Agent Builder
Docker Desktop MCP Toolkit Pre-packages popular MCP servers for easy installation
Any Haystack Agent Open-source framework with native MCP client support

Popular MCP Servers You Can Use Today

GitHub MCP
Read repos, create issues, open PRs from chat
PostgreSQL / SQLite MCP
Natural language → SQL queries on your database
Filesystem MCP
Read/write files on your local machine
Brave Search MCP
Web search with structured results
YouTube Transcript MCP
Extract and summarize any YouTube video
Obsidian / Notion MCP
Write notes directly into your knowledge base from chat
Docker MCP
Manage containers and images conversationally
Puppeteer MCP
Control a browser: navigate, click, scrape web pages
Slack / Discord MCP
Send messages, read channels, manage workspaces
ArXiv / Wikipedia MCP
Structured research paper and encyclopedia access
! Safety & Permissions

MCP was designed with explicit safety controls from the start:

  • Tool schemas define exactly what inputs a tool accepts — the LLM cannot call tools outside those schemas
  • Permission controls let you set read-only vs. read-write access per server
  • Confirmation prompts can require user approval before destructive actions
  • Sandboxing keeps server execution isolated from the host system
  • OAuth support for secure, token-based authentication with remote servers
⚠ Security Note

MCP is powerful but introduces new attack surfaces. Malicious MCP servers could exfiltrate data or execute unwanted actions. Only install MCP servers from trusted sources, and always review what permissions each server requests.

Building MCP Servers

Getting Started
  • A minimal Python MCP server can be under 20 lines of code using FastMCP
  • Use the MCP Inspector — built-in dev tool for debugging tool calls
  • Tools declare their input schema (JSON Schema format)
  • Resources should be idempotent (no side effects)
  • Servers can compose — one server can call another's tools
Key Concepts
  • Servers are language-agnostic — Python, TypeScript, Go, Java
  • Run servers in Docker for easy deployment and isolation
  • Mock servers during development to test without real APIs
  • Tools support required and optional parameters with type validation
  • Microsoft AI Toolkit includes a Visual Agent Builder
# Minimal Python MCP server using FastMCP (under 20 lines)

from fastmcp import FastMCP

mcp = FastMCP("My Server")

@mcp.tool()
def calculate_bmi(weight_kg: float, height_m: float) -> float:
    "Calculate Body Mass Index"
    return weight_kg / (height_m ** 2)

@mcp.tool()
def query_database(sql: str) -> list:
    "Execute a read-only SQL query"
    # Your DB logic here
    return []

MCP vs. Other Approaches

Approach Pros Cons
MCP Model-agnostic, open standard, growing ecosystem Relatively new (Nov 2024), ecosystem still maturing
Function Calling Native to OpenAI/Gemini, battle-tested Model-specific, not portable across providers
Custom Glue Code Full control, no dependencies Different implementation per model per tool
ChatGPT Plugins Early solution to the problem OpenAI-only, now deprecated
// Good to Know

MCP works alongside function calling — some clients translate MCP tool definitions into native function call formats automatically. LangChain tools and Haystack tools can be wrapped as MCP servers, giving legacy integrations MCP compatibility.

For Students & Engineers

Project Ideas
  • NotebookLM + Filesystem MCP = AI reads your actual lecture PDFs
  • GitHub MCP + Claude = code reviews where AI reads your full repo
  • YouTube Transcript + Obsidian MCP = paste link → auto-generate notes
  • Build a "personal research assistant" querying your Obsidian vault
  • MCP server for university course catalog = AI plans your semester
  • Minecraft mod server — let Claude read mod files and generate Fabric code
Easy Start
  • Docker Desktop MCP Toolkit = easiest way to get started
  • VS Code AI Toolkit supports local ONNX/CPU inference + MCP
  • Fully offline agentic AI development possible
  • CTF platform MCP = AI assists bug bounty recon with scoped access
  • Expose custom SQL views as MCP resources for scoped data access
  • Hundreds of community servers on GitHub and MCPMarket

Security & Best Practices

Do

  • Apply principle of least privilege — only permissions actually needed
  • Use OAuth or API keys for remote MCP servers
  • Log all tool calls for auditability
  • Require explicit user confirmation per destructive action
  • Run servers in Docker for isolation
  • Use schema validation server-side (never trust unvalidated inputs)
  • Treat MCP servers like microservices — clear boundaries, independently deployable

Don't

  • Install MCP servers from untrusted sources
  • Expose write-capable servers without confirmation prompts
  • Skip logging — know what your agent did and when
  • Ignore prompt injection via malicious webpages
  • Skip schema validation even though JSON is structured
  • Enable writes by default — use read-only mode first
  • Ignore MCP server permission requests without review
→ The Bigger Picture

MCP is the foundation of the agentic AI paradigm — AI that acts, not just answers. In 2026, MCP is being used in production CI/CD pipelines: AI agents that trigger builds, run tests, and open PRs autonomously. Google Cloud officially supports MCP as a standard for Gemini-powered agent integrations. The next evolution is multi-agent MCP — networks of AI agents, each with their own MCP servers, coordinating through shared tool interfaces.

50 Additional MCP Facts

Core Protocol
  • MCP was released as fully open-source by Anthropic in November 2024
  • Builds on JSON-RPC 2.0 as its message format
  • Google, Microsoft, and major IDE vendors adopted it within months
  • A server can expose multiple tools, resources, and prompts simultaneously
  • Language-agnostic — Python, TypeScript, Go, Java, or any language
  • FastMCP framework makes building servers as simple as @mcp.tool()
  • Separates what to do (LLM) from how to do it (server)
  • Supports streaming via SSE — tools send partial results in real-time
  • Sampling lets servers request LLM completions from client — agentic loops without server API keys
Ecosystem & Future
  • Protocol versioning — clients and servers negotiate compatible version on handshake
  • Hundreds of community servers available on GitHub and MCPMarket
  • Google Cloud officially supports MCP for Gemini agent integrations
  • Used in production CI/CD — AI agents trigger builds, run tests, open PRs
  • Multi-agent MCP is the next evolution — coordinated AI agent networks
  • Red Hat security blog documents attack surfaces: tool poisoning, data exfiltration
  • MCP servers like microservices — do one thing, clear boundaries
  • Local servers generally safer than remote — no network exposure
  • MCPMarket.com has a directory of community-built servers

Quick Reference: MCP Resources

Resource What It's For
Official Docs modelcontextprotocol.io — Full spec, SDKs, quickstart
MCP Market mcpmarket.com — Directory of community servers
FastMCP gofastmcp.com — Fastest way to build Python servers
Docker MCP Toolkit Docker Desktop — One-click server installation
MS AI Toolkit VS Code Extension — Visual agent builder with MCP
Red Hat Security Blog MCP security risks and controls documentation
Read Official MCP Docs →
Scroll to track progress
Scroll Progress
0%
of this page viewed