Agentic AI Wiki
Deep-Dives / MCP

MCP

Building, testing, securing, and operating Model Context Protocol servers — the practical layer above mcp-architecture's conceptual introduction.

  1. Building MCP Servers in Practice
    Idiomatic server construction beyond hello-world — FastMCP decorators, TypeScript Standard Schema, when to expose a capability as a tool vs a resource vs a prompt, and what to actually put in the median five-tool server.
  2. Designing MCP Tools
    MCP tools are prompts as much as APIs — description phrasing changes selection, granularity changes token cost, and the search-then-fetch pattern beats "give the model the whole document" every time.
  3. Testing MCP Servers
    In-memory client/server binding beats subprocess plumbing; contract tests beat vibe-testing through an agent loop; the MCP Inspector is a debugger, not a test.
  4. Streamable HTTP: the current MCP transport
    The single-endpoint replacement for the deprecated HTTP+SSE transport — MCP-Session-Id, Last-Event-ID resumability, and why "remote MCP server" is really "distributed system".
  5. MCP Auth: the OAuth 2.1 Profile
    PKCE mandatory, RFC 8707 resource indicators, Protected Resource Metadata for AS discovery, Client ID Metadata Documents beating Dynamic Client Registration — the MCP-shaped subset of OAuth, and why 39% of production servers ship with none of it.
  6. MCP Security Anti-Patterns
    The six patterns the 2025-11-25 spec forbids by name — confused deputy, token passthrough, session hijacking, SSRF via discovery, javascript-URL injection, startup-command execution — with the trace signature and mechanical fix for each.
  7. Sampling & Elicitation: Server-Initiated MCP
    Two under-covered server-initiated features from the 2025-11-25 spec — sampling with tools lets the server borrow the host's model without holding an API key, URL-mode elicitation captures third-party credentials without token passthrough.
  8. Tool Poisoning: Prompt Injection via Tool Descriptions
    Tool descriptions are prompts your model reads — when they come from a downstream data source that also takes untrusted input, they become an indirect prompt injection surface (CVE-2025-54136, MCPTox).
  9. MCP Ops in Production
    Per-tool kill switches, argument-shape (not value) audit logs, tenant isolation from verified token claims (not request bodies), and rate-limits sized for agent traffic.
  10. MCP Registry & Distribution
    The MCP Registry, package types (npm/PyPI/OCI), versioning conventions, and where the 2026 roadmap on .well-known capability discovery goes.