Understanding MCP
The Model Context Protocol structures how an AI application accesses external tools and resources. It defines interfaces but does not guarantee a server is trustworthy or an action is authorized.
Hosts, clients and servers
A host application controls connected servers and which actions are allowed. Servers expose capabilities such as tools and resources. A tool description explains how to call it; it does not independently grant access rights.
Inspect before invoking
Capability discovery must be followed by input-schema validation and evaluation of side effects. A tool call can read, write or transmit data depending on its design; permissions must reflect this.
Version evolution
The protocol evolves: its July 28, 2026 specification included core and authorization changes. An integration should document the version it implements and test client/server compatibility.
Connection security
A server can be misconfigured or compromised. Restricting allowed origins, minimizing secret access, validating inputs and logging sensitive actions remain host responsibilities.
Tool lifecycle and authorization
When an MCP client connects to a server, relevant versions and capabilities must be established according to the applicable specification. The client can then discover tools, resources or prompts and issue structured calls. Schemas help validate inputs but do not make a function safe. HTTP access requires careful token validation and correct audience handling.
Exercise: document a retrieval interface
Create a document search tool descriptor with a question parameter and a response listing document identifiers. Test missing parameters, empty corpora and unauthorized access. Record permission decisions and measure result stability between server versions. Do not portray a local prototype as universal interoperability.
Core steps
- 01Discover a server
- 02Inspect capabilities
- 03Authorize and invoke
- 04Audit effects
Three questions to ask
Are specification and SDK versions documented?
Are tool parameters and outputs treated as untrusted?
Are sensitive accesses subject to approval?
Read the source documents
Versions, reuse terms and document status can change. Check them on the original sites.