MCP

Knowledge-base overview

Model Context Protocol (MCP) is an open protocol for connecting AI applications to external capabilities and context in a consistent way. This knowledge base does not stop at “copy a server configuration.” It is designed to help a beginner:

Explain the host, client, server, and bidirectional capabilities.
Read the JSON-RPC lifecycle and capability negotiation.
Choose correct boundaries for tools/resources/prompts and roots/sampling/elicitation.
Compare stdio and Streamable HTTP.
Review authorization, security, debugging, and versions.
Validate key rules for messages, schemas, errors, and experimental Tasks with an offline project.
Validate Streamable HTTP, sessions, and OAuth resource boundaries with real loopback HTTP round trips.

The knowledge base has two layers:

Learning path: seven stable core lessons and runnable projects. Start here. One frontier-observation topic is also available, but is not a stable prerequisite.
Official-document reference layer: 18 local Chinese summaries that existed before this task. Each uses a compressed “key conclusion — main content — cautions — related pages” template; none is an upstream-body mirror or full translation. They remain frozen in principle and are consulted only as needed; confirmed problems receive only narrow corrections.

Source boundary: the learning path is original teaching material for this project. The 18 historical summaries are now marked page by page as curated / needs-review, accurately indicating “locally curated; current facts and provenance have not yet been restored.” Because they remain in the frozen reference tree, the publication gate continues to generate a stub for every one. Changing frontmatter alone does not release the body. A genuinely independent, verified rewrite must move into the learning-path layer; a local summary must not be mislabeled third-party / frozen-reference to bypass the gate.

MCP documentation cannot be uniformly labeled MIT

The former modelcontextprotocol/docs repository was archived under MIT. After the project moved into modelcontextprotocol/modelcontextprotocol, the license transition on 2026-01-05 set CC BY 4.0 for ordinary new documentation contributions while unrelicensed older contributions retained their original license. A page that evolved across the transition may contain contributions under different licenses. The current reference layer therefore uses page-specific: until page-level commit history, attribution, and modification notice have been checked, the public site continues to show only a source-link stub.

Reference-layer audit boundary, 2026-07-20

The most recent official-repository commit before the acquisition time was 76ceb47f, and all 18 source paths existed then. This workspace did not retain HTTP response hashes or a deployment revision, so it cannot claim that the captured body byte-for-byte matches that tree. Commit history supports treating “Protocol Versioning” and “Example Servers” as MIT-recovery candidates, and “Build with Agent Skills” and “Client Best Practices” as CC BY 4.0-recovery candidates; the other 14 pages cross the license transition and remain fail-closed. Candidates also need fixed sources, license notice, attribution/modification notice, and fact revalidation before publication; finding a license alone cannot automatically publish them.

Dynamic-fact boundary

This learning path was checked against first-party material obtained on 2026-07-21. The official version page still marked 2025-11-25 as latest; 2026-07-28 remained a release candidate under /specification/draft and is dated after this review, so it cannot be the current stable interoperability contract. Both projects implement only a teaching subset of 2025-11-25. They do not mix in the candidate’s no-initialize model, server/discover, or per-request capability shapes. A real implementation must check host, client, server, SDK, and extension support and follow actual negotiation.

Where this course fits in the overall roadmap

MCP is an on-demand interoperability branch in the “Single Agent and Tools” stage. Course-directory numbering expresses display order only. Enter this course when a project needs standardized cross-process, cross-product, or cross-organization exchange of tools, resources, prompts, or client features. Before starting, you should have:

API: HTTP, authentication, timeouts, and errors.
JSON: JSON and JSON Schema.
If the main goal is to expose or invoke tools, Tool Calling (including Function Calling) first, to understand how a model chooses a tool and how a host validates and dispatches it.
Before connecting to an untrusted resource or remote server, or turning protocol checks into regression cases, complete the overall roadmap’s early safety and evaluation milestone. It is not a prerequisite for the entire AI-safety and evaluation discipline.

MCP further standardizes tools, context, and client features as an integration boundary across implementations. It is not an Agent planning loop, nor is it a universal prerequisite for Agent Core. Study it before or after Agent Core according to interoperability needs. If you use only in-process functions, a direct SDK, or an existing private interface with no protocol-interoperability requirement, you can defer MCP.

Learning objectives

Distinguish host, client, server, data layer, and transport layer.
Use a direction matrix to explain server features and client features.
Correctly distinguish requests, responses, notifications, and bidirectional request IDs.
Explain initialization, protocol-version selection, capability/sub-capability, operation, and shutdown.
Write tool input/output schemas and distinguish protocol errors from tool-execution errors.
Understand control and security boundaries for roots, sampling, elicitation, and Tasks.
Compare stdio, Streamable HTTP, and older HTTP+SSE material.
Use Inspector and layered logs to locate failures and record four kinds of version fact.
Complete an offline data-driven validation project and explain why it is not an official conformance suite.
Run real loopback Streamable HTTP and distinguish transport, session, OAuth resource policy, and message schema.

Prerequisites

Read JSON objects, arrays, and a minimal JSON Schema.
Understand HTTP request/response, status codes, bearer tokens, and timeouts.
Run python -B script.py on Windows 11 / PowerShell 7.
Know the difference between stdout and stderr.
You do not need to know a particular MCP SDK first: learn the protocol, then choose an implementation.

Core mental model

Capability owner	Main capabilities	Typical request direction
server	tools, resources, prompts, logging, completions	client → server
client	roots, sampling, elicitation	server → client
both/utility	ping, progress, cancellation, experimental Tasks	Depends on the particular method and capability

A capability declares “the protocol function available in this session.” It does not mean that the user has consented, a resource is authorized, or server content is trustworthy.

Recommended sequence

Order	Lesson	Question it answers	Completion evidence
1	Architecture and Roles	Who connects to whom, and where are bidirectional capability and control located?	Can draw a multi-server host and trust boundaries
2	Primitives and Tool Contracts	When should I choose a tool/resource/prompt/root/sampling/elicitation?	Can choose features for the running scenario and write schemas
3	Lifecycle, Capability Negotiation, and Transports	In what order, direction, and transport do messages run?	Can write a handshake and locate failure by layer
4	Authorization and Security Boundaries	Once a capability is available, how do I prevent overreach and leakage?	Completes a threat model with prevention/detection/recovery
5	Inspector, Debugging, and Version Management	How do I troubleshoot and upgrade with actual evidence?	Completes a seven-layer issue report and four-version table
6	Project: Offline MCP Message Validation	How do I turn key protocol rules into regression checks?	All 54 cases and 108 tests pass
7	Project: Loopback Streamable HTTP and OAuth Resource Boundaries	How do I use real HTTP to validate headers/statuses, JSON/SSE, session, PRM shape, and authorization failure?	CLI `PASS`/`BLOCK` and all 80 tests pass in four modes
8 (optional)	Frontier Topic: Extensions, Apps, and Version Compatibility	How do I separate stable core, extensions, experiments, and Drafts, and fall back safely?	Version ledger + compatibility matrix + negative interoperability tests

Allow 11–16 hours for the stable core: 60–90 minutes for each of the first five lessons and 2–4 hours for each project. Study the frontier topic only for extensions or migration exploration. Do not read all 18 reference-layer pages in order at the start; consult them when you have a specific question.

Hands-on entry points

Main project: Offline MCP teaching validator

From the repository root:

Set-Location ".\docs-EN\mcp" # Enter the MCP teaching-project directory so that subsequent relative paths resolve correctly.
python -B .\examples\validate_mcp_messages.py # Run 54 offline JSON-RPC cases; -B does not create __pycache__.
python -B .\examples\test_validate_mcp_messages.py # Run all regression tests in normal interpreter mode.
python -B -O .\examples\test_validate_mcp_messages.py # Verify that critical protocol gates do not rely on bare assert removable by -O.
python -B -W error .\examples\test_validate_mcp_messages.py # Promote every warning to failure to expose compatibility problems early.
python -B -O -W error .\examples\test_validate_mcp_messages.py # Cover optimized and strict-warning modes together.

Current acceptance baseline:

Strict JSON fixture: 54 cases.
16 positive passes and 38 expected negative rejections.
108 unit/data-driven tests.
Normal and -O modes, plus warnings-as-errors, all pass.
No network, secret, third-party dependency, or cache requirement.

Advanced project: Loopback Streamable HTTP and OAuth resource boundaries

Complete the offline message state machine first, then run the independent real HTTP boundary:

python -B .\examples\streamable_http\loopback_mcp_http.py demo # Run real loopback HTTP through the normal handshake, JSON/SSE, and session path.
python -B .\examples\streamable_http\loopback_mcp_http.py attack # Run attack paths; BLOCK means attacks were successfully rejected.
python -B .\examples\streamable_http\test_loopback_mcp_http.py # Run 80 HTTP-boundary regression tests in normal mode.
python -B -O .\examples\streamable_http\test_loopback_mcp_http.py # Verify that production gates do not rely on bare assert in optimized mode.
python -B -W error .\examples\streamable_http\test_loopback_mcp_http.py # Promote resource, thread, and HTTP warnings to failures.
python -B -O -W error .\examples\streamable_http\test_loopback_mcp_http.py # Combine the strictest interpreter and warning checks.

Current acceptance baseline: real loopback POST/GET/DELETE and JSON/SSE round trips; CLI outputs PASS/BLOCK; 80 tests cover initialize alternative versions, Origin, headers/statuses, Unicode identity/session, PRM document/challenge shape, RFC 8707 resource, scope/tenant/revision, concurrency, JSON-depth budgets, explicit recovery, no cursorless replay, expiry, and revocation. See the project lesson.

Authorization capability boundary

The project’s HTTP is real; its token policy is an offline fixture. It has no authorization server, PKCE, signature/JWKS, introspection, or TLS and must not be described as “OAuth implemented.” Its http://127.0.0.1 resource validates only PRM shape and does not meet RFC 9728’s HTTPS requirement.

Third project: minimal real-SDK interoperability

After both teaching projects, choose one official SDK:

Follow Build an MCP Server to make a read-only, offline minimal server.
Use MCP Inspector to validate initialize and tool/resource behavior.
Follow Build an MCP Client to make a minimal client.
Record the protocol specification, negotiated version, SDK, and client/server versions.
Add one negative schema test, one missing-capability test, and one security test.

Dynamic SDK commands, package names, and arguments must come from official documentation at development time; do not guess them from this learning path.

Mastery checklist

Relationships to other knowledge bases

Tool Calling (including Function Calling): how a model/host chooses, approves, and executes tools; MCP describes how capabilities are discovered and exchanged across processes/services.
Agent Skills: packages procedural knowledge about “how to complete a task”; MCP provides “which external capabilities and context can be accessed.” They can be combined and do not replace one another.
Agent Core: planning, state, memory, and execution loops; MCP is only one integration boundary.
A2A: discovery, messages, Tasks, and Artifacts between independent Agent applications; MCP connects an Agent/Host with tools, resources, and context capabilities. They can be combined but are not interchangeable.
API: HTTP, OAuth, retry, idempotency, and error handling are the underlying foundation of remote MCP.
AI Safety: expands on prompt injection, permissions, supply chain, and runtime governance.
Runtime Monitoring: brings request IDs, capability decisions, duration, and outcomes into observability.

Primary references

The following are first-party MCP or original protocol sources, retrieved or checked on 2026-07-21.

Topic	Source
Architecture	MCP Architecture
Current specification	MCP 2025-11-25 Specification
Lifecycle/capabilities	Lifecycle
Transports	Transports
Authorization	Authorization, RFC 8707, RFC 9728
Schema	Schema Reference
Tools	Server Tools
Roots	Client Roots
Sampling	Client Sampling
Elicitation	Client Elicitation
Tasks	Tasks utility
Extensions, Apps, and Tasks migration	Extensions Overview, MCP Apps, Tasks extension
Security	Security Best Practices
Debugging	MCP Inspector, Debugging
JSON-RPC	JSON-RPC 2.0 Specification

Official-document reference layer

The following 18 pages are all local Chinese summaries that existed before this task, not upstream-body mirrors. Between 2026-07-19 and 2026-07-20, narrow corrections were made to Roots, logging, the secret boundary of elicitation, optional sessions, vendor-specific Custom Connectors, the scope of Agent Skills, session-hijacking risk classification, and a removed Example Clients source. Every page remains needs-review and fails closed on the public site. Folder-qualified wikilinks remove ambiguity among same-named files. They can reflect only the state of material when it was curated; current protocol and product facts must be verified against the stable specification, target SDK/host, and actual capability negotiation.

AI Agent Engineer

Account and learning progress

Mark this course

MCP

MCP

Knowledge-base overview

Where this course fits in the overall roadmap

Learning objectives

Prerequisites

Core mental model

Recommended sequence

Hands-on entry points

Main project: Offline MCP teaching validator

Advanced project: Loopback Streamable HTTP and OAuth resource boundaries

Third project: minimal real-SDK interoperability

Mastery checklist

Relationships to other knowledge bases

Primary references

Official-document reference layer

01 — Introduction

02 — Understanding MCP

03 — Developing with MCP

04 — Clients

05 — Security

06 — Developer tools

07 — Examples

Table of Contents

Backlinks