MCP in Depth: Build, Secure and Run Servers and Clients

What's inside

1. Level 1: What MCP Is and What This Course IsFree
   Establishes that this course is independent of Anthropic and explains the problem MCP solves: one open protocol replacing a custom integration for every pairing of assistant and tool.
2. Level 2: Hosts, Clients and ServersFree
   Maps the three roles in every MCP deployment and who trusts whom, so every later design decision has a place to land.
3. Level 3: Where MCP Runs Today
   Surveys the real places servers get plugged in — connectors in the Claude apps, Claude Code, the Messages API's beta MCP connector, and other vendors' tools — and how to verify what each currently supports.
4. Level 4: Specification Revisions and How to Read Them
   Explains MCP's date-stamped revisions, names 2026-07-28 as the current one, and shows how 2025-era and 2026-era behaviour coexist in the field.
5. Level 5: Your First Server with the Python SDK
   Builds and runs a minimal server with the official Python SDK's MCPServer class, exposing one tool from a type-hinted function.
6. Level 6: Testing with the MCP Inspector
   Uses the inspector as a manual test client to list, call and debug the first server before any model is involved.
7. Level 7: Tool Anatomy: Name, Schema and Result
   Dissects what a tool actually is on the wire — the definition a client lists and the result a call returns — and how Python code maps to each field.
8. Level 8: Input Schemas That Constrain the Model
   Designs input schemas that make wrong calls hard to express, using enums, bounds, defaults and required fields rather than prose instructions.
9. Level 9: Names and Descriptions a Model Chooses Well
   Treats tool names and descriptions as the prompt the model reads when deciding what to call, and writes them for selection accuracy.
10. Level 10: Structured Results and Output Schemas
    Returns machine-readable results through structuredContent with a declared outputSchema, alongside text the model can read.
11. Level 11: Structured Errors the Model Can Recover From
    Separates tool execution failures, reported inside the result with isError, from protocol errors, and writes error payloads that tell the model what to do next.
12. Level 12: Few Well-Made Tools Versus Many
    Weighs the cost of a large tool surface — context consumed, worse selection, more attack surface — against a small set of task-shaped tools.
13. Level 13: Resources: Data the Application Reads
    Exposes read-only context as URI-addressed resources and explains how that differs from a tool the model calls.
14. Level 14: Resource Templates and Completion
    Parameterises resources with URI templates so one definition serves a whole family of items, with argument completion to help users fill them in.
15. Level 15: Prompts: User-Invoked Templates
    Publishes reusable, parameterised prompt templates that a user triggers deliberately, for example as slash commands in a host.
16. Level 16: Building a Python Client
    Writes a client that launches a server, lists what it offers and calls a tool, then connects those tools to a model's tool-use loop in a vendor-neutral way.
17. Level 17: JSON-RPC: Requests, Responses, Notifications
    Drops to the wire to read the three JSON-RPC 2.0 message kinds that every MCP exchange is made of.
18. Level 18: Protocol Errors, Codes and the _meta Field
    Covers the JSON-RPC error object, MCP's error-code allocation, and the _meta envelope that carries protocol metadata alongside every payload.
19. Level 19: The Classic Handshake and Capability Negotiation
    Walks through the initialize, response and initialized exchange used through revision 2025-11-25, which most deployed clients and servers still speak.
20. Level 20: Stateless Requests and server/discover
    Shows how 2026-07-28 removes the handshake: every request carries its protocol version and client capabilities in _meta, and server/discover advertises what a server supports.
21. Level 21: Stateless Requests and server/discover
    How the 2026-07-28 revision drops the initialize handshake so that every request carries its own protocol version, client identity and capabilities in _meta, with server/discover as the up-front way to learn what a server supports.
22. Level 22: Multi Round-Trip Requests: The Server Asks Back
    How a server that needs something from the client now returns an input_required result instead of sending its own request, and how the client retries the original call with the answers.
23. Level 23: Elicitation: Asking the User Mid-Call
    How a tool asks the person at the keyboard for structured input (form mode) or sends them to a web page (URL mode), delivered through the multi round-trip pattern.
24. Level 24: Subscriptions and Cache Hints
    How clients learn that something changed, through one opt-in subscriptions/listen stream, and how ttlMs and cacheScope on list and read results cut down polling.
25. Level 25: Progress, Cancellation and the Tasks Extension
    How to report progress on a slow call, how a client abandons one, and when to hand back a task handle through the io.modelcontextprotocol/tasks extension instead of holding the request open.
26. Level 26: Sampling and Logging in the Deprecation Window
    How sampling and protocol logging work today, why 2026-07-28 marks both Deprecated, and what to build instead.
27. Level 27: Roots, and Why the Server Must Enforce Them
    What roots tell a server about the directories it may work in, why they are advisory unless the server checks every path, and what replaces them now that the feature is Deprecated.
28. Level 28: stdio: A Server as a Subprocess
    How the stdio transport frames messages as newline-delimited JSON over a client-launched process, and the operational rules that keep it from corrupting itself.
29. Level 29: Streamable HTTP: One Endpoint, One POST per Message
    How a remote server exposes a single MCP endpoint where every request is its own HTTP POST, and the baseline protections every HTTP server needs.
30. Level 30: JSON Responses versus SSE Streaming
    How a server chooses per request between a single JSON body and a request-scoped event stream, and what each choice costs.
31. Level 31: 2025-Era Sessions and What They Cost
    How the 2025-03-26 to 2025-11-25 revisions tied a client to a server with Mcp-Session-Id, a standalone GET stream and Last-Event-ID replay, and why that was hard to run at scale.
32. Level 32: Stateless Mode and Server-Minted Handles
    How to run a server so that any instance can answer any request, and what to do with the state a session used to hold.
33. Level 33: Routing Headers: Mcp-Method, Mcp-Name, x-mcp-header
    How 2026-07-28 mirrors body fields into HTTP headers so that gateways can route and rate-limit without parsing JSON, and why the server must check that the two agree.
34. Level 34: Serving Old and New Clients from One Server
    How a dual-era server and a dual-era client detect which protocol generation the other side speaks, and fall back without guessing.
35. Level 35: Authorisation Model and Discovery
    How a remote MCP server acts as an OAuth 2.1 resource server and how a client that starts with nothing but a URL finds the right authorisation server.
36. Level 36: Client Registration: CIMD Replaces DCR
    How a client obtains a client ID without prior arrangement by using an HTTPS URL that hosts its metadata, and why 2026-07-28 deprecates Dynamic Client Registration in its favour.
37. Level 37: The Token Flow: PKCE, Resource and Audience
    How to run the authorisation code flow end to end so that the token is bound to one MCP server, and how the server verifies that binding on every request.
38. Level 38: Scopes, Step-Up and Refresh Tokens
    How to design scopes so that clients start with the minimum and ask for more only when an operation needs it.
39. Level 39: Prompt Injection Through Tool Results
    Why anything a tool returns (a web page, an issue comment, a file) can carry instructions the model may follow, and how to limit the damage.
40. Level 40: Tool Poisoning and Changing Definitions
    How a malicious or compromised server attacks through the tool descriptions and schemas the model reads, and how clients and operators defend the tool list itself.
41. Level 41: Secrets: Storing, Scoping and Never Leaking Them
    Closes the security phase by handling the credentials an MCP server holds (upstream API keys, OAuth tokens, client credentials) so they stay out of tool results, logs, config files and the model's context.
42. Level 42: Local Extension Bundles: Packaging with MCPB
    Packages a stdio server as an MCP Bundle (.mcpb), a zip archive with a manifest.json that a desktop host installs in one click, and weighs it against shipping a remote server.
43. Level 43: Remote Distribution and the MCP Registry
    Makes a remote Streamable HTTP server discoverable by describing it in a server.json and publishing it to the official MCP Registry under a namespace you can prove you own.
44. Level 44: Interactive MCP Apps: UI Delivered by a Server
    Adds an interactive interface to a tool with the MCP Apps extension, where the server declares an HTML resource under the ui:// scheme and the host renders it in a sandboxed iframe.
45. Level 45: Observability with OpenTelemetry
    Instruments a server and client with OpenTelemetry so one trace follows a request from the host through the MCP call to the upstream API, replacing the deprecated protocol logging feature.
46. Level 46: Versioning Servers, Tools and Protocol Revisions
    Manages change over time across three separate version lines (the protocol revision, your server release and each tool's contract) without breaking the clients and models that depend on them.
47. Level 47: Using Your Server from Claude Code and Agents
    Wires a finished server into Claude Code and into programmatic agents, and tunes it for how those hosts actually load tools, limit output and apply permissions.
48. Level 48: Final Challenge: Design, Secure and Ship a Server Exam
    A whole-course review in which the learner takes one realistic server from design to production and defends every decision on tools, protocol, transport, authorisation, security and operations.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →