MCP for Engineers

Every MCP request carries its own protocol version and client capabilities, so a server never depends on an initialization handshake or on which connection delivered the message. You map the host, client, and server roles, follow client-originated JSON-RPC requests to their correlated responses, and use server/discover plus UnsupportedProtocolVersion retries instead of connection state to negotiate what both sides support.

The three server primitives differ by who controls them: the model calls tools, the application selects resources, and the user invokes prompts. You define JSON Schema 2020-12 contracts for tools, RFC 6570 URI templates and annotations for resources, and validated arguments for prompts, then choose between them from the interaction owner and data flow rather than from habit.

Discovery, list, and read results are cacheable with time-to-live hints, and subscriptions/listen delivers change notifications as invalidation signals rather than replayed data. When a tool needs more input, InputRequiredResult and opaque requestState let the client retry with inputResponses under a new JSON-RPC identifier, with principal binding, expiry, and replay limits protecting the state in flight.

Local servers speak newline-delimited JSON-RPC over stdin and stdout with logging kept on stderr; remote servers accept a separate POST per message and stream responses over request-scoped SSE with metadata mirrored into HTTP headers. You handle process restart, Origin validation, proxy buffering, progress tokens, and the two transport-specific forms of cancellation, including the race where a request completes while being cancelled.

A remote server discovers its authorization server from a 401 challenge, binds access tokens to a canonical resource URI, and validates authenticity, issuer, expiry, and audience on every protected request. Around that you threat-model confused-deputy attacks, token passthrough, SSRF through metadata and schema fetches, and prompt injection through tool results, then write deterministic abuse tests at each trust boundary.