GuideBeginner
Mcp Deep Dive
Learn the Model Context Protocol (MCP) in its current revision, `2026-07-28`, by building by hand the MCP server and client of Reservo, a coworking space, with Python 3.14 and the standard library. This guide continues the Agent Fundamentals and Tool Calling Guide: there you built the Reservo tools (`list_rooms`, `get_quote`, `book_room`, `cancel_booking`); here you expose them through MCP, the open protocol Anthropic published in November 2024 so that M applications and N tools do not need M×N integrations, only M+N. You implement the wire protocol as it is today: JSON-RPC 2.0 over stdio, **stateless** (no handshake and no session: every request carries its version and capabilities in `_meta`), `server/discover` to ask before acting, `resultType` on every result and caching with `ttlMs`. You build the server's three primitives (tools with `outputSchema` and `structuredContent`, resources with templates, prompts with embedded resources), **elicitation** with the Multi Round-Trip Requests pattern and an HMAC-sealed `requestState`, a complete client that talks to several servers, and the same server over **Streamable HTTP** protected with **OAuth 2.1** (resource metadata, audience, scopes and step-up). You finish by registering it in Claude Code and checking that the Python SDK's **official client** (`mcp` 2.3.0) talks to your hand-written server, and that your client talks to the SDK's server (`MCPServer`). Everything shown in the guide actually ran; a model's decision about which tool to use is treated as a concept.
- 64
- lessons
- 8
- modules
- English · Spanish
- available in
- Yes
- certificate
- Free
- access
Outcomes
What you'll be able to do
- Explain why MCP exists (the M×N problem that becomes M+N) and its host, client and server architecture: one client per server, and a connection that is not a session
- Implement the `2026-07-28` wire protocol by hand: JSON-RPC 2.0 over stdio, the per-request `_meta`, `server/discover`, `resultType` and the modern error codes (`-32602`, `-32021`, `-32022`)
- Build a tools server with `inputSchema`, `outputSchema` and `structuredContent`, telling protocol errors from execution errors (`isError`) and using explicit handles instead of a session
- Expose resources (with RFC 6570 templates and `ttlMs`/`cacheScope` caching hints) and prompts with embedded resources, knowing who controls each primitive
- Ask for the person's confirmation with form-mode elicitation and the Multi Round-Trip Requests pattern, protecting the `requestState` with integrity and single use; know when to use URL mode and what was deprecated (roots, sampling, logging)
- Build a complete MCP client: a badge on every request, discovery, pagination, caching, the retry loop and several servers with no name collisions
- Serve the same server over Streamable HTTP with its required headers and protect it as an OAuth 2.1 resource server: Protected Resource Metadata, PKCE, audience validation, `403 insufficient_scope` and the ban on token passthrough
- Recognize the trust boundary of a third-party server (tool poisoning, SSRF, compromised local servers, DNS rebinding) and check a remote server's rules with a test
- Register the server in Claude Code over stdio and HTTP with `.mcp.json`, and rewrite it with the official SDK (`MCPServer`) understanding what each line replaces
- Ship a complete project and verify its conformance with the SDK's official client over both transports
Before you start
What you need to bring
It's for you if...
- Developers who already built an agent with tool calling and want to expose its tools in a standard, reusable way
- Developers who will build or connect MCP servers for Claude Code or another compatible host, local or remote
- Backend developers who want to understand the real wire protocol, not only an SDK, to debug and design with judgment
- Anyone evaluating MCP for their team who needs to understand its architecture, its security model and how it changed in revision `2026-07-28`
Requirements and materials
- Agent Fundamentals and Tool Calling Guide completed (or equivalent: what a tool is, its JSON Schema contract, the `tool_use`/`tool_result` protocol)
- Basic Python: functions, dictionaries, classes, exception handling
- Python 3.14 with its standard library; no API key required. The optional lessons with the official SDK use `uv` and an internet connection
Content
The syllabus, module by module
Open any of them to see its lessons.
- Module 7: Remote Servers: Authorization and Security
- Streamable HTTP: one POST per message
- Serving Reservo over HTTP
- Why a remote server needs authorization
- The OAuth flow step by step
- Validating tokens and the confused deputy
- The trust boundary of third-party servers
- Mini-project: a Protected Reservo HTTP Server
Where it fits
This guide is part of something bigger
It's studied inside these programs, with support and dates.
Common questions
What people usually ask
No limit. It's a free guide: come in whenever you like, as often as you like.
No. Modules run from easier to harder, but you can jump to the one you need. Progress is saved per lesson.
Whatever is needed is listed under “What you need to bring”, above. If nothing is listed there, you can start from zero.
In the WhatsApp group, and every two weeks there's a live with an instructor where questions get worked through.
Yes. It's issued automatically once you finish every lesson, with a verifiable code you can share on LinkedIn.
No. This guide is self-paced with no dates. The bootcamp is live, by cohort, with work someone reviews.
Start whenever you like
What students say
These reviews are from enrolled students who completed at least 50% of the course. We moderate reviews only on content grounds (spam, offensive language, personal data), never for being critical or negative.
No approved reviews yet.
Be the first to share your experience!