Discover a capability without granting it authority
How to study this lesson
Read one section, trace the worked example, and try the knowledge check. Bookmark saves a shortcut; notes appear in My notebook. Mark lesson complete is your own assessment and does not mark its lab passed.
By the end, you can
- Distinguish the host, client, and server roles.
- Trace version selection, tool discovery, and invocation.
- Explain why a discovered description is untrusted integration data.
Name the participants before designing the adapter
MCP connects an application to external context and operations through a common protocol. The host is the user-facing application and its orchestration environment. A client is the connector inside that host. A server offers protocol features. A single host can use several clients and servers, so an integration design should name the connection and the responsible component whenever it refers to a tool.
Imagine a support workbench connected to a ticket server and a warehouse server. Both expose a tool named search. The host needs an internal identity such as (configured_server_id, tool_name) so a ticket search never becomes an inventory search by accident. A friendly server name is display metadata, not a globally unique or cryptographically authenticated identity. Configuration and transport trust establish the actual endpoint relationship.
Pin the protocol era explicitly
This module targets the official 2026-07-28 revision, checked on 2026-09-07. Its base interaction is stateless: requests carry protocol version and client capabilities in metadata. The revision removes the older initialize and notifications/initialized handshake and introduces server/discover for server information and supported versions. Earlier tutorials may accurately describe earlier revisions while being incompatible with this one.
Keep a compatibility matrix in a real project: client SDK version, implemented protocol revisions, server revision, and selected transport. Do not equate the newest installed package with support for every current specification feature. The snippets here are standard-library simulations of selected boundaries. They deliberately avoid presenting an unverified SDK import or an incomplete miniature server as a deployable MCP implementation.
A trace from catalog to one call
A host first establishes which configured endpoint it intends to use and which protocol versions its client supports. It can discover server information, select a compatible revision, and request the tool catalog through tools/list. The catalog describes callable names and schemas. Invocation uses tools/call with a selected name and arguments. Discovery and calling are separate operations, so a catalog can become stale between them.
In the warehouse example, the host sees stock_lookup requiring a SKU string. It presents that bounded operation to the model, checks the proposed arguments, applies its policy, and invokes the server. The server repeats validation and authorization before consulting stock. The returned result becomes an observation, not a new instruction. This trace is useful even when a mature SDK handles every wire detail.
Capabilities describe support, not permission
Capability information tells peers which protocol features they support. It does not establish user consent, tenant membership, or permission to execute a particular business operation. Similarly, a tool description can help a model choose a tool while remaining untrusted text from another component. A malicious description that asks the host to disclose unrelated conversation data does not become a host policy.
Design a local registry that stores configured endpoint identity, schema version, required application scopes, and exposure policy separately from the tool's own description. For example, the ticket server may describe a bulk-delete feature, while the workbench's policy exposes only ticket lookup. Keep these decisions auditable. The absence of a tool from model context can reduce accidental selection, but server-side authorization is still the enforcement boundary.
Catalog management is part of correctness
Tool lists can be paginated and can vary with the authorization presented on a request. Cache them under a key that includes the relevant authorization context. Respect freshness information and invalidate stale schemas when calls fail because the contract changed. If catalog pages are merged, preserve server identity and handle name collisions deterministically. Deduplicating solely by a friendly tool name loses essential information.
The code constructs a request with pinned metadata and prints only the method, tool name, and selected revision. It has no network connection and supplies no authorization. Use it to inspect the host's responsibilities before adding a real client library. A production milestone should then verify discovery, schema handling, denial behavior, and one read-only invocation against a server whose supported revision is explicitly documented.
Work through the code
This serializes one modern MCP-shaped request in memory. Metadata lives under params._meta. It is not a transport client and does not discover a server, authenticate, implement every schema rule, or verify a response.
import json
VERSION = "2026-07-28"
metadata = {
"io.modelcontextprotocol/protocolVersion": VERSION,
"io.modelcontextprotocol/clientInfo": {"name": "course-simulator", "version": "0.1"},
"io.modelcontextprotocol/clientCapabilities": {},
}
request = {
"jsonrpc": "2.0",
"id": "attempt-1",
"method": "tools/call",
"params": {
"name": "stock_lookup",
"arguments": {"sku": "A"},
"_meta": metadata,
},
}
restored = json.loads(json.dumps(request))
print(restored["method"], restored["params"]["name"])
print(restored["params"]["_meta"]["io.modelcontextprotocol/protocolVersion"])
tools/call stock_lookup 2026-07-28
Run Python snippets locally with the prerequisites named above. The module coding lab runs directly in your browser.
Pause and reason
Two configured servers expose a tool called search, and one changes its schema after a cache refresh. Define an identity and cache key that avoid selecting the wrong contract.
Check your understanding
A server advertises support for tools and lists a delete operation. What does this prove?
Your notes
Explain the mechanism in your own words. Add a failure you want to test.