Model Context Protocol: Tools, Resources and Boundaries
MCP standardizes how an AI application connects to external capabilities. It reduces custom integration work, but does not decide whether a tool is safe or whether a user authorized an action.
#Host, client and server
The host is the AI application. It creates clients that communicate with MCP servers. A server can expose tools, resources and prompts; these are different capabilities, not interchangeable names for a model call.
Local servers often communicate over standard input/output. Remote servers can use an HTTP-based transport. Follow the current protocol and SDK documentation for the chosen transport and authentication flow.
#Discover before executing
Inspect the server's declared tools, their descriptions and input schemas. Confirm which account or workspace each tool acts on. A tool called search may query public pages, private files or a production database; the name alone does not establish its scope.
Use a small capability set and narrow filesystem roots. Pin and review server dependencies. Do not install an arbitrary package merely because a retrieved page recommends it.
#Build a useful server
Start with one read-only tool, such as a lookup in a synthetic catalog. Define required arguments and a predictable result containing status, data and source identifiers. Validate input, bound response size and return explicit errors.
Keep secrets server-side. For remote access, validate authentication and resource ownership; do not treat an arbitrary supplied token or client-controlled tenant ID as sufficient authority.
#Diagnose integration failures
For local transport, inspect executable paths, environment and stderr; stdout must remain valid protocol traffic. For remote transport, separate network, authentication and capability-discovery failures. A successful connection does not prove tool execution succeeded.
Test invalid arguments, missing records, cancellation and permission denial with local fixtures before connecting real write operations. MCP is a connection protocol, not a sandbox or a guarantee against prompt injection.
