MCP Interview Questions

Summary

MCP is an open protocol that standardises how AI applications connect to external tools and data. A system is wrapped once in an MCP server; any MCP-capable application (a host with an MCP client) can discover and use its tools, resources and prompts. It turns N apps × M custom integrations into N clients plus M servers.

Longer Answer

Before MCP, every AI app re-implemented integrations to the same systems (ticket trackers, wikis, databases), each with its own auth, pagination and error handling. MCP defines the messages (JSON-RPC 2.0), the lifecycle (initialisation and capability negotiation) and the primitives, so integrations become reusable components. The model side does not change: the host still passes tool definitions (name, description, JSON Schema) to the model; MCP standardises where those tools come from and how they are called.

Key Points

• Open protocol between AI apps and tools/data.
• Servers expose capabilities; hosts discover them at runtime.
• JSON-RPC 2.0 messages.
• N×M integrations become N+M.

Deep dive: AI Agents and MCP in Production

Summary

Design tools around the tasks agents perform rather than mirroring a REST API: filter and aggregate on the server, return small and relevant fields, paginate with cursors, give precise names, descriptions and schemas, return actionable errors, and annotate read-only and destructive tools.

Longer Answer

A thin list_customers() that returns 12,000 rows overflows the model's context; find_customers(city, has_overdue_invoices, limit, cursor) returns a page of three fields. Each response costs context tokens on every subsequent model call, so compactness matters more than for programmatic clients. Descriptions should say when to use and not use a tool. Annotations such as read_only_hint and destructive_hint let hosts auto-approve safe calls and ask before risky ones.

Key Points

• Task-shaped tools, not CRUD mirrors.
• Small outputs, pagination, server-side filtering.
• Clear schemas and actionable errors.
• Annotate read-only and destructive tools.

Deep dive: Designing MCP Servers Agents Use Well

Summary

Tool poisoning is hiding instructions in an MCP tool's name or description (which the host puts in the model's context) so that the model takes harmful actions, such as reading secrets and sending them through another connected tool. Defences: connect only reviewed, version-pinned servers, detect changes to tool definitions, give servers least privilege, and require human approval for consequential actions.

Longer Answer

A related risk is the "rug pull": a server changes its tool descriptions after you approved it. Pinning a hash of each tool definition and re-reviewing on change catches this. Combining untrusted content, access to private data and a way to send data out in one session is the dangerous mix; removing any one of the three reduces impact. Pattern scanning of descriptions helps only against crude attacks.

Key Points

• Descriptions are instructions to the model.
• Allowlist and pin servers; detect definition changes.
• Least privilege per server.
• Approval for consequential actions.

Deep dive: MCP Security

Summary

Tools are actions the model can invoke (model-controlled), resources are data the application can read and add to context (application-controlled), and prompts are reusable templates that users or apps select (user-controlled).

Longer Answer

A search_tickets function is a tool; a ticket's contents at tickets://123 or a schema file is a resource; a "summarise this incident" template with arguments is a prompt. The split matters for control: tools need safety decisions because the model chooses to call them, while resources and prompts are chosen by the app or the user. Clients also offer capabilities to servers, such as sampling (letting a server request a model completion through the host) and elicitation (asking the user for input).

Key Points

• Tools: model-controlled actions.
• Resources: application-controlled data.
• Prompts: user-controlled templates.
• Clients can offer sampling and elicitation.