Engineering course

MCP Course

The Model Context Protocol end to end: building tool servers, handling transport and auth, and connecting agents to real data without opening a security hole.

Connect models to real systems, safely

The Model Context Protocol end to end: building tool servers, handling transport and auth, and connecting agents to real data without opening a security hole.

  • Server and client, both sides
  • Transport and auth covered
  • Prompt-injection defences
  • Write actions need approval
Apply for this track See the full program
Modules
8
Format
Online
Mentorship
Weekly 1:1
Project
Production

Why this track

What you get that a general AI course does not cover.

Both sides of the protocol

Most learning material only covers the client. You will build tool servers too, so you understand the contract from the perspective of whoever has to maintain it.

Security is a main module

MCP servers hold credentials and reach internal systems. Tool poisoning, confused-deputy problems and prompt injection through tool output are treated as engineering work with real mitigations.

Transport and auth in practice

stdio for local development, HTTP transports for deployed servers, and how authentication and scoping actually work when more than one person uses a server.

Side effects handled deliberately

Reading a document and deleting a record should not share the same permission model. You will design read, write and destructive tools with different approval flows.

Curriculum

Eight modules, each ending in something you can show.

  1. M01

    The protocol and why it exists

    Hosts, clients, servers and tools. The problem MCP solves, and what it deliberately leaves to the application layer.

    • Architecture and roles
    • Capability negotiation
    • Lifecycle
    • When not to use MCP
  2. M02

    Building a tool server

    Defining tools, schemas and resources properly. Input validation and error shapes that clients can act on.

    • Tool definitions
    • Input schemas
    • Error responses
    • Resources and prompts

    Tools

    • TypeScript SDK
    • Python SDK
  3. M03

    Transports: stdio and HTTP

    Local development over stdio, deployed servers over streamable HTTP, and the operational differences between them.

    • stdio transport
    • Streamable HTTP
    • Session handling
    • Server deployment

    Stack

    • FastMCP
    • MCP Inspector
  4. M04

    Authentication and authorisation

    OAuth for remote servers, scoped tokens, and keeping per-user permissions intact through the tool boundary.

    • OAuth flows
    • Scoped tokens
    • Per-user context
    • Credential isolation
  5. M05

    Wiring MCP into an agent

    Registering servers with an agent runtime, deciding which tools to expose, and keeping tool selection reliable as the list grows.

    • Server registration
    • Tool selection
    • Context budget
    • Routing tools

    Tools

    • Claude Code
    • LangGraph
    • Cursor
  6. M06

    Security and threat modelling

    Tool poisoning, prompt injection arriving through tool output, confused deputy, and least-privilege design for destructive actions.

    • Tool poisoning
    • Injection via tool output
    • Confused deputy
    • Least privilege
    • Audit logging
  7. M07

    Reliable tool design

    Idempotency, pagination, timeouts, and tool descriptions written so a model picks the right one. Description writing is a real skill.

    • Idempotency
    • Pagination
    • Timeouts and partial failure
    • Tool descriptions
  8. M08

    Shipping and operating servers

    Versioning, observability, rate limits, and testing a server against real agent traffic rather than a single happy path.

    • Protocol versioning
    • Metrics and tracing
    • Rate limiting
    • Integration testing

    Stack

    • OpenTelemetry
    • Docker

Roles this maps to

Where this track lines up with real job descriptions.

  • AI Infrastructure Engineer

    The natural home for this skill. You own the layer between models and the systems they act on.

  • Agent Engineer

    Tool design and transport choices are core parts of building reliable agents, not a side concern.

  • Platform Engineer

    MCP servers are distributed services with auth and rate limits, so platform experience transfers directly.

What you can do afterwards

Concrete capabilities, not a certificate.

  • Build and deploy a production MCP server with authenticated HTTP transport
  • Threat-model a tool server and apply least-privilege rules to write actions
  • Write tool descriptions that a model selects reliably as your tool list grows
  • Connect an agent to real internal systems with permission boundaries intact

Questions

Is MCP still moving quickly enough to learn?

The core protocol model has been stable, and the transport and auth story is the part worth learning because it is not obvious from examples. The architecture reasoning transfers even when SDK details move.

Do I need to know agents already?

Module 5 assumes you can work with an agent runtime, but only lightly. If you have not built one, the Agentic AI track covers it properly and this track sits on top of it.

How is this different from just calling REST APIs?

The tooling and schema discovery, and the fact that a model chooses which tool to call. That last part changes how you design: tool descriptions become a prompt surface, and module 7 treats writing them as the skill it is.

Is a real server needed to complete this track?

You build and deploy one that talks to a system you care about, ideally a small internal or side project. A server with genuine permissions behind it teaches the security material in a way a mock cannot.

Related tracks

LLM Engineering

Build on top of models, not around them

RAG and Knowledge Systems

Retrieval that holds up against real questions

Ready when you are

Applications for the next cohort are open. You pick your track during the first month, so you can change if the material does not suit you.

Apply now Talk to a mentor first