Creating MCPs

Creating MCPs: Safe, Observable, Bounded Servers for the Enterprise — the fifth course, a hands-on, measured follow-on to the Foundations course .

Do the Foundations course first. This course assumes it — it leans on §14–15 (tool calling and the tool-use loop), §16–17 (sandboxing), §18 (MCP by hand) and §21 (security), and does not re-teach them. If those aren’t familiar, start with Foundations .

Foundations §18 built an MCP server by hand and ended on “in production, reach for the official SDK.” This course starts there, on the current protocol (2026-07-28) and the Python SDK v2, and asks the questions the quickstarts skip. Its examples are the systems a SOC or IT-operations team actually wires agents into: a CMDB in Postgres and a SIEM in OpenSearch, with personas who may see different things and a planted intrusion to find. An MCP server is three things at once — an interface for a model reader, a trust boundary, and a shared resource with an operating envelope — and the course measures its way to a default for all three: catalogs and discovery, restrictive vs permissive tools, identity and enterprise rules, per-caller limits, performance, the OWASP MCP Top 10, and audit. Labs are reactive marimo notebooks; the estate runs on a laptop or a shared lab server.

-1 The Problem and the Thesis Goal: understand what this course is for, set up the estate you will work in for the rest of it, and take a first look at that estate as three … 01 The Current Protocol and a First Server Goal: build your first real MCP server, a read-only CMDB server, with the official Python SDK v2, on the current protocol (2026-07-28). Along the way … 02 The Host Side Goal: build the other end of the protocol, a host: the application that starts MCP servers, hands their tools to gpt-oss-120b, runs the tool calls the … 03 Catalogs and Discovery Goal: give a model what it needs to ask good questions of the CMDB and the SIEM, and measure the difference. You’ll build the two common answers side … 04 Searching Logs and Incidents Goal: build the SIEM server’s real tools: incidents, aggregations and log search over OpenSearch. Three habits run through all of them: every query … 05 The Permission Dial: Restrictive vs Permissive Tools Goal: give the same persona’s access to a model four ways, from “run any SQL” to “only these questions”, and measure what each one costs and risks: … 06 Designing Tools for a Model Reader Goal: make the restrictive tools from Units 3-5 easier for a model to use correctly, without changing a line of what they do. You’ll: serve the same … 07 Identity, Least Privilege and Enterprise Rules Goal: turn the single-persona servers of Units 3-6 into shared servers that know who is calling and act as that person all the way down. You’ll: issue … 08 Resource Management: Many Callers, Finite Backends Goal: put Unit 7’s shared servers inside an operating envelope, so that many agents calling at once can’t exhaust the backends, and one agent stuck in … 09 Performance and Scale Goal: run Unit 8’s servers as several replicas, and find out what that buys and what it breaks. You’ll: measure the two transports against each other, … 10 Attacking and Defending MCP Status: in progress. This unit’s defences, servers and lab are complete. The negative cases, one per OWASP category, are placeholders that the course … 11 Observability, Audit and Testing Goal: know what the gateway did, for whom, and why, and know when a change breaks it. You’ll: carry one trace across the client, the SDK and the … 12 The Measured Default (Capstone) Goal: put everything the course built behind one endpoint, use it to work a real incident from alert to containment proposal, and decide, with … 13 References & Further Reading The specifications, standards and documentation this course is built on, grouped by topic, with the unit that leans on each. Where the course makes a … 14 E1. Backend APIs with Approvals Goal: let the capstone gateway carry out the step it proposed, through backend APIs that fail the way real ones do, without ever doing it twice, doing … 15 E2. The Local Systems Server Goal: give an agent controlled access to a host under investigation: who logged in, what is running, what it talks to, what will start it again, and … 16 E3. Full OAuth for Remote Servers Goal: let a host that has never seen your server connect to it the way a real deployment does: find the issuer, register, send a person to consent, …

Last modified October 10, 2026