References & Further Reading

The specifications, standards and documentation this course is built on, grouped by topic, with the unit that leans on each. Where the course makes a claim about a protocol, a database or a security property, the source is here. Read the source when your version differs from the course’s: specs and products move faster than courses.

The course targets MCP 2026-07-28 with the Python SDK v2, Postgres 17 and OpenSearch with its security plugin. Links were checked in October 2026.

The protocol

MCP specification, 2026-07-28 and its changelog . The stateless core, server/discover, input_required, cache hints, the Mcp-Method and Mcp-Name headers, and trace context in _meta. Units 0, 1 and 2, and everything after.
The 2026-07-28 release candidate and the final release : what changed from 2025 and why, including what’s deprecated (sampling, roots, logging) and the one-year runway. Unit 0.
The specification repository : the schema and the SEPs (enhancement proposals) that the changelog cites, such as SEP-414 for trace context (Unit 11).
Python SDK : MCPServer (formerly FastMCP), the first-class Client, middleware, ToolError, sealed request state, and the SDK’s own OpenTelemetry spans. Every unit’s code.
MCP Inspector : a client for poking at a server by hand. A useful companion to Unit 1’s frame tap.
JSON Schema 2020-12 : the dialect the spec uses for input and output schemas. Units 1 and 6.

Identity and authorization

MCP authorization : OAuth 2.1 for HTTP transports, protected resource metadata, audience-bound tokens and no token passthrough. Unit 7.
RFC 9728, OAuth 2.0 Protected Resource Metadata : how a client learns which authorization server a resource trusts. Unit 7.
RFC 8707, Resource Indicators for OAuth 2.0 : why a token for the CMDB server is refused by the SIEM server. Unit 7, and the identity line of Unit 12’s review.
RFC 7519, JSON Web Token and RFC 8037, Ed25519 in JOSE : the course issuer’s tokens. Unit 7.
RFC 9700, OAuth 2.0 Security Best Current Practice : the threat model the MCP authorization page builds on.
RFC 8414, Authorization Server Metadata and RFC 7591, Dynamic Client Registration : how a host finds the issuer’s endpoints and gets a client id. E3.
RFC 7636, PKCE and RFC 9207, Authorization Server Issuer Identification : a stolen code is useless without the verifier, and a code from the wrong issuer is refused. E3.
RFC 8693, OAuth 2.0 Token Exchange : calling a downstream API for the person, with act naming the server acting. E3.
The OAuth 2.1 draft : PKCE for every client, exact redirect URIs, and rotated refresh tokens with replay detection. E3.

Security

OWASP MCP Top 10 : the ten categories Unit 10 maps onto the gateway, and the cases the Unit 12 review reports on.
OWASP Top 10 for LLM Applications : the wider list the MCP one specializes. Prompt injection and excessive agency are the two that matter most here.
MCP security best practices : the confused deputy, token passthrough, session hijacking and local server compromise, from the protocol’s maintainers. Units 7 and 10.
Tool poisoning attacks (Invariant Labs, 2025): instructions hidden in tool descriptions. The reason for Unit 10’s description vetting and pinning.
The lethal trifecta (Simon Willison, 2025): private data, untrusted content and a way to send data out, in one agent. Unit 0’s argument for a measured default, and Unit 10’s egress defence.

Observability

W3C Trace Context : the traceparent format the joinable record and _meta carry. Units 1 and 11.
OpenTelemetry semantic conventions for MCP and for generative AI : the span names and attributes telemetry.to_span follows. Both are still marked Development; the source now lives in semantic-conventions-genai . Unit 11.
Service Level Objectives (SRE book) and Implementing SLOs (SRE workbook): objectives, indicators and error budgets. Unit 11’s objective and the latency line of Unit 12’s review.

Load, limits and scale

Scaling your API with rate limiters (Stripe): request rate, concurrency and load shedding, the same split as Unit 8’s limits.
Handling Overload (SRE book): per-caller limits, criticality and retry budgets. Unit 8’s “busy, retry after N s” refusals.
Valkey : the key-value store behind Unit 9’s shared limits and cache.
Uvicorn : the ASGI server and its workers. Unit 9.

Postgres (the CMDB)

Row security policies : how an L1 analyst can’t see db-prod-01. Units 3 and 7.
GRANT and SET ROLE : column privileges, the gateway acting as the caller’s persona, and the insert-only and select-only logins of the audit table. Units 7 and 11.
Client connection defaults : statement_timeout and friends. Units 5 and 8.
EXPLAIN : the cost gate before a query runs. Units 5 and 8.
psycopg connection pools : sizing a pool against a role’s connection limit. Units 8 and 9.
SQLGlot : the SQL parser behind Unit 5’s guard.

OpenSearch (the SIEM)

Document-level security and field-level security : which events and fields each persona may read. Units 4 and 7.
User impersonation : the opendistro_security_impersonate_as header and the plugins.security.authcz.rest_impersonation_user setting that lets the gateway act as the caller. Unit 7.
Point in time : sealed cursors with search_after, and why each one holds a context per shard. Units 4 and 8.
PPL : the piped query language Unit 5’s open end of the dial exposes and guards.
Python client : opensearch-py, which every SIEM example uses.
opensearch-mcp-server-py : the project’s own MCP server, the permissive end of Unit 5’s dial.

Porting to Elasticsearch

The SIEM runs on OpenSearch so that document- and field-level security are free to use in class. Everything else ports to Elasticsearch with renames. If your SOC runs Elasticsearch, this is what changes:

The course uses (OpenSearch)	Elasticsearch	Notes
Security plugin roles, `_plugins/_security/api/roles`	Roles via `_security/role`	Same idea: index privileges per role.
Document-level security: a role’s DLS query	A role’s `query` (DLS and FLS )	A paid feature in Elasticsearch (not in the free Basic license); check Elastic’s subscription matrix for your tier.
Field-level security: `"fls": ["~user.email"]`	`field_security: {grant: ["*"], except: ["user.email"]}`	Same licensing as DLS.
`masked_fields` (a hash instead of the value)	No direct equivalent among the pages linked here	Exclude the field, or hash it at ingest.
Impersonation: `opendistro_security_impersonate_as`	`run_as` privilege and the `es-security-runas-user` header (docs )	Not available on Elastic Serverless.
`create_pit` / `delete_pit`, `search_after`	`POST /<index>/_pit?keep_alive=...`, `pit.id` in the search, `DELETE /_pit` (paginating )	Unit 4’s sealed cursor ports directly.
PPL, `_plugins/_ppl`	ES\|QL , `_query`	A different language: Unit 5’s PPL guard must be rewritten, not renamed.
`opensearch-py`	`elasticsearch` Python client	Near-identical call shapes for search, PIT and index templates.
opensearch-mcp-server-py	mcp-server-elasticsearch	Deprecated by Elastic in favour of its Agent Builder MCP endpoint.

Index templates, aggregations, date_histogram, terms and search_after are the same query DSL on both. The task tools of Units 4 and 6 need no change beyond the client.

Courses as preparation and complements

This course assumes you know what MCP is and have built a small server. If you haven’t, start with one of these; each also covers ground this course skips.

MCP Course (Hugging Face, with Anthropic): fundamentals to a deployed app. Good preparation for Unit 1.
MCP: Build Rich-Context AI Apps with Anthropic (DeepLearning.AI): servers and clients connected to a desktop host. A short preparation for Units 1 and 2.
Introduction to Model Context Protocol (Anthropic Academy): tools, resources and prompts in Python. Preparation for Unit 1; resources and prompts are covered more there than here.
MCP for Beginners (Microsoft): an open curriculum in several languages. A complement if your servers aren’t in Python.

Where they stop, this course picks up: an enterprise estate behind the server, many callers with different rights, finite backends, an adversary, and a review that says whether it’s ready.

Tools used in the labs

marimo : the reactive notebooks every lab is written in.

The optional enterprise track starts with E1: Backend APIs with Approvals : the capstone gateway carries out the step it proposed, through backend APIs that fail, behind an approval and a change window.

Last modified October 12, 2026