What MCP is, how to build MCP servers/clients, security, and tools. 12 articles, written by the engineers building AI App Lab.
MCP database server with FastMCP for PostgreSQL, MySQL, SQLite, MSSQL. Tools: list_tables, describe_table, execute_query, explain_query. Read-only mode, connection pooling, SQL validation, table allowlist, row limiting, schema introspection, and production checklist for 2026.
MCP security risks: tool poisoning, prompt injection, cross-server data exfiltration, rug-pull attacks, confused deputy, CVE-2025-6514. STRIDE threat model, defense-in-depth architecture, sandboxing, least privilege, tool integrity, runtime monitoring, and production checklist for 2026.
Build an MCP server from scratch with Python FastMCP SDK. Register tools with @mcp.tool(), resources with @mcp.resource(), prompts with @mcp.prompt(). stdio transport for Claude Desktop, Streamable HTTP for remote. MCP Inspector testing, Claude Desktop config, and production checklist for 2026.
MCP (Model Context Protocol) is an open protocol by Anthropic for connecting LLMs to external data sources and tools. Client-host-server architecture, JSON-RPC 2.0, stdio and Streamable HTTP transports, tools, resources, prompts, sampling, capability negotiation, and production checklist for 2026.
MCP tools are model-controlled functions AI can invoke. Build tools with @mcp.tool() decorator, auto-generated JSON schema from type hints, input validation, error handling, progress notifications, cancellation, testing strategy, and production checklist for 2026.
MCP transports: stdio for local subprocess communication, Streamable HTTP for remote with POST and optional SSE. Single endpoint design, session management, resumability, redelivery, OAuth auth, custom transports, 2026-07-28 stateless protocol, and production checklist.
Claude Desktop MCP setup: edit claude_desktop_config.json, add mcpServers with filesystem, GitHub, Postgres, Brave Search. Config paths for macOS, Windows, Linux. Desktop Extensions (.dxt), Custom Connectors for remote OAuth, troubleshooting, and production checklist for 2026.
Best MCP servers 2026: Context7 (54K stars, 890K weekly downloads), GitHub, Filesystem, Postgres, Brave Search, Firecrawl, Sentry, Cloudflare, Notion, Figma, Playwright. Vendor-maintained vs community, security tiers, decision framework, and production checklist.
Cursor MCP setup: configure mcp.json in Settings > Cursor Settings > MCP, add servers via stdio and SSE. Filesystem, GitHub, Postgres, Brave Search, Context7, Firecrawl. Agent mode, tool approval, security boundaries, troubleshooting, and production checklist for 2026.
Build an MCP client in Python with ClientSession, StdioServerParameters, and stdio_client. Connect to MCP servers, list tools, call tools, read resources, use prompts, integrate with Claude API for AI-powered chat. Capability negotiation, AsyncExitStack, and production checklist for 2026.
MCP authentication: OAuth 2.1 with PKCE for HTTP transports, environment credentials for stdio, bearer tokens and API keys. Authorization framework, .well-known/oauth-authorization-server, token passthrough prohibition, Keycloak integration, and production checklist for 2026.
MCP API server wraps REST APIs as MCP tools with FastMCP and httpx. Build Slack, Notion, Jira, weather API integrations. API client pattern, error handling, OAuth middleware, caching, deployment, and production checklist for 2026.