Cheat sheet · Specialise
Model Context Protocol cheat sheet
Opens with creditsA quick-revision book on the Model Context Protocol: the roles, the JSON-RPC messages, transports, tools, resources and prompts, OAuth for remote servers, building servers with the official SDKs, and the security and design rules that keep them useful. It reflects the 2026-07-28 revision of the specification and notes what older revisions did differently.
Curated by Tauseef Fayyaz9 chapters62 concepts82 glossary termsChapters
9 chapters · 62 concepts
1What MCP isMCP is an open standard for plugging tools and data into AI applications, in the way a USB port lets any device work with any computer. Start with the roles and the three things a server can offer.7 concepts
- 1Model Context ProtocolAn open protocol that defines how AI applications discover and use external tools, data and prompt templates, using JSON-RPC 2.0 messages over a transport.
- 2The M times N problemWithout a standard, M AI applications and N services need M times N custom integrations.
- 3HostThe AI application the user interacts with, such as a desktop chat app, an IDE or an agent.
- 4ClientThe connector inside the host that talks to exactly one server.
- 5ServerA program that exposes tools, resources and prompts over MCP.
- 6Tools, resources and promptsTools are functions the model can call; resources are data the application can read into context; prompts are templates the user picks.
- 7Protocol versions and extensionsThe specification is versioned by date, for example 2025-11-25 and 2026-07-28.
7 in this chapterOpen this chapter2Messages and lifecycleEverything in MCP is a JSON-RPC 2.0 message. The current revision is stateless: every request carries the version and capabilities it relies on, instead of a handshake at the start of a connection.8 concepts
- 1JSON-RPC 2.0A small JSON message format.
- 2Stateless requests and _metaSince 2026-07-28, each request carries its protocol version and client capabilities (and usually client info) in
_meta. - 3server/discover and version negotiationServers implement
server/discoverto advertise their supported versions, capabilities and identity. - 4The initialize handshake (older revisions)Up to 2025-11-25, a connection began with an
initializerequest exchanging versions and capabilities, then aninitializednotification. - 5CapabilitiesDeclarations of optional features each side supports, such as
toolswithlistChangedon a server orelicitationon a client. - 6Multi round-trip requestsWhen a server needs more from the client mid-request (user input, for example), it returns a result with
resultType: "input_required"and the questions. - 7Notifications and subscriptionsOne-way messages such as progress updates or
notifications/tools/list_changed. - 8Protocol errors and tool errorsProtocol problems (unknown tool, malformed params) are JSON-RPC errors.
8 in this chapterOpen this chapter- TransportsA transport carries the JSON-RPC messages. Local servers use stdio; remote servers use Streamable HTTP. The older HTTP+SSE transport is deprecated.6 conceptsOpens with credits
- Tools, resources and promptsThe three server primitives in detail: how tools are described and answer, how resources are addressed, and how prompts give users reusable workflows.9 conceptsOpens with credits
- Client features and utilitiesClients can also offer features to servers, chiefly asking the user for input. Sampling, roots and protocol logging still work but are deprecated in the 2026-07-28 revision.6 conceptsOpens with credits
- Authorisation for remote serversRemote servers use OAuth 2.1. The MCP server is a resource server that checks tokens; a separate or built-in authorisation server logs the user in and issues them. Local stdio servers take credentials from the environment instead.7 conceptsOpens with credits
- Building and testing a serverThe official SDKs handle the protocol so you write plain functions. Python uses decorators on an
MCPServerfrom themcppackage; TypeScript registers tools on anMcpServerwith Zod schemas.7 conceptsOpens with credits - SecurityAn MCP server hands a model the power to act. Treat everything it returns as untrusted input, grant the least access that works, and keep a human in the loop for anything that cannot be undone.6 conceptsOpens with credits
- Designing good toolsA model uses your server only as well as your tools let it. Design for an agent reading descriptions, not a developer reading API docs.6 conceptsOpens with credits
- 10Glossary, A to ZEvery concept in the sheet and the smaller terms it uses, in one list.82 terms
About this sheet
How MCP connects AI applications to tools and data: hosts and servers, messages, transports, auth, building servers and staying safe.
Related on Sefism
Picked from the other libraries by shared topics.
Roadmaps
See allBest practices
See all- Best Practices for Building LLM AppsHow to build LLM apps and agents that hold up in production: prompts, evals, prompt injection, tool permissions, cost, logging and privacy.
- Prompt Engineering Best PracticesHow to write prompts that work the same way on the hundredth input as on the first: clear instructions, structure, examples, reasoning, output control and testing.
- Best Practices for AI Coding AssistantsHow to get reliable code from AI coding assistants and agents: instruction files, task prompts, verification, review, security, dependencies and session hygiene.
Checklists
See all- RAG Production ChecklistA RAG production checklist: chunking, embeddings, hybrid search, reranking, per-user permissions, citations, evals, re-indexing and cost, with how to verify each check.
- LLM Evaluation ChecklistAn LLM evaluation checklist: success criteria, eval datasets, code and model graders, judge calibration, agent evals, safety tests and production monitoring, with how to verify each check.
- AI Feature Launch ChecklistAn AI feature launch checklist: use case fit, evals, UX for errors, disclosure, human override, abuse filters, rate limits, cost caps, prompt privacy, monitoring and rollback.
Project structures
See all- GenAI RAG app (FastAPI) project structureFor developers turning a "chat with your documents" demo into an app people can rely on. A FastAPI backend where every layer has a home: ingestion workers, retrieval, prompts as versioned files, model clients with fallbacks and cost caps, guards, evals that gate CI, and tracing, so a wrong answer can be traced to the step that caused it.
- AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Machine learning project project structureFor students and analysts whose model works in a notebook and now needs to be reproducible, reviewable, served and watched. It starts from the Cookiecutter Data Science v2 layout (immutable raw data, numbered notebooks, a real Python package) and grows into versioned data with DVC, typed parameters, data validation with pandera, experiment tracking and a model registry with MLflow, a FastAPI prediction service, drift monitoring and, for a team, scheduled retraining, model cards, fairness checks and shadow deployment.
Career questions
See all- Which AI tools do employers expect junior developers to know in 2026?Employers rarely require a specific brand. They expect you to use an AI coding assistant well (in the editor and in the terminal), to review and test what it produces, to call an LLM API in a small feature, and to explain when you would not use AI. Pick one assistant, learn it properly, and show judgement in your projects.
- How do I use AI to become a better engineer instead of becoming dependent on it?Decide the job AI does before you open it. Use it as a tutor, reviewer and sparring partner that explains and challenges, not a vending machine that hands you finished code. Attempt first, ask second, and always be able to explain and defend what you ship.
- How do I start learning AI agents as a software engineer?Start with one LLM API and plain code: a loop that calls the model, lets it pick a tool, runs the tool and feeds the result back. Build one small agent that does a real task end to end, add evaluation and guardrails, and only then reach for a framework. Agents are software engineering first.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com