Sefism Model Context Protocol Cheat Sheet

What this cheat sheet is

The Sefism Model Context Protocol cheat sheet is a quick-revision book for engineers building AI applications that use tools and data through MCP. It covers the roles, the JSON-RPC messages, transports, tools, resources and prompts, OAuth for remote servers, building servers with the official SDKs, and the security and design rules that keep servers useful.

It is a standalone sheet: it does not belong to one roadmap and has no editions, so every reader sees the same nine chapters and 62 concepts. Each concept is a short card with what it is, why it matters and, for many, the mistake people make with it. Some cards include a short code snippet, such as a JSON-RPC message or a minimal server.

Which revision of MCP it reflects

MCP is versioned by date, and the protocol has changed a lot in a short time. The sheet states that it reflects the 2026-07-28 revision of the specification, and it notes what older revisions did differently where that still matters. In that revision requests are stateless: each one carries its protocol version and client capabilities in _meta, instead of an initialize handshake and a session at the start of a connection. Because many hosts, servers and tutorials still speak the earlier revisions, the sheet keeps a card on the older handshake so you recognise it in logs and SDKs. Check which revision your SDK and host speak before relying on a newer feature.

Who it suits

• Engineers connecting an AI app, IDE assistant or agent to internal tools, and wanting to know what the host, client and server each do.
• Developers writing their first MCP server in Python or TypeScript.
• Anyone responsible for approving which MCP servers a team may install, who needs the security chapter more than the rest.

If you are new to agents in general, start with the AI agents and MCP roadmap, which teaches tool use, agent loops and evaluation in order, and come back to this sheet for the protocol detail. The roadmap's own AI agents cheat sheet covers the wider agent topics.

Chapter by chapter

1. What MCP is

The Model Context Protocol as an open standard (the sheet compares it to a USB port), the M times N integration problem it solves, the host, client and server roles, the three server primitives (tools, resources and prompts) and how protocol versions and optional extensions such as Tasks and MCP Apps work. The first pitfall is a useful one: MCP is plumbing between applications, not a model feature.

2. Messages and lifecycle

JSON-RPC 2.0 requests, responses and notifications; stateless requests and _meta; server/discover and version negotiation; the initialize handshake from older revisions; capabilities; multi round-trip requests that return input_required; notifications and subscriptions; and the difference between protocol errors and tool errors that return isError: true.

3. Transports

stdio for local servers, Streamable HTTP for remote ones, and the deprecated HTTP+SSE transport it replaced. Also local versus remote servers, registering a server with a host, and keeping state without sessions by returning an opaque handle. The most common bug in the whole sheet lives here: printing logs to stdout in a stdio server, which corrupts the protocol stream.

4. Tools, resources and prompts

Tool definitions, input schemas in JSON Schema, tool annotations such as readOnlyHint and destructiveHint, tool results and structured output with outputSchema, resources addressed by URI, resource templates, prompts and argument completion.

5. Client features and utilities

Elicitation in form and URL mode, progress and cancellation, and the Tasks extension for long-running work. Sampling, roots and protocol logging are covered too, marked as deprecated in the 2026-07-28 revision.

6. Authorisation for remote servers

OAuth 2.1 roles in MCP, protected resource metadata, the authorisation code flow with PKCE, resource indicators and token audience, client registration, scopes and step-up with insufficient_scope, and the rule against token passthrough. Local stdio servers take credentials from the environment instead.

7. Building and testing a server

A Python server with decorators on MCPServer (earlier versions called it FastMCP), Python resources and templates, a TypeScript server with registerTool and Zod schemas, connecting a transport, the MCP Inspector, testing servers with unit and integration tests, and how SDK releases track spec revisions.

8. Security

Prompt injection via tool results, malicious servers and tool poisoning, least privilege, confirmation for destructive tools, data exfiltration paths (a tool that reads private data plus one that can reach the outside world), and hardening a server with validation, rate limits, timeouts and audit logs.

9. Designing good tools

Task-level tools rather than one tool per API endpoint, names and descriptions written as you would brief a new colleague, concise and paginated results, actionable error messages, stable tool lists, and evaluating tool use with realistic tasks.

Rules of thumb

The sheet ends with eight rules, including:

• Log to stderr in stdio servers; anything on stdout that is not a protocol message breaks the connection.
• Test every server in MCP Inspector before connecting it to a model.
• Treat every tool result as untrusted input that may contain instructions.
• Return tool failures as results with isError: true and a message that tells the model how to fix the call.
• Validate that access tokens were issued for your server, and never pass them on to other APIs.
• Prefer a few task-level tools with sharp descriptions over one tool per API endpoint.

How to use it

• Before building a server, read chapters 1, 3 and 9, so the design is right before the code is.
• While building, keep chapters 4 and 7 open, and test each tool in the Inspector as you add it.
• Before exposing a server remotely, work through chapters 6 and 8 as a checklist.
• When an SDK example does not work, check chapter 2 and the revision notes: the cause is often an older revision.

How it works on Sefism

Everything on Sefism is free to learn from. The public page lists all nine chapters, with the first chapters open to read. Keeping the sheet in your member area uses credits, like any cheat sheet; because it is standalone, it is not included with a roadmap. New members get starting credits when they join. If you are stuck on a protocol question, send Tauseef a query.

Related on Sefism

• Roadmap: AI agents and MCP, with its cheat sheet; also the LLM APIs cheat sheet
• Question: What is MCP, and do I need to learn it?
• FYP ideas: Model Context Protocol Server for University Systems and AI Agent Tool Permission Gateway with Human Approval and Audit Log
• Resources: Model Context Protocol documentation, MCP Inspector, MCP Python SDK, MCP TypeScript SDK, Writing Effective Tools for AI Agents

FAQ

What is MCP in simple terms? An open protocol that defines how AI applications discover and use external tools, data and prompt templates, using JSON-RPC 2.0 messages over a transport. Write an integration once as a server and it works in any MCP-capable host.

What is the difference between an MCP host, client and server? The host is the AI application the user works in. It runs one client per configured server, and each server exposes tools, resources and prompts.

Should I use stdio or Streamable HTTP? stdio for a local server the host starts as a subprocess; Streamable HTTP for a remote server, which then needs OAuth. HTTP+SSE is deprecated.

Is MCP safe to use? Only with care. Tool results can carry prompt injection and servers can be malicious, so grant least privilege, read what a server does before enabling it, and confirm destructive actions. Chapter 8 covers each risk.