Chapter 6 · Part 3

Secure it & ship

An MCP server is a door into your data and actions, opened for an AI that follows instructions from anywhere — including a web page or document it just read. That makes a few habits non-negotiable before you expose one beyond your own machine.

Treat every call as untrusted

The AI chooses the arguments, and it can be steered by content it encounters. So:

  • Validate inputs. A tool that takes a path should refuse to escape its folder; one that runs a query should never interpolate raw strings.
  • Gate side effects. Reading is low-risk; anything that deletes, sends, or spends should be narrow and, ideally, confirmed — the same reversibility test from the agent course.
  • Expose the minimum. Every tool and resource is attack surface. Ship only what's needed.
⚠️'The model asked for it' is not authorization

Prompt injection is real: text your server's data contains can try to make the AI misuse your tools. Your server — not the model — is the last line of defense. Enforce limits in code.

Auth for remote servers

A local stdio server is only reachable by you. The moment a server is on a URL others can hit, it needs authentication — the SDK has OAuth 2.1 support built in (see the SDK's Authorization docs) so you can require a verified token before any tool runs.

The v2 heads-up

The SDK is moving to a v2 with a new API (the server class becomes MCPServer, and more). It's in pre-release now. A plain pip install "mcp[cli]" still gives you the stable v1 line this course used, so your code keeps working — but if another project depends on mcp, pin it so a future v2 can't surprise you:

pin it in your dependencies
mcp>=1.27,<2

When you're ready to move, the SDK ships a migration guide. The concepts — tools, resources, prompts, transports — carry over unchanged; only the class names shift.

What you built, and where next

You wrote a real MCP server: tools that act, resources that supply data, prompts users can invoke — connected to Claude Code and the Claude API, exposed over a standard any AI app can speak.

  • Learn from real servers — the official catalog at github.com/modelcontextprotocol/servers is a library of production examples.
  • Read the spec — modelcontextprotocol.io covers sampling, elicitation, and more primitives beyond these three.
  • Wrap something you use — your notes, a database, an internal API. Build it once; every MCP-speaking app can now reach it.