Lesson 164 — Advanced

MCP Server for a Real Tool

MCP (Model Context Protocol) ka matlab: ek baar server banao, aur har compatible client (chat app, coding agent) usse seedha baat kar lega. Is lesson mein tum ek real tool — calendar ya tasks — ka MCP server banate ho.

Project kya hai

Yeh project 2026 ka integration pattern hai: agents ab custom APIs nahi, MCP servers maangte hain. Ek working server + docs = portfolio mein concrete proof ki tum protocol-level samajhte ho.

Server banana

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("my-calendar")

@mcp.tool()
def list_events(day: str) -> list[dict]:
    """Ek din ke saare events ISO date (YYYY-MM-DD) ke hisaab se list karo.
    Kaam nahi aaye toh khaali list wapas karo, guess mat karo."""
    return calendar_api.events(day)

@mcp.tool()
def search_notes(query: str) -> list[dict]:
    """Notes mein keyword search — title aur body dono."""
    return notes_index.search(query, limit=10)

if __name__ == "__main__":
    mcp.run()   # stdio transport — local clients ke liye

Client config

{
  "mcpServers": {
    "my-calendar": {
      "command": "python",
      "args": ["/path/to/server.py"],
      "env": { "CALENDAR_TOKEN": "env-secrets-yahan" }
    }
  }
}

• stdio: client tumhara server process khud chalata hai — local ke liye sabse aasan.
• HTTP/SSE: remote server — deploy karke doosron ke liye available.
• Tokens kabhi config file commit mat karo — env var ya secret manager se laao (L0.5/L8.6).

Testing — Inspector se

MCP Inspector official debugging tool hai — server ko visually chalao, tools list karo, manually call karke responses dekho:

npx @modelcontextprotocol/inspector python server.py
# Khulega: http://localhost:5173
# Connect -> tools/list -> list_events call -> JSON response check
# Error path bhi chalao: galat date, khali result, token missing

• tools/list par saare tools dikhne chahiye — description + schema ke saath.
• Har tool ka happy path + error path dono test karo (structured error messages).
• Ek actual client (Claude Desktop / any MCP host) se end-to-end ek call — yehi demo screenshot README mein.

Security — least privilege

• Scope chhota rakho: read-only tokens, sirf ek calendar (poora account nahi), minimum time-to-live.
• Tool output = untrusted data: usme aaya text prompt-injection ban sakta hai — client ko data samajh kar hi treat karna chahiye (L8.2/L8.4).
• Audit log: kaunsa tool, kis argument se, kab — chhoti si file bhi kaafi hai.
• Rate limit + pagination limit (search limit=10 jaisa) — agent galat loop chalaye toh API bill na uchhale.

Exercise

Common mistakes

• Vague tool descriptions: Docstring mein sirf "list karo" likha toh model input format guess karega. Kya, kaise, limits — teenon docstring mein.
• Pehle din hi write tools: create/delete se shuru karna = pehle buggy run par data ja sakta hai. Read-only v1, write v2 with confirmation.
• Secrets config file mein: Token commit kar diya toh repo leak = account leak. Env var + .env.example (naam bina value) — yehi pattern poore course mein hai.

server = FastMCP("my-calendar")
server.tool("list_events")(list_events)    # read-only, pehle
server.tool("create_event")(create_event)  # permission gate ke baad
# Ek server -> har MCP client: chat app, coding agent, custom bot