Lesson 66 — Beginner

MCP — Model Context Protocol

MCP (Model Context Protocol) ek open standard hai jisse tum ek baar kisi system (database, internal API, SaaS) ke tools banao aur wohi integration har compatible AI application mein chale. Is lesson mein host-client-server architecture, function calling se farak, ek asli MCP server likhna, transports/auth aur untrusted servers ka risk cover honge.

MCP kyun bana

Pehle ka problem: N integrations × M applications = N×M cables. Har naye AI app ke liye integration dobara. MCP ne standard plug banaya — ab N + M ka kaam hai. Yehi standardization iska poora point hai.

Host → client → server

AI application (host)  — jaise Claude Desktop, agent framework, chat client
   |  MCP client (host ke andar, har server connection ke liye ek)
   |  JSON-RPC messages — stdio (local) ya streamable HTTP (remote)
   v
MCP server (tumhara)  — ek baar banao, kai apps mein chalega
   +-- tools      functions jo model call kar sakta hai (search, create)
   +-- resources  padhne wala data (file, db rows, records)
   +-- prompts    ready-made prompt templates
   v
Real system: internal API, Postgres, filesystem, SaaS app

• Host: user-facing AI application — conversation manage karti hai, model chalati hai, aur kaise chalana hai decide karti hai.
• Client: host ke andar ek per connection — server se handshake (capabilities) karta hai, messages route karta hai.
• Server: capability expose karta hai — tools/resources/prompts ki list, phir unhe handle karke result deta hai.

Function calling vs MCP

Dono alag layer par kaam karte hain: function calling batata hai model kaise action request kare (ek model call ke andar), MCP batata hai external capabilities AI application tak kaise pahunchti hain (application layer par, standard interface se).

• Function calling = model provider ka mechanism — tool schema diya, tool_calls aaya, result gaya. Andar ka engine.
• MCP = exposure standard — koi bhi system apne tools MCP server ke through publish kare, host unhe aise hi lega jaise built-in tools.
• MCP server ke tools host mein aakar model ke saamne function calling ki shakal mein hi aate hain — dono ek doosre ko complete karte hain, replace nahi.

Ek MCP server likhna (Python)

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("orders-server")

@mcp.tool()
def lookup_order(order_id: str) -> dict:
    """Customer ka order detail internal API se lao. Sirf read hai."""
    return orders_api.get(order_id)

@mcp.tool()
def list_refunds(days: int = 7) -> list:
    """Pichle N dinon mein hue refunds ki list."""
    return refunds_api.recent(days)

@mcp.resource("orders://{order_id}")
def order_card(order_id: str) -> str:
    """Order ka snapshot resource ki tarah — direct padhne ke liye."""
    return json.dumps(orders_api.get(order_id), indent=2)

if __name__ == "__main__":
    mcp.run()  # default stdio — local host app isko spawn karti hai

• Tool vs resource: tool = model ka action (call hota hai), resource = padhne wala data (host attach karti hai). Galat choice se model ko extra actions mil jaate hain jo chahiye nahi.
• Type hints hi schema hain: function signature se parameter schema banta hai — typed arguments ka fayda seedha.
• Docstring = description: model yahi padhta hai — "kab use karna hai" wali line likhna na bhoolo (L5.3 wala same rule).
• Errors: tool exception protocol-level error banta hai — informative message rakho, wohi model ko recover karayega.

Transports, auth aur trust boundaries

{
  "mcpServers": {
    "orders-server": {
      "command": "python",
      "args": ["orders_server.py"],
      "env": {"ORDERS_API_KEY": "vault-secrets-se-aao"}
    },
    "remote-metrics": {
      "url": "https://metrics.internal/mcp",
      "headers": {"Authorization": "Bearer <token>"}
    }
  }
}

• Stdio: local process, host khud spawn karti hai — LAN se expose nahi hota, sabse simple.
• Remote (streamable HTTP): service ke roop mein — token auth zaroori, aur scope chhota rakho (sirf needed tools).
• Least privilege: server par sirf wahi tools/resources jo AI app ko chahiye. Poora db expose karna bekaar hai.
• Untrusted servers: unknown community server = naya attack surface. Tool output bhi untrusted data hai — usme likha instruction kabhi follow mat karo (prompt injection).
• Audit: kaunsa server connected, kya expose kar raha hai, kitne calls hue — ye list regularly dekho.

Exercise

Common mistakes

• MCP aur function calling ko same samajhna: Function calling model ka request mechanism hai; MCP external capabilities ko AI apps tak pahunchane ka standard hai. Alag layers hain — interview mein yahi farak poochha jaata hai.
• Server par sab kuch expose karna: Poora db/API daal dena = least privilege toota. Sirf needed tools/resources publish karo, write tools approval ke saath, aur scope chhota rakho.
• Tool output ko trusted maanna: Kisi bhi server ke result mein prompt injection aa sakta hai. Woh data hai, instruction nahi — model ko system prompt mein yeh boundary clear karo.
• Remote server par auth ignore karna: HTTP transport bina token ke bahar khula hai. Token ka scope chhota rakho, secrets code mat daalo, vault/env se lao.

pehle: app1 x apiA, app1 x apiB, app2 x apiA ... (N x M)
ab:    apiA -> MCP server (ek baar) -> har compatible app (N + M)