MCP

Beginner — What problem does MCP solve?

• It standardizes how AI applications connect to and discover external tools and context.
• Multiple approved hosts can reuse the same server-side capability contracts rather than each building a custom integration.

Intermediate — MCP versus function calling?

• Function calling lets a model propose a structured operation.
• MCP provides an integration protocol for discovering/invoking capabilities.
• The host can turn a model proposal into an MCP request that calls an existing REST service underneath.

Senior — How do you secure an MCP server?

• I authenticate requests, verify token properties, authorize each tool and object, restrict downstream credentials/egress, validate schemas/results, review tool definitions, and audit actions.
• Connection permission does not equal customer-record permission.

Scenario — A new discovered tool requests secret access. What happens?

• The host should not automatically expose or execute it.
• Tool descriptions are untrusted unless reviewed; allowlists and execution policy block capabilities outside the task.
• I investigate the server/definition change and preserve an audit record.