Which responsibilities belong to the host, client, server, model, and user?

2026-07-28 core · deterministic JSON-RPC fixtures

Atlas Release Evidence Server. Read-only evidence, deterministic scoring, and an explicit evaluation Task across replicas and protocol eras.

Prior knowledge: Function calling, JSON-RPC, and HTTP basics help. Building with LLM APIs is the recommended preceding course.
Study time: 3–4 hours guided · about 9 hours of optional deep dives
By the end: Design, implement, secure, and test a modern stateless MCP host and server across transports, versions, explicit state, Tasks, and hostile failures.

01 · Smallest useful mechanism

Keep orchestration, protocol, execution, and authorization as separate responsibilities.

An MCP host coordinates model interactions, clients maintain server connections, and servers expose context and operations. None of those roles makes server content trusted or a model proposal authorized.

MCP makes capabilities interoperable; the host still owns consent, policy, and model-facing decisions.

02 · Experiment

Test the prediction

Deterministic protocol fixture

This workbench uses inspectable JSON-RPC fixtures and injected failures. It does not make live calls or execute external effects.

Protocol workbench · atlas-boundary-v1

Choose the architecture that preserves host control after connecting a third-party server.

Injected failure

The server labels a write-capable tool “read only” in its description.

Choose the implementation

Let the model call the server directlyPass credentials and trust server annotations.Approve the server onceTreat initial connection consent as permanent tool authorization.Mediate through the hostDiscover, filter, authorize, approve, invoke, sanitize, and audit.

The trace has not run.

Commit to an implementation, then inject the failure and inspect the actual state transitions.

03 · Implementation brief

Build it, break it, prove the outcome.

Implement: Draw the host, model, client, server, identity provider, and external system with every credential and policy boundary.
Break it on purpose: Change a tool description and scope after connection, then propose a cross-tenant call.
Completion evidence: The host detects drift, re-evaluates authority, denies the call, and stores a reviewable decision.

Your learning artifact

Write the argument you would defend

Stored only in this browser. No account required; course reset does not delete it.

Your response

04 · Check your understanding

What does MCP capability discovery establish?

Primary sources · verified 2026-08-02

What the fixture does not prove

Architecture diagrams that collapse the host, model, and server conceal where credentials live, where approvals happen, and who is accountable for an effect.

Common mistake: Connecting an MCP server grants the model permission to use every exposed tool. Discovery describes availability. The host must apply current policy, approval, and least privilege before each invocation.

Transfer exercise: Assign ownership for credentials, server discovery, model tool selection, approval, execution, result sanitization, and audit records.

Model Context Protocol — 2026-07-28 specificationThe authoritative modern MCP protocol: stateless requests, per-request metadata, capabilities, and server features.MCP — ToolsNormative tool discovery and invocation contract, input and output schemas, errors, annotations, and safety requirements.OpenAI — MCP and ConnectorsOfficial Responses API integration for remote MCP servers, connectors, authorization, and tool approvals.

Optional referenceDeep dive / reference chapterOpen the complete essay, diagrams, mathematics, exercises, glossary, and sources when you want more depth.on demand

Next: With roles separated, the next lesson distinguishes tools, resources, and prompts by their actual contracts.