MCP Server Development
Parent: AI & LLM Engineering · Published reference · snapshot 2026-09-08 · skill ai-mcp-sdk-prompting/references/mcp-servers.md
↓ Facts as markdownall context files
MCP uses JSON-RPC 2.0 with a three-layer model: Host (AI application) → Client (stateful session manager) → Server (exposes tools, resources, prompts).
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Architecture
- MCP uses JSON-RPC 2.0 with a three-layer model: Host (AI application) → Client (stateful session manager) → Server (exposes tools, resources, prompts). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#architecture]
stdio
- Communication via stdin/stdout of a child process [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#stdio]
- Zero network overhead, inherently single-client [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#stdio]
- Default for local developer tools and desktop integrations [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#stdio]
Streamable HTTP (introduced March 2026, replaces deprecated SSE)
- POST for client→server requests [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#streamable-http-introduced-march-2026-replaces-deprecated-sse]
- GET for SSE notifications (server→client) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#streamable-http-introduced-march-2026-replaces-deprecated-sse]
- DELETE to terminate sessions [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#streamable-http-introduced-march-2026-replaces-deprecated-sse]
Security: OAuth 2.1 + PKCE
- Mandatory for public remote MCP servers since November 2025. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#security-oauth-21-pkce]
- Resource indicators (RFC 8707): bind tokens to one server - blocks cross-server replay [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#security-oauth-21-pkce]
- Refresh rotation: for public clients, rotate refresh tokens on each use [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#security-oauth-21-pkce]
- NEVER forward client tokens to backend services [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#security-oauth-21-pkce]
Best practices checklist
- [ ] Zod/Pydantic input validation - never trust raw LLM arguments [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#best-practices-checklist]
- [ ] Health checks for production deployments [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#best-practices-checklist]
- [ ] OAuth 2.1 + PKCE for any public-facing remote server [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#best-practices-checklist]
- [ ] Streamable HTTP (not deprecated SSE) for all new remote servers [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#best-practices-checklist]
- [ ] Structured logging and telemetry for production observability [archived source: https://llms-explorer.com/sources/mdb-context-hub/mcp-servers/#best-practices-checklist]
Where this helps
- Deciding which MCP transport to use for a new server — stdio for local developer tools and desktop integrations, Streamable HTTP for a remote, multi-client server. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Securing a public-facing remote MCP server, where OAuth 2.1 + PKCE has been mandatory since November 2025 and resource-indicator binding (RFC 8707) is needed to block cross-server token replay. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Migrating an existing SSE-based remote MCP server to the current Streamable HTTP transport introduced in March 2026. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Reviewing a new MCP server before shipping it, using the pack's best-practices checklist — input validation, health checks, OAuth, structured logging — as a concrete gate. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Project ideas
- Build a local stdio-based MCP server for a personal developer tool, taking advantage of its zero network overhead and single-client simplicity. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Build a remote MCP server on Streamable HTTP with POST for requests, GET for SSE notifications, and DELETE for session termination, replacing an older SSE-only implementation. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Wire OAuth 2.1 + PKCE into a public remote MCP server, including resource-indicator token binding and refresh-token rotation for public clients. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Add Zod or Pydantic input validation on every tool so the server never trusts raw LLM-generated arguments directly. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Antipatterns
- Forwarding a client's OAuth token to a backend service instead of minting a scoped token for that service — the pack's security guidance explicitly forbids forwarding client tokens downstream. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Building a new remote MCP server on the deprecated SSE transport instead of Streamable HTTP, which replaced it as of March 2026. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Skipping resource-indicator binding (RFC 8707) on tokens, which leaves a public server exposed to cross-server token replay. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Trusting raw LLM tool-call arguments without schema validation, on the assumption that a well-behaved client won't send malformed input. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Known issues
- This pack's content is a compressed checklist rather than a full protocol reference — it names the requirements (OAuth 2.1 + PKCE, Streamable HTTP, structured logging) without walking through implementation, so building a compliant server still requires the fuller MCP spec. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Refresh-token rotation is specified here for public clients only; confidential clients follow a different rotation posture that this pack doesn't spell out. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- stdio's zero-network-overhead simplicity comes at the cost of being inherently single-client — it's the wrong transport the moment more than one client needs to talk to the same server instance. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Children
- MCP Server Builder Patterns
- Plaud MCP Integration
- JSON-RPC 2.0 Architecture (frontier)
- MCP OAuth 2.1 Security (frontier)
- Sampling and Elicitation (frontier)
- MCP Deployment (frontier)
Frontier under this node: JSON-RPC 2.0 Architecture, MCP Deployment, MCP OAuth 2.1 Security, Sampling and Elicitation