MCP Best Practices

A security-first portfolio demonstrating Model Context Protocol expertise through original working code, threat models, and teaching material.

Spec

The current MCP revision is 2026-07-28 (final 2026-07-28). The default examples run on stable FastMCP 3.4.x (implementing through the prior 2025-11-25 semantics); a labeled preview rides the FastMCP 4.0 beta line for the stateless core. See Spec Currency.

Live demo: the exam-prep quiz app runs at mcp-exam-quiz-production.up.railway.app.

Tracks

The portfolio is built in this order, security first:

1. Security (flagship) : policy gateway (allowlist, consent, rules, rate limit, audit), guardrails, Ed25519-signed registry, threat models, OAuth demo, composed capstone.
2. Fundamentals : FastMCP and TypeScript servers, a minimal client, conformance-style tests.
3. Tooling : tool design, an eval harness, an elicitation human-in-the-loop confirmation demo, structured output.
4. Architecture : multi-server orchestration, stateless vs stateful, a self-hosted registry.
5. Use cases and ecosystem : a production-style server, an MCP plus A2A seam demo, an ecosystem map.
6. Exam prep : a researched curriculum and the live Railway quiz app.

Start here

• Build Plan : the approved, sequenced plan and the locked stack.
• Spec Currency : the current 2026-07-28 spec and the FastMCP 3.4.x / 4.0-beta split.
• Founding Report : the research this is built on.
• Exam Curriculum : the ordered body of knowledge and blueprint.