AI Learning Hub › Learn AI › Self-Paced Courses › MCP Without the Mystery
Course ยท Beginner to intermediate
MCP Without the Mystery
A hands-on guide to how AI connects to tools and information
First, ignore the “Protocol” in Model Context Protocol.
A protocol is just an agreement about how two programs talk to each other. You do not need to read the agreement to understand what it makes possible.
Here is the idea. On its own, an AI application has only what it was trained on and what you type into it. It cannot look anything up in your systems, and it cannot do anything outside the conversation.
MCP is a standard way for an AI application to discover and use capabilities provided by another system. Something else — a calendar, a catalog, a document store, a service desk — describes what it can offer, and the AI application can then find those offerings and use them.
Depending on what the other system chooses to offer, an AI application connected through MCP may encounter:
- information it can read — documents, records, or reference material;
- tools it can call — specific operations the other system will perform on request;
- structured prompt templates — suggested wording the other system provides for common requests; and
- actions that may change something — if, and only if, that system chose to offer them.
Not every connection offers all four, and many offer only one. A connection that can only read is a very different thing from a connection that can also book, send, edit, or delete, and telling those apart is a skill worth having.
MCP does not decide whether an action is safe. The protocol is a way of describing and reaching capabilities. It does not judge them. Whether a particular capability should be connected, and who should be allowed to use it, remains a human decision.
The question is not “what can AI do?” It is “what has this connection been given access to, and who decided that?”
What this course promises
You do not need to build an MCP server before you can understand one. This course begins by inspecting a safe practice server from the outside, looking at what it says it can do before any AI model is allowed to use it. You will gradually learn to answer:
- What is connected?
- What does it expose?
- What information can it read?
- What actions can it take?
- What requires input?
- What could change something?
- What should I verify before trusting the result?
The emphasis is understanding and supervision rather than protocol engineering, and you will not be asked to write code. The first six modules use a fictional server on your own computer, with no AI model involved. The later modules look at how Stanford’s managed AI environments present these connections, what happens when a model selects a tool, and what stands between a proposed action and a real one. A capstone then asks you to evaluate a connection you have never seen.
Format
Ten modules and a capstone, each on its own page. Each introduces only the vocabulary the next step needs.
Time
Module 1 takes 30–45 minutes including the one-time setup. The hands-on modules after it are shorter, and the last four are read-through.
Written for
Students, faculty, and staff at Stanford Law School. No programming background is assumed.
What you need
Node.js 22.19.0 or newer, a terminal (we give you every command), and the practice server below. No account, API key, or AI subscription: Module 1 involves no AI model at all.
The rule throughout: inspect → understand → then decide what may be used. Look at a connection before you delegate anything through it.
For SLS work, pause before you begin. Do not connect an AI application to sensitive or confidential systems unless the tool and the use are authorized. Students: check your course policy first.
MCP evolves quickly. This course teaches the durable concepts and verifies the current interfaces used in the exercises. Labels and available capabilities may change over time.
Before you begin
Get the practice server
We will all use the same small practice server: the Practice Resource Desk. It is a fictional service invented for this tutorial. It is not a Robert Crown Law Library system, and none of the five resources it lists exist.
Everything it does happens on your own computer. It makes no network requests once it is installed, reads no file outside its own folder, writes nothing, and needs no account or password.
- Download the practice server. Download the ZIP file below.
- Unzip it. Your computer will create a folder named
mcp-practice. Move it somewhere easy to find, such as your Documents folder or Desktop. - Do not open anything yet. Module 1 walks through the setup.
No account, API key, or AI subscription is required.
The course
-
Module 01 · Beginner
Meet MCP
Open the fictional practice server in MCP Inspector and identify what it exposes, separating inspection from action before any AI model is involved.
Start module -
Module 02 · Beginner
Use Your First Tool
Inspect what a tool says it does, identify the input it expects, then call a read-only tool by hand and examine what comes back.
Start module -
Module 03 · Beginner
Read a Resource
What separates a resource from a tool: identify one by its URI, read it through Inspector, and see that it need not be a webpage or a file.
Start module -
Module 04 · Beginner
Use a Server-Provided Prompt
Supply a required argument, retrieve the resulting prompt content, and see why retrieving a prompt does not itself run an AI model.
Start module -
Module 05 · Beginner
Understand What a Tool Accepts
Why Inspector knows what input a tool expects: read a schema as a description of structure, and watch validation reject input that does not match.
Start module -
Module 06 · Beginner
Read Is Not Write
Tell a read-only tool from one that changes something, use a tightly bounded local write tool, and verify what actually changed afterward.
Start module -
Module 07 · Intermediate
When the Host Sets the Boundary
Why a managed environment may expose only certain connections, and why the local practice server cannot simply be added to Stanford's web applications.
Start module -
Module 08 · Intermediate
Let an AI Choose a Tool
What changes when a model can select among exposed tools: a goal rather than an instruction, a tool result as context, and a constraint as a boundary.
Start module -
Module 09 · Intermediate
When the AI Proposes a Write
A proposed tool call is not an executed one. Deny one, approve the same bounded write once, then verify the side effect independently.
Start module -
Module 10 · Intermediate
Supervise the Connection
Inventory what a connection can reach and what it could change, separate server claims from host controls, and decide what questions remain.
Start module