Course
Building Scalable Agentic Systems
1 hr 30 min
16K
A year and a half ago, the Model Context Protocol was still a niche term outside Anthropic. Now it shows up in interviews for AI engineering, developer relations, and backend roles because many teams shipping agents have an MCP server or client somewhere in the stack.
MCP (Model Context Protocol) is an open protocol that standardizes how AI applica tions connect to external tools, data, and prompt templates. It solves the N x M integration problem: without a shared protocol, each model-tool pairing needs its own connector. With MCP, you build the connector once and any compliant host can use it. You may hear it called "the USB-C of AI," which works as a first explanation and not much further.
What interviewers ask depends heavily on the role. A junior developer might need to explain tools versus resources. A platform engineer is more likely to get asked how a stateless protocol core changes deployment. I've organized the guide by difficulty and use case, so focus on the sections that match your role.
Timing matters here, and I am being explicit about it because MCP is still changing. As of this writing, the current stable spec is 2025-11-25. A release candidate for 2026-07-28 is locked and due to ship in about four weeks, so anything from that RC is labeled as future-facing.
Beginner MCP Interview Questions
These come up in many screens, regardless of seniority. I would start with the vocabulary.
What is MCP and why was it created?
MCP is an open standard, originally built by Anthropic and open-sourced in November 2024, for connecting AI applications to external tools and data sources. Put more directly: implement MCP once, and you can talk to any MCP-compatible server instead of writing a new connector for every tool.
What is an MCP server?
A server is a program that exposes tools, resources, and prompts to an MCP client. It can run as a local subprocess over stdio or as an independent remote process reachable over HTTP. The server does not know anything about the model itself; it answers requests according to the protocol.
What is an MCP client?
The client is the protocol-level connector that lives inside a host application (think Claude Desktop, VS Code, or Cursor) and talks to one server at a time over JSON-RPC. A single host can run multiple clients, each holding its own one-to-one connection to a server.
How is MCP different from a regular REST API?
A REST API is written for developers to call from code. MCP is built for an LLM to discover and call at runtime. That distinction matters more than the wire format. A client can ask a server tools/list and get a structured description of available capabilities, something a typical REST API does not offer by default. For one simple integration, a direct API call is often faster and cheaper.
What kinds of resources can a server expose?
Anything addressable by a URI: files, database records, documents, configuration values, API responses. Resources are read-only context, not actions, which is a common beginner mix-up.
Core MCP Concepts Interview Questions
Once the vocabulary is solid, interviewers shift to how the pieces talk to each other.
What's the high-level architecture?
Three roles: host, client, server. The host is the application a person uses. It instantiates one or more clients, and each client holds a single connection to a server. Every message between client and server is JSON-RPC 2.0, which gives you a stable wire format regardless of transport.
What are the three lifecycle phases of a connection?
Initialization, operation, and shutdown. During initialization, the client sends its supported protocol version and capabilities, and the server responds with its own. Once both sides agree, normal requests like tools/list and tools/call happen in the operation phase. Shutdown is just a clean close.
What transports does MCP use today?
stdio for local, subprocess-based servers, and Streamable HTTP for remote servers. Streamable HTTP replaced the older HTTP-plus-SSE transport in the 2025-03-26 spec, so describing two separate SSE endpoints is already out of date.
What's the actual difference between tools, resources, and prompts?
This distinction is about control, not data type:
- Tools are model-controlled. The LLM decides when to call one based on context.
- Resources are application-controlled. The host or user decides when to load one.
- Prompts are user-controlled. A person explicitly selects a template before inference starts.
Many candidates define these by what kind of data they carry, which misses the point.
MCP Tools, Resources, and Prompts Interview Questions
Once the control model is clear, the next question is what these primitives look like in practice.
What does a tool definition include?
A name, a description, an inputSchema written in JSON Schema, and since the 2025-06-18 spec, an optional outputSchema plus annotations that describe behavior such as whether a tool is read-only or destructive. Clients should treat annotations as untrusted unless they come from a trusted server. They are hints, not guarantees.
When should something be a tool instead of a resource?
If it has a side effect or needs a fresh, live computation, it's a tool. If it's static or semi-static reference data with no side effects, it's a resource. A weather lookup against a live API is a tool. A cached list of supported cities is a resource.
What makes a good MCP tool, beyond just working?
Design it around what the user is trying to get done, not around the endpoints you happen to have. A tool should wrap a complete workflow, not a single raw API call. Its description also matters: that text goes into the model's context and affects whether the model picks the right tool. Here is a minimal example with the Python SDK's FastMCP layer:
from mcp.server.fastmcp import FastMCP
app = FastMCP("weather-demo")
@app.tool()
async def get_weather(city: str) -> str:
"""Get the current weather for a city."""
return f"Weather data for {city}"
@app.resource("config://units")
async def get_units() -> str:
"""Static configuration for the unit system in use."""
return '{"temperature": "celsius"}'The tool's docstring becomes its description; the resource is static data behind a URI, no side effects.
How does a client retrieve a resource?
It calls resources/read against a URI it got from resources/list. If the server supports the listChanged capability, it can notify the client when the resource list changes. Without that capability, the client has no signal and has to poll or refresh manually.
MCP Server Development Interview Questions
This is where conceptual knowledge has to turn into something that runs.
What official SDKs exist, and are they all equally mature?
No. SDKs are tiered: TypeScript, Python, C#, and Go sit in Tier 1 with full feature support, Java and Rust are Tier 2, and Swift, Ruby, PHP, and Kotlin are Tier 3. The Python SDK includes FastMCP, its decorator-based server API.
What's the most common bug that breaks a local server?
Writing to stdout when you shouldn't. A stdio transport uses stdout exclusively for JSON-RPC messages, so a stray print() or console.log() call corrupts the message stream and the client's parser chokes on it. Anything you want logged for debugging has to go to stderr instead.
MCP Inspector showing tool and resource. Video by Author.
How does error handling work in MCP, and why does it matter for interviews?
There are three tiers. Transport-level failures are connection problems. Protocol-level errors use standard JSON-RPC codes (-32700 for a parse error, -32600 through -32603 for invalid requests, unknown methods, and similar issues). Application-level failures, such as an API call inside your tool returning an error, should come back with isError: true in the tool result so the model can see and react to them.
return {
"content": [{"type": "text", "text": "Rate limit exceeded, try again later"}],
"isError": True
}That flag lets the model see the failure and try something different.
Is MCP stateful right now?
Yes, sessions today are tracked at the connection level. This creates scaling problems for production teams, which I will cover in the system design section.
MCP Security and Governance Interview Questions
Security questions now come up in many MCP interviews, especially for platform and enterprise roles.
How does authentication differ between stdio and HTTP transports?
For local stdio servers, authentication is optional in practice; you are already trusting whatever process you launched. For HTTP-based remote servers, OAuth 2.1 is the framework, and servers are classified as OAuth 2.0 resource servers as of the 2025-06-18 spec. OAuth is not required everywhere in MCP.
What is tool poisoning?
It is malicious instructions hidden inside a tool's metadata, usually the description or schema, that the model reads while deciding which tool to call. The tool does not need to be invoked for this to matter, because the model already saw the instructions when the tool was listed.
How is a rug pull attack different from tool poisoning?
Tool poisoning is an entry-point problem. A rug pull is a persistence problem: a tool looks clean when you approve it, then its definition changes afterward, and most clients have no built-in way to force re-approval. Defending against one does not defend against the other.
What is Enterprise-Managed Authorization, and why does it matter right now?
EMA is an MCP extension that went stable on June 18, 2026. It moves the authorization decision to the organization's identity provider instead of a per-server consent click from each employee. The client gets a signed Identity Assertion JWT during single sign-on and exchanges it for a scoped access token from the server's authorization server. Anthropic, Microsoft, and Okta support it.
MCP and AI Agent Interview Questions
This is where the protocol starts to connect with agent design.
Why does MCP matter for agents specifically?
Agents need context and action. MCP puts both inside one protocol. As mentioned earlier, tools/list lets an agent discover what is available instead of relying on a hardcoded list in the agent's code.
Agent host, client, and server model. Image by Author.
What's the difference between MCP and A2A?
The short rule is: MCP connects agents to tools, A2A connects agents to other agents. Both protocols now sit under the Agentic AI Foundation, so they are usually discussed as separate layers, not competitors.
What is the sampling primitive, and should I still mention it?
Sampling lets a server request a model completion through the client, which is how a server can run agent-like behavior without holding API keys. Know the primitive, but add the caveat: the 2026-07-28 RC marks Sampling, Roots, and Logging as deprecated under the new feature lifecycle policy. They stay functional for at least twelve months, but server authors are increasingly told to call a model provider's API directly instead.
How do agents avoid blowing up their context window with tool definitions?
By not loading every tool definition upfront. Anthropic's Tool Search approach defers loading tool schemas until they are needed, and the engineering writeup reports an 85% reduction in token usage for tool-heavy setups while keeping the full tool library reachable. In an interview answer, I would pair deferred loading with narrowly scoped servers.
MCP System Design Interview Questions
Scenario questions test whether you can apply these ideas under constraints, not just recite definitions.
Design a document retrieval system using MCP.
MCP and RAG are not competing here. RAG handles pre-indexed vector retrieval; MCP exposes that retrieval as a tool or resource the agent can call live, alongside whatever other actions the agent needs. Treat the question as how the two pieces fit together, not which one replaces the other.
Design an MCP server for internal company data.
Start from single responsibility: one server per domain, such as a database server and a separate file server, instead of one server doing everything. Add OAuth 2.1, least-privilege scopes per tool, and audit logging from the start, because access control is harder to fix after a server is live.
How would you scale an MCP deployment today, before the stateless spec ships?
Candidates often trip up by describing the future spec as if it has already shipped. The statefulness from the server section is the scaling issue here: horizontal scaling needs sticky routing, a shared session store, or an MCP gateway. The 2026-07-28 RC removes protocol-level sessions, but that part is not live yet.
How do you keep a large multi-server deployment from drowning the model in tokens?
The deferred loading idea from the agent section helps here too. At the deployment level, also filter and aggregate data server-side before it reaches the model's context, and paginate anything returning a list. The main rule is to control what enters the context window.
MCP Integration Interview Questions
Integration questions check whether you understand where MCP appears in common developer tools.
How does MCP show up across Claude products?
Claude.ai, Claude Desktop, and Claude Code all support MCP, and Anthropic runs a connector directory with pre-built servers. There is also an MCP connector in the Messages API for remote servers, still in beta at the time of writing.
Claude Desktop showing connected MCP server. Image by Author.
Is MCP only useful with Claude?
No. OpenAI adopted MCP across its Agents SDK and Apps SDK starting in March 2025. VS Code shipped support for the full spec in mid-2025, Cursor supports MCP through mcp.json, and Google Cloud had more than 50 managed MCP servers either generally available or in preview by April 2026.
How is MCP different from RAG, concretely?
This is the system design answer in shorter form: RAG answers from a scheduled knowledge base, while MCP handles live lookups and actions.
Advanced MCP Interview Questions
Advanced questions test whether you are tracking the protocol as it changes, not just how it works today.
Can you walk through the spec version history?
Interviewers ask this to see if you know what changed and when. Five revisions matter, and only one is still speculative:
|
Version |
Date |
What changed |
|
2024-11-05 |
Nov 2024 |
Initial release |
|
2025-03-26 |
Mar 2025 |
Streamable HTTP replaces HTTP+SSE; OAuth 2.1 introduced |
|
2025-06-18 |
Jun 2025 |
Structured tool outputs, elicitation, OAuth resource server classification |
|
2025-11-25 |
Nov 2025 |
Current stable spec; async Tasks (experimental), governance formalized |
|
2026-07-28 |
RC locked May 2026 |
Stateless core, MCP Apps, extensions framework |
The key is knowing which row has actually shipped.
Who actually governs MCP now?
Anthropic donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation, on December 9, 2025. Block and OpenAI co-founded the AAIF alongside Anthropic, with Google, Microsoft, AWS, Cloudflare, and Bloomberg as supporting members. The maintainers kept control over technical decisions; governance moved to a broader foundation.
What's actually changing in the 2026-07-28 release?
The main change is the stateless core from the system design section: the initialize/initialized handshake and the Mcp-Session-Id header both go away, replaced by capability information traveling in _meta on every request. That removes the sticky-routing requirement. An extensions framework also defines how optional capabilities like MCP Apps and Tasks ship and stabilize on their own.
What are MCP extensions, and do they all work everywhere?
No. Extensions are opt-in capabilities, like Enterprise-Managed Authorization, OAuth Client Credentials for machine-to-machine auth, and MCP Apps for interactive UI inside a host. Support varies client by client, so do not design around universal extension support.
Scenario-Based MCP Interview Questions
These test diagnostic reasoning more than memorized facts, so structure answers as a path from symptom to cause to fix.
Tool calls fail intermittently. What do you check first?
Check whether the failures come back as isError: true in the tool result or as a protocol-level error. That tells you whether the problem is inside the tool's own logic or the transport. From there, look at rate limits on whatever the tool wraps, and check for timeouts before assuming it is a model problem.
An agent keeps acting on stale resource data. Why?
This goes back to the resource question earlier: listChanged is what tells a client a resource changed. Without it declared, the client has no signal and keeps serving a cached snapshot until something forces a refresh.
One MCP server has become a clear bottleneck. What's your move?
Split along domain lines, add connection pooling, and scale horizontally. Until the stateless core ships, you may still need the session affinity discussed under system design.
Sensitive data leaked out through a tool call. How did that happen?
Two common causes are a tool with broader permissions than it needed, or missing output sanitization before data hit the model's context. Least privilege per tool and a sanitization step before context are the fixes. Tool poisoning is related too: a model can be instructed to forward data without anyone writing exfiltration code.
Common Mistakes in MCP Interviews
A few patterns come up often enough to call out directly:
-
Treating MCP as a drop-in REST replacement after the REST distinction covered earlier
-
Defining tools versus resources by data type after the control model has already been explained
-
Assuming the same auth rule applies to
stdioand HTTP -
Giving the legacy SSE answer after the transport change covered earlier
-
Mixing the shipped spec with the 2026-07-28 RC
-
Skipping the security risks covered above when asked to design a tool-calling system
Most of these mistakes come from older tutorials.
How to Prepare for MCP Interviews
Hands-on practice matters for this protocol.
-
Build a small server with FastMCP or the TypeScript SDK, expose one tool and one resource, and get it running
-
Install the official Inspector (
npx @modelcontextprotocol/inspector) and look at the raw JSON-RPC traffic it shows you -
Connect your server to a real client, Claude Desktop, VS Code, or Cursor, and watch the initialization handshake happen
-
Read the actual spec changelog instead of a secondhand summary, especially the 2025-06-18 and 2025-11-25 entries
-
Pick one system design scenario from this article and write a full answer before your interview
These steps separate definition-level knowledge from hands-on familiarity.
Conclusion
I do not think memorizing MCP definitions is enough anymore. The harder part is knowing which answer belongs to which spec version. Current deployments still deal with connection-level sessions; the 2026-07-28 RC points to a stateless core. If you blur those two, your architecture answer sounds more confident than accurate.
That is why I would treat MCP as something to test, not just read about. Build the small server from the preparation section, watch a client list tools and read resources, and pay attention to where the protocol ends and your application design begins. The useful interview answer is not "MCP is the USB-C of AI." It is "here is what MCP standardizes, here is what it does not, and here is what changed recently."
For a more structured follow-up, our Building Scalable Agentic Systems course covers MCP and A2A in the context of agent design, testing, and deployment.
Do I need to memorize every spec version date?
Sampling is getting deprecated. Is it still worth learning?
Which SDK should I start with if I've never touched MCP?
Will MCP still matter once the 2026-07-28 spec ships?
How technical do beginner-level MCP interviews actually get?
Topics
