Model Context Protocol laboratory

What an MCP server actually exposes—and what it does not authorize

The Model Context Protocol standardizes how an AI host can connect to servers that expose tools, resources, and prompts. An MCP server is a protocol endpoint, not a synonym for any one tool it advertises.

The current protocol is stateless: optional server/discover can advertise capabilities, while every primitive request carries its own protocol and client metadata. Read the exact JSON-RPC transcript for tools, resources, and prompts; then deny one grant or break one path without pretending the others disappeared.

MCP servers · Standard transport, explicit consent

Trace: Discover · list · host grant · call/read/get · result
Server primitives: Tools · resources · prompts
Security premise: Connection is not blanket authorization

MCP wire inspectorcompleted

01discovercompleted
Optional server discovery returned supported versions and all three independently advertised server primitives.
02toolscompleted
The client listed tools, the host approved one exact payload, and the server returned typed content.
03resourcescompleted
The client listed resources, the host granted one exact URI, and resources/read returned cache-scoped contents.
04promptscompleted
The client listed user-controlled prompt templates, the host granted one exact payload, and prompts/get returned structured messages.

Host + clientAI Lab ClientOptional discovery · separate grants · context

Stateless JSON-RPC / MCP 2026-07-28 ↔

ServerAcme KnowledgeEvery request is self-described in _meta

Tools2 discovered

search_private_docs

Host grant: approved · tools/call returned

Resources2 discovered

acme-knowledge://policies/support-retention

Host grant: approved · resources/read returned

Prompts1 discovered

draft_policy_brief

Host grant: approved · prompts/get returned

Protocol transcript14 exact envelopes

01client→serverserver/discover

{
  "direction": "client→server",
  "jsonrpc": "2.0",
  "id": 1,
  "method": "server/discover",
  "params": {
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "AI Lab Client",
        "version": "1.0.0"
      },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

02server→clientresult

{
  "direction": "server→client",
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "resultType": "complete",
    "supportedVersions": [
      "2026-07-28"
    ],
    "capabilities": {
      "tools": {
        "listChanged": true
      },
      "resources": {
        "listChanged": true
      },
      "prompts": {
        "listChanged": true
      }
    },
    "instructions": "Use the separate tool, resource, and prompt grants; never treat discovery as authorization.",
    "ttlMs": 300000,
    "cacheScope": "public",
    "_meta": {
      "io.modelcontextprotocol/serverInfo": {
        "name": "Acme Knowledge",
        "version": "2.4.1"
      }
    }
  }
}

03client→servertools/list

{
  "direction": "client→server",
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/list",
  "params": {
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "AI Lab Client",
        "version": "1.0.0"
      },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

04server→clientresult

{
  "direction": "server→client",
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "resultType": "complete",
    "tools": [
      {
        "name": "search_private_docs",
        "description": "Search documents the connected user is authorized to read.",
        "inputSchema": {
          "type": "object",
          "required": [
            "query",
            "limit"
          ],
          "additionalProperties": false,
          "properties": {
            "query": {
              "type": "string",
              "minLength": 3
            },
            "limit": {
              "type": "integer"
            }
          }
        }
      },
      {
        "name": "get_document",
        "description": "Retrieve one authorized document by its opaque identifier.",
        "inputSchema": {
          "type": "object",
          "required": [
            "documentId"
          ],
          "additionalProperties": false,
          "properties": {
            "documentId": {
              "type": "string",
              "pattern": "^doc_"
            }
          }
        }
      }
    ],
    "ttlMs": 120000,
    "cacheScope": "private",
    "_meta": {
      "io.modelcontextprotocol/serverInfo": {
        "name": "Acme Knowledge",
        "version": "2.4.1"
      }
    }
  }
}

05client→servertools/call

{
  "direction": "client→server",
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "search_private_docs",
    "arguments": {
      "query": "support retention policy",
      "limit": 3
    },
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "AI Lab Client",
        "version": "1.0.0"
      },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

06server→clientresult

{
  "direction": "server→client",
  "jsonrpc": "2.0",
  "id": 3,
  "result": {
    "resultType": "complete",
    "content": [
      {
        "type": "text",
        "text": "Found 2 authorized passages."
      }
    ],
    "structuredContent": {
      "matches": [
        {
          "documentId": "doc_policy_17",
          "title": "Support retention policy",
          "passage": "Resolved cases are retained for 365 days."
        },
        {
          "documentId": "doc_policy_22",
          "title": "Deletion exceptions",
          "passage": "Legal holds suspend scheduled deletion."
        }
      ]
    },
    "_meta": {
      "io.modelcontextprotocol/serverInfo": {
        "name": "Acme Knowledge",
        "version": "2.4.1"
      }
    }
  }
}

07client→serverresources/list

{
  "direction": "client→server",
  "jsonrpc": "2.0",
  "id": 4,
  "method": "resources/list",
  "params": {
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "AI Lab Client",
        "version": "1.0.0"
      },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

08server→clientresult

{
  "direction": "server→client",
  "jsonrpc": "2.0",
  "id": 4,
  "result": {
    "resultType": "complete",
    "resources": [
      {
        "uri": "acme-knowledge://policies/support-retention",
        "name": "support-retention.md",
        "title": "Support retention policy",
        "description": "Approved retention periods and legal-hold exceptions.",
        "mimeType": "text/markdown"
      },
      {
        "uri": "acme-knowledge://runbooks/deletion-review",
        "name": "deletion-review.md",
        "title": "Deletion review runbook",
        "description": "Review steps before a scheduled deletion is executed.",
        "mimeType": "text/markdown"
      }
    ],
    "ttlMs": 120000,
    "cacheScope": "private",
    "_meta": {
      "io.modelcontextprotocol/serverInfo": {
        "name": "Acme Knowledge",
        "version": "2.4.1"
      }
    }
  }
}

09client→serverresources/read

{
  "direction": "client→server",
  "jsonrpc": "2.0",
  "id": 5,
  "method": "resources/read",
  "params": {
    "uri": "acme-knowledge://policies/support-retention",
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "AI Lab Client",
        "version": "1.0.0"
      },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

10server→clientresult

{
  "direction": "server→client",
  "jsonrpc": "2.0",
  "id": 5,
  "result": {
    "resultType": "complete",
    "contents": [
      {
        "uri": "acme-knowledge://policies/support-retention",
        "mimeType": "text/markdown",
        "text": "# Support retention\n\nResolved cases are retained for 365 days. Legal holds suspend scheduled deletion."
      }
    ],
    "ttlMs": 60000,
    "cacheScope": "private",
    "_meta": {
      "io.modelcontextprotocol/serverInfo": {
        "name": "Acme Knowledge",
        "version": "2.4.1"
      }
    }
  }
}

11client→serverprompts/list

{
  "direction": "client→server",
  "jsonrpc": "2.0",
  "id": 6,
  "method": "prompts/list",
  "params": {
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "AI Lab Client",
        "version": "1.0.0"
      },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

12server→clientresult

{
  "direction": "server→client",
  "jsonrpc": "2.0",
  "id": 6,
  "result": {
    "resultType": "complete",
    "prompts": [
      {
        "name": "draft_policy_brief",
        "title": "Draft a policy briefing",
        "description": "Create a source-grounded briefing for a named audience.",
        "arguments": [
          {
            "name": "audience",
            "description": "Who will read the briefing",
            "required": true
          }
        ]
      }
    ],
    "ttlMs": 300000,
    "cacheScope": "public",
    "_meta": {
      "io.modelcontextprotocol/serverInfo": {
        "name": "Acme Knowledge",
        "version": "2.4.1"
      }
    }
  }
}

13client→serverprompts/get

{
  "direction": "client→server",
  "jsonrpc": "2.0",
  "id": 7,
  "method": "prompts/get",
  "params": {
    "name": "draft_policy_brief",
    "arguments": {
      "audience": "support managers"
    },
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "AI Lab Client",
        "version": "1.0.0"
      },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

14server→clientresult

{
  "direction": "server→client",
  "jsonrpc": "2.0",
  "id": 7,
  "result": {
    "resultType": "complete",
    "description": "A user-controlled template for a cited policy briefing.",
    "messages": [
      {
        "role": "user",
        "content": {
          "type": "text",
          "text": "Draft a concise briefing for support managers. Cite the approved retention resource and surface legal-hold exceptions."
        }
      }
    ],
    "_meta": {
      "io.modelcontextprotocol/serverInfo": {
        "name": "Acme Knowledge",
        "version": "2.4.1"
      }
    }
  }
}

Primary research

Inspect the mechanism at its source.

Project architecture and terminology were checked against official documentation on August 10, 2026. Research papers are linked to their original publication records.

Current server primitivesMCP server specificationOriginal source ↗Stateless core and per-request metadataMCP 2026-07-28 releaseOriginal source ↗Optional version and capability advertisementMCP server discoveryOriginal source ↗Consent and authorization boundariesMCP security best practicesOriginal source ↗

Keep experimenting

Change the layer, keep the system visible.

AI Lab indexSee every interactive laboratoryBrowse the suite →Transformer microscopeGo beneath the agent runtime into the modelInspect the matrices →