MCP (Model Context Protocol) Interview Questions (2026): 14 Questions

A 5-step way to answer any MCP question

Place it. Say which side you mean: host application, client or server.
Name the primitive. Tools, resources or prompts, and who controls each.
Explain the flow. Discovery, call, result, all over JSON-RPC messages.
Address security. Permissions, authentication, untrusted results and user consent.
Compare. When MCP is worth it versus direct function calling.

Contents: Basics (questions 1 to 4) · Design (questions 5 to 8) · Security and operations (questions 9 to 14)

Basics (questions 1 to 4)

1. What is the Model Context Protocol?

An open protocol that standardizes how AI applications connect to external tools, data and prompts.
It was introduced by Anthropic in November 2024 and has been adopted by many clients and tools.
It replaces one-off integrations with a common interface: build a server once, use it from any compatible client.
Messages use JSON-RPC 2.0.

Common pitfall: Describing MCP as a model or a specific vendor API.

2. What are hosts, clients and servers in MCP?

The host is the AI application the user interacts with, such as a chat app or IDE.
The host runs MCP clients, each holding a connection to one server.
Servers expose capabilities such as tools, resources and prompts.
This separation lets the host control which servers are connected and what is shared.

Common pitfall: Confusing the MCP client with the end user's browser.

3. What are tools, resources and prompts?

Tools are functions the model can call to take actions or fetch data, typically model-controlled.
Resources are data such as files or records that the application can read and add to context, typically application-controlled.
Prompts are reusable templates or workflows, typically user-controlled.
Each has discovery methods so the client can list what a server offers.

Common pitfall: Treating every capability as a tool.

4. What transports does MCP support?

stdio for local servers launched as a subprocess.
Streamable HTTP for remote servers. It was introduced in the 2025-03-26 spec revision and replaced the older HTTP+SSE transport. The old HTTP+SSE transport is deprecated, though some implementations still support it for backward compatibility.
The transport carries JSON-RPC messages; the protocol logic is the same.
Authorization is optional in the spec; when used over HTTP, the spec defines an OAuth 2.1-based flow. The spec is versioned by date and keeps evolving, so check the current revision.

Common pitfall: Assuming MCP only works for local tools.

Design (questions 5 to 8)

5. How is MCP different from function calling?

Function calling is a model API feature: the model outputs a structured call that your code executes.
MCP is a protocol for discovering and invoking tools and data across applications.
In practice, a host often converts MCP tool definitions into the model's function-calling format.
MCP adds reuse across clients; direct function calling is simpler for a single app.

Common pitfall: Saying MCP replaces function calling.

6. When would you build an MCP server instead of a direct integration?

When the same tool or data source should work across several AI clients.
When third parties or other teams need to plug in without changing the host.
A direct integration is simpler for one app with a few internal functions.
Consider the operational cost of running and securing another service.

Common pitfall: Wrapping every internal function in a server with no reuse need.

7. How do you design good MCP tools?

Clear names and descriptions that tell the model when to use each tool.
Narrow, typed input schemas and concise, structured outputs.
Return actionable error messages the model can recover from.
Avoid huge outputs that flood the context window; paginate or summarize.

Common pitfall: Exposing a raw API with dozens of vague parameters.

8. How does a client discover what a server can do?

After initialization and capability negotiation, the client calls list methods such as tools/list.
Each tool comes with a name, description and JSON Schema for inputs.
Servers can notify clients when their lists change.
The host decides which tools to expose to the model.

Common pitfall: Hard-coding tool definitions in the client.

Security and operations (questions 9 to 14)

9. What are the main security risks with MCP?

Prompt injection through tool descriptions or tool results.
Malicious or compromised servers requesting excessive data or performing harmful actions.
Over-broad credentials and missing user consent for sensitive actions.
Mitigate with trusted server lists, least-privilege scopes, approvals and logging.

Common pitfall: Assuming tool results are trustworthy because the server is internal.

10. What is tool poisoning?

A tool's description contains hidden instructions that steer the model, for example to read secrets.
The user may not see the full description.
Review descriptions, pin versions and alert on changes.
Limit what any single tool can access.

Common pitfall: Never re-reviewing a server after it updates.

11. How should authentication work for remote MCP servers?

Follow the spec's OAuth 2.1-based authorization for HTTP servers so users grant scoped access without sharing passwords.
Tokens should be scoped to the server and the minimal permissions.
Do not pass a user's token through to unrelated downstream services.
Support revocation and expiry.

Common pitfall: Hard-coding a shared admin token in the server.

12. How do you test an MCP server?

Unit test each tool's logic and input validation.
Use an inspector or test client to exercise the protocol messages.
Run end-to-end evaluations where a model must choose and use the tools on realistic tasks.
Test error paths and large outputs.

Common pitfall: Testing only that the server starts.

13. How do you handle long-running or expensive tools?

Return quickly with progress notifications or a job handle when the spec and client support it.
Set timeouts and budgets on the host side.
Make operations idempotent so retries are safe.
Cache results that are reused.

Common pitfall: Blocking the agent loop on a slow call with no timeout.

14. How would you roll out MCP in a company?

Start with read-only servers for high-value internal data.
Maintain an approved server registry and central logging.
Add write actions with approvals and narrow scopes later.
Measure task success and incidents before expanding.

Common pitfall: Allowing any employee to connect any public server to production data.

Go deeper on related questions

FAQ

Is MCP only for Anthropic models?

No. It is an open protocol, and clients from several vendors and open-source projects support it.

Do I need to know the full spec?

Know the architecture, the three primitives, transports, JSON-RPC and the security risks. Details of every message type are rarely asked.

Is MCP the same as an agent framework?

No. MCP connects applications to tools and data; agent frameworks orchestrate the reasoning loop. They are often used together.

How do I prepare?

Build a small MCP server with one tool and one resource, connect it to a client and test what happens with bad inputs.

The PlaybookWant the full method?

The 0 to 1 AI Engineer Interview Playbook covers answer frameworks, system-design walkthroughs and an 8-week plan. $19.99 on Gumroad.

Get the playbook

All interview topics · Prep guides · Question deep dives · Free 50 RAG and LLM questions