Unit 02 of 02
Implementation
Writing, connecting and assessing a fictional server and client for security: the number of negotiated tools and failed calls at four declaration levels, the request, response and token cost of server discovery and the tool dropped by version skew producing no error and so becoming visible only through counting, the round trips, envelope tokens and number of messages until the first call on a local process connection, the identity and authorization step a remote connection adds, read side by side with the local setup, how many definition lines and how many messages are paid again when the same server definition is attached to a second client, and the number of names outside the allowlist, side-effecting tools and suspicious patterns in the definitions an untrusted server declares, along with the findings the declaration audit catches and that also appear on trusted servers.
Published Updated
Lessons
- 01 Writing a Server Separating a server's handlers from its capability declaration and measuring the completeness of the declaration as callability: when the same three fictional servers and the same twelve tasks are run at four declaration levels, the cost of the handshake is 3 requests, 3 responses, 99 tokens and 5 round trips at all four levels, and the only thing that changes is what those three responses leave in the client's hands. At the level that declares only names, the negotiated tools number four but, because the client cannot fill in fields, 12 of 12 calls fail and the completed tasks are zero. Once fields are declared, calls rise to 30 and completed tasks to 9. Declaring the side effect moves no number on this allowlist. Declaring the version drops the negotiated tools from 4 to 3, lowers the completed tasks to 6 and pulls the envelope tokens from 816 to 744: the most complete declaration gives the smallest tool set. When the allowlist is widened to accept kayit_yaz, three write calls whose side effect is undeclared pass silently; when it is declared, the same three calls are stopped at the approval gate. 12 min read
- 02 Writing a Client Writing server discovery and session management on the client side, and counting both the cost of discovery and the silence of version skew: discovery against three fictional servers costs 3 requests, 3 responses, 99 tokens and 5 round trips, and these four numbers are exactly the same whether the kayit server is dropped entirely by version skew or not. While the same twelve tasks run in a single session with 27 requests and 744 tokens, renewing discovery at every task raises the requests to 60 and the tokens to 1833, of which 1188 go to discovery. For a client that has learned the version, the negotiated tools rise from 3 to 4 and the completed tasks from 6 to 9. On a task set with no region tasks, however, the skewed client and the current client produce exactly the same thing, 12 completed tasks, 33 requests, 33 responses, 909 tokens and 41 round trips: the dropped tool produces no error at all, and the only thing that makes the loss visible is printing the 5 declared, 3 negotiated and 2 dropped side by side at session open. 3 min read
- 03 Connecting to a Local Server Starting a local server as a separate process and counting the cost of the connection as the messages that pass before the first call: starting the process costs 1 message and 10 tokens with its ready notification, server discovery costs 6 messages and 99 tokens, so 7 messages and 109 tokens are spent before the first tool call is sent. The three-tool chain that runs after the same setup yields 844 for subscriber A017 with 3 requests, 3 responses, 80 tokens and 4 round trips; in a single-task session the setup costs more than the work. Over twelve tasks the setup stays at 7 messages while the work rises to 60. When the process drops, neither an error nor a message is produced, the loss is noticed only when the next call cannot be sent, and recovery makes the whole setup be paid again: one drop raises the tokens from 919 to 1028, three drops to 1246, and the completed tasks stay at twelve. 4 min read
- 04 Connecting to a Remote Server Counting the step a connection adds when the server moves beyond the network: the same three-tool chain pays 6 requests, 6 responses, 179 envelope tokens and 6 round trips when all three servers are on the same machine; when two servers move to remote transport the round trips rise to 9 with the message count unchanged, and when one identity step and one authorization step are added per remote server the count climbs to 10 requests, 10 responses, 289 tokens and 17 round trips. The negotiated tool set is three tools in all three setups and the result is the same in all three; of the 110 added tokens, 64 are only the envelope constant. The measure is independent of the run: the count comes out identical for three separate subscribers. 3 min read
- 05 Integrating with Development Tools Counting the cost of plugging the same server into a second client: the definition of the three-tool chain is 24 lines, and in the setup without the protocol every client carries these 24 lines again, 96 lines at four clients; in the setup with the protocol the definition stays at 24 lines in one place, but every client pays 10 requests, 10 responses, 289 envelope tokens and 17 round trips, 40 requests and 1156 tokens at four clients. The marginal cost of the second client is 0 definition lines and 20 messages. When the interface changes, the setup without the protocol rewrites 52 lines at four separate points at four clients, the setup with the protocol rewrites 13 lines at a single point. With a single client the protocol is pure cost. 3 min read
- 06 Security Assessment Counting, on the defense side, the definitions declared by an untrusted server: three declared definitions give six audit findings (not allowed 2, side effect 1, suspect pattern 3), and the same audit produces 2 findings on the three trusted servers as well. The allowlist alone stops two of the three definitions; the third passes because it carries a name on the allowlist, and it shadows the same-named tool of a trusted server. The suspect filter removes the shadowing but lowers the negotiated tools from 3 to 2 and breaks the chain; the zero-finding gate removes the shadowing and eliminates a trusted server without it even appearing in the dropped list. The lesson is the wrap-up of The Model Context Protocol and Tool Ecosystem course and gathers the without-protocol and with-protocol numbers of eleven lessons in a single table. 3 min read