MCP & Tool Use Protocol

Why tools matter

An LLM without tools is a text generator. With tools, it becomes an agent that can:

• Query your database ("how many failed orders today?")
• Read Jira/Linear tickets
• Run terminal commands (tests, builds, deploys)
• Search the web for current docs
• Create PRs, post Slack messages, update configs

Tool use is the bridge from "AI assistant" to "AI that does work."

Tool use fundamentals

All major providers implement the same pattern:

1. Define tools with JSON Schema (name, description, parameters) 2. Send tools list with prompt 3. Model returns tool_call (name + arguments) instead of text 4. Your code executes the tool 5. Send tool result back to model 6. Model continues (more tool calls or final answer)

The model chooses which tool to call based on descriptions. Bad descriptions = wrong tool selection.

Description quality is prompt engineering for tools. Be explicit about when to use and when NOT to use each tool.

Model Context Protocol (MCP)

MCP is an open standard (Anthropic, adopted broadly) for connecting AI clients to external data and tools via servers:

AI Client (Cursor, Claude Desktop) ←→ MCP Server ←→ Your System (DB, API, filesystem)

MCP primitive	Purpose	Example
Tools	Actions the model can invoke	run_query, create_ticket, deploy
Resources	Read-only data the model can fetch	file://config.yaml, db://schema
Prompts	Pre-built prompt templates	"Review this PR" with injected context

Transports

Transport	How	Use case
stdio	Local process, stdin/stdout	IDE integrations, local dev tools
SSE/HTTP	Remote server, event stream	Shared team servers, cloud services

Cursor supports both. Most IDE setups use stdio for local servers.

Stateless RC (2026-07-28): what changed

The July 2026 MCP release candidate introduces stateless server mode:

• Before: MCP servers could hold session state between tool calls (connection-scoped)
• After (RC): Servers can declare themselves stateless — each tool call is independent, no session affinity required

What this means for engineers:

Impact	Detail
Simpler deployment	Stateless servers scale horizontally; no sticky sessions
Cloud-friendly	MCP servers can run as serverless functions or k8s pods
Less magic	Each call must carry all needed context; no "remember what I said last call"
Durable concept	Tool design should be stateless anyway — session state was always fragile

Don't over-index on the RC details. The durable lesson: design tools as idempotent, self-contained operations with explicit parameters. Whether the server is stateful or stateless, your tools should work the same way.

Tool design principles

Principle	Why
Idempotent when possible	Agent may retry; get_user(id) not increment_counter()
Narrow scope	One tool = one action. Not manage_database
Explicit parameters	No implicit state; everything the tool needs is in the call
Safe defaults	Read-only by default; write operations require confirmation
Descriptive errors	Return actionable error messages the model can act on
Rate limit	Agent loops can hammer APIs; add backoff

Security model

MCP servers run with your credentials. The agent inherits whatever the server can access:

• Scope API keys minimally (read-only DB user for query tools)
• Never expose prod write access without human approval gate
• Audit tool calls (log who/what/when)
• Validate tool arguments server-side — don't trust the model's JSON

Parallel tool calls

Modern models can request multiple tools in one turn:

User: "What's the error rate and who is on call?" Model: [call metrics_api, call pagerduty_api] in parallel

Design tools to be independently callable. Avoid tools that depend on side effects from a prior call in the same turn.

Interview framing

"MCP standardizes how AI clients connect to external tools via a client-server protocol. I design tools as narrow, idempotent operations with explicit schemas. The stateless RC direction reinforces what was already best practice: tools carry their own context, no hidden session state."

Senior signal: Draw the MCP client-server diagram. Explain why tool descriptions matter as much as tool implementations. Mention credential scoping and audit logging.