Official docs outline
18 sections- Architecture
Hosts, clients and servers, one client per server connection, JSON-RPC 2.0 messages, design principles and capability layering.
- Base protocol
JSON-RPC requests, responses and notifications, message format, _meta fields, protocol structure.
- Lifecycle and capability negotiation
initialize handshake, protocol version negotiation, capability negotiation, session shutdown and timeouts.
- Versioning and compatibility
Date-based protocol revisions, backward compatibility, version negotiation.
- Transports
Transport layer overview: stdio and Streamable HTTP, message framing, choosing a transport.
- stdio transport
Local servers as subprocesses, newline-delimited JSON-RPC over stdin/stdout, logging to stderr.
- Streamable HTTP transport
HTTP POST/GET endpoint, SSE streaming responses, session IDs, resumability, origin validation.
- Tools
Server-exposed tools: tools/list and tools/call, input/output JSON schema, annotations, structured results, tool errors.
- Resources
Resources identified by URI, resources/list and read, templates, subscriptions and update notifications, MIME types.
- Prompts
Reusable prompt templates with arguments, prompts/list and prompts/get, user-controlled slash-command style workflows.
- Pagination and utilities
Cursor-based pagination for list operations, plus completion, logging and caching utilities.
- Progress, cancellation and subscriptions
Progress notifications with progress tokens, request cancellation, long-running operations, subscriptions to changes.
- Roots
Client-provided filesystem roots that scope where servers may operate.
- Sampling
Servers requesting LLM completions through the client, model preferences, human-in-the-loop approval.
- Elicitation
Servers requesting structured user input mid-operation, form schemas, accept/decline/cancel responses.
- Authorization
OAuth 2.1-based authorization for HTTP transports, protected resource metadata, authorization server discovery, PKCE, tokens and scopes.
- Authorization security considerations
Token audience binding, confused deputy, token passthrough prohibition, redirect URI validation.
- Building servers and clients
Implementing an MCP server and client with SDKs, tool definitions, testing with the MCP Inspector, debugging.
Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.