MCP Server Architecture: Protocol Roles, Transports, State and Security (2026)

An MCP server is a versioned protocol endpoint that exposes tools, resources and prompts to an MCP client. The client sits inside (or beside) an AI host and mediates what the application can discover and invoke. The server owns protocol handling, validation, authorization and downstream integrations; MCP does not prescribe your business logic.

This article describes the current MCP baseline, 2026-07-28. It is a substantial change from the 2025-11-25 lifecycle: protocol sessions and the initialize handshake are gone, Streamable HTTP has new routing headers, and several older features are deprecated.

#	Preview	Product	Price
1		Pearson Computer Networking, 8E	$32.70	Buy on Amazon
2		Networking All-in-One For Dummies (For Dummies (Computer/Tech))	$28.25	Buy on Amazon
3		Computer Networking Bible: [3 in 1] The Complete Crash Course to Effectively Design, Implement and...	$31.30	Buy on Amazon
4		Computer Networking A Top-Down Approach	$193.32	Buy on Amazon
5		The TCP/IP Guide: A Comprehensive, Illustrated Internet Protocols Reference	$67.09	Buy on Amazon

What is an MCP server?

MCP (Model Context Protocol) standardizes the communication surface between an AI application and external capabilities. A typical deployment has three roles:

The protocol defines messages, capability descriptions, transports and lifecycle rules. It does not define how you query a database, call a weather provider or render a report. That application logic remains yours.

#1 Best Overall

Sale

Pearson Computer Networking, 8E

• brand: Pearson
• Computer Networking, 8e

$32.70

Buy on Amazon

Tools, resources and prompts are not interchangeable

Keep these control models visible in your design. A read-only document belongs as a resource, not a tool that silently performs side effects. A reusable user workflow belongs as a prompt, not an implicit system instruction.

How the 2026-07-28 request lifecycle works

Requests are self-describing

Each request carries protocol metadata and may be routed to any server instance. The protocol no longer requires the old initialize/initialized exchange or an Mcp-Session-Id. An optional server/discover call lets a client inspect supported versions, capabilities and server identity before normal requests.

Record the versions your implementation supports and test negotiation with older clients. SDKs may discover the current version and fall back to the legacy initialize handshake when talking to older servers; that compatibility path should be deliberate rather than assumed.

Continuity belongs in application state

If an operation needs continuity, return an explicit handle from a tool and require that handle in later arguments. A handle is a reference to protected server-side state, not a credential. Authenticate every request, bind the state to the verified user, use unpredictable values and expire them when practical.

Rank #2

Sale

Networking All-in-One For Dummies (For Dummies (Computer/Tech))

$28.25

Buy on Amazon

Typical message path

1. The host decides that a capability is needed and asks its MCP client to use a server.
2. The client discovers or selects the server and sends a versioned request over the configured transport.
3. The server validates the method, arguments, authorization and any referenced state.
4. The handler calls application services or downstream systems and returns a bounded result.
5. The client applies host policy before the model or user sees the result.

Choosing a transport: stdio or Streamable HTTP

Transport changes framing, metadata carriage, cancellation and termination; it does not change what a tool or resource means. Choose using locality and data boundary, latency, client compatibility, authentication, observability and operational burden.

Stateless does not mean “no application state”

The stateless protocol core permits ordinary load balancing without sticky sessions or shared protocol-session storage. Your application may still keep jobs, approvals, cursors or drafts in a database or cache. Pass only an opaque, authorized handle through MCP and retrieve the actual state server-side.

Designing tools, resources and prompts

Tools

• Give every tool a stable, specific name and a description that says what it does and does not do.
• Publish a structured input schema; reject unknown, missing or out-of-range arguments before the handler runs.
• Authorize both the operation and the data it touches. A user allowed to read one project is not automatically allowed to read every project.
• Bound output size and execution time. Return a concise result or a reference to a larger resource.
• Avoid a huge flat catalog. Narrow, task-specific capabilities are easier for a model to understand and safer to govern.

Resources

Use resource identifiers that are stable enough for clients to address but do not leak secrets. The July 2026 release adds ttlMs and cacheScope metadata to list/read responses, allowing clients to make informed caching decisions. Keep list ordering deterministic so catalogs and prompt caches remain stable.

Prompts

Prompts are reusable, user-invoked templates. Treat their arguments as user input, document expected values and avoid embedding authorization decisions in a template.

Long-running and interactive work

The Tasks extension uses task handles and polling operations for work that outlives one request. If a server needs a user answer while work is in progress, Multi Round-Trip Requests (MRTR) can return an input_required result; the client supplies the answer in a retry. This avoids keeping a bidirectional stream open. Event-delivery and task-lifecycle details continue to evolve, so separate stable specification behavior from roadmap features in your implementation plan.

Rank #3

Sale

Computer Networking Bible: [3 in 1] The Complete Crash Course to Effectively Design, Implement and Manage Networks. Including Sections on Security, Performance and Scalability

$31.30

Buy on Amazon

A minimal TypeScript stdio server

The following example follows the official SDK pattern: register a structured get-forecast tool and serve it over stdio. Pin an SDK release that supports the 2026-07-28 protocol, and verify the exact API names against that release before deploying.

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { z } from "zod";

const server = new McpServer({
  name: "forecast-server",
  version: "1.0.0"
});

server.tool(
  "get-forecast",
  "Return a short forecast for a city.",
  { city: z.string().min(1).max(100) },
  async ({ city }) => {
    // Replace this with an authenticated call to your forecast service.
    const text = `Forecast lookup requested for ${city}.`;
    return { content: [{ type: "text", text }] };
  }
);

const transport = new StdioServerTransport();
await server.connect(transport);

Run the process only under a client that you trust. Do not print logs to stdout, because stdout carries protocol messages; send diagnostics to stderr or a separate sink. In production, replace the placeholder handler with a service that enforces authorization, timeouts, rate limits and output limits.

Security architecture

An MCP server is a security boundary: its tools may reach APIs, data stores or a local machine. Apply controls at the protocol, operation and data layers.

Credentials and confused-deputy risks

• No token passthrough: never accept a token issued for another resource and forward it unchanged. Validate that credentials were issued for your MCP server and enforce audience boundaries.
• OAuth proxy protection: identify the MCP client, request only the required downstream scopes, preserve per-client consent, validate redirect URIs exactly and protect state/CSRF flows.
• Issuer validation: validate the authorization response issuer (iss) under RFC 9207 and bind credentials to the issuer that minted them.
• Client registration: Client ID Metadata Documents are the preferred direction; Dynamic Client Registration is deprecated but retained for compatibility. Check the versioned authorization specification for normative details.

Network and state threats

• Treat OAuth metadata URLs and redirects as untrusted. Require HTTPS in production, block private or reserved ranges where appropriate, validate redirect destinations and consider egress controls to reduce SSRF.
• Never treat possession of an explicit state handle as authentication. Bind it to an authenticated principal and make it unpredictable.
• For local servers, show the exact command before launch, require consent before running an untrusted executable, use least privilege and sandboxing, and protect any local HTTP listener.

Deployment, scaling and observability

Local stdio

• Package a reproducible executable or script and pin dependencies.
• Document required environment variables and filesystem/network permissions.
• Keep protocol output on stdout and diagnostics elsewhere.
• Apply OS-level isolation when a tool can execute code or access sensitive files.

Remote Streamable HTTP

• Expose one MCP endpoint behind your normal TLS termination, gateway and load balancer.
• Route using the required method and name headers, while checking that they agree with the body.
• Authenticate every request and authorize every operation; do not rely on a previous connection.
• Use ordinary horizontal scaling. Store explicit application state in shared, access-controlled storage only when a workflow requires it.
• Record request IDs, method names, latency, authorization outcomes, downstream errors and billed or metered usage without logging secrets or sensitive arguments.

Capacity and cost decisions

Stateless protocol handling removes sticky-session overhead, but downstream APIs, databases and long-running jobs still determine capacity. Measure queue time, handler time, payload size and retry rates. Cache resources only when their ttlMs and cacheScope semantics match the data’s sensitivity and freshness requirements.

Migrating from older MCP tutorials

The maintainers reported close to half a billion Tier 1 SDK downloads per month in the 2026 release announcement, with the TypeScript and Python SDKs each exceeding one billion total downloads. Those are maintainer-reported figures, not independent audits; they indicate ecosystem activity, not a guarantee of client compatibility.

Rank #4

Computer Networking A Top-Down Approach

$193.32

Buy on Amazon

Troubleshooting common failures

The client cannot start a stdio server

Likely causes: wrong executable path, missing environment variables, permission failure or protocol text written to stdout. Fix: run the exact command manually, verify the working directory and permissions, move logs to stderr, and inspect the client’s launch configuration.

Streamable HTTP requests are rejected before the handler runs

Likely cause: missing or mismatched Mcp-Method/Mcp-Name headers in a 2026-07-28 deployment. Fix: have the gateway preserve the headers, verify they match the request body and ensure the endpoint supports the same protocol version as the client.

A tool works for one user but exposes another user’s data

Likely cause: application state or a handle is not bound to the authenticated principal. Fix: resolve identity on every request, authorize the referenced record at read time and expire or revoke handles.

OAuth login loops or redirects to an unexpected host

Likely causes: loose redirect matching, issuer confusion or untrusted metadata fetching. Fix: compare redirect URIs exactly, validate iss, restrict metadata and redirect destinations to approved HTTPS endpoints and add egress controls.

Best Value

Sale

The TCP/IP Guide: A Comprehensive, Illustrated Internet Protocols Reference

• Used Book in Good Condition

$67.09

Buy on Amazon

Large results time out or overwhelm the model

Likely cause: an unbounded tool response. Fix: cap records and bytes, return a resource identifier for the full data set, paginate through a task or resource, and set downstream timeouts.

Or skip the browser setup

If one of your MCP tools needs website screenshots, you can run a browser yourself—or call ScreenshotNeo from the server. Its API accepts a URL and returns PNG, JPEG, WebP or PDF. Cookie and consent banners, newsletter popups and chat widgets are removed before capture; bot checks, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing result. ScreenshotNeo also provides an MCP server with take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients.

See the complete parameter reference in the ScreenshotNeo documentation. A one-call capture looks like this:

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp

import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);

Every plan includes the capture options, including full-page and element shots, device and retina settings, PDF controls, custom CSS/JavaScript, clicks, waits, request blocking, headers, cookies, user agents, timezone, geolocation, transparent backgrounds, resizing, selectable caching TTLs, signed links, asynchronous webhooks, bulk capture of up to 100 URLs per call, usage data and an OpenAPI specification. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.

Frequently Asked Questions

Does an MCP server contain the language model?

No. The host owns the AI application and model orchestration; the server exposes protocol capabilities and executes authorized application logic.

Can one server support both stdio and Streamable HTTP?

Yes, when the implementation keeps protocol semantics separate from transport bindings. Run each binding with its own lifecycle, authentication and deployment controls, and test both against the same supported protocol versions.

What should be versioned besides the protocol number?

Version the server identity, tool and resource schemas, authorization behavior and enabled extensions. Clients need to know which capabilities and compatibility paths they can rely on.

The Bottom Line

Design an MCP server as a versioned, security-sensitive protocol boundary: keep host, client and server roles distinct; model tools, resources and prompts according to their control models; use stdio locally or Streamable HTTP remotely; and carry application continuity through authenticated, expiring handles rather than protocol sessions.

Quick Recap

SaleBestseller No. 1

Pearson Computer Networking, 8E

brand: Pearson; Computer Networking, 8e

$32.70

SaleBestseller No. 2

Networking All-in-One For Dummies (For Dummies (Computer/Tech))

$28.25

SaleBestseller No. 3

Computer Networking Bible: [3 in 1] The Complete Crash Course to Effectively Design, Implement and Manage Networks. Including Sections on Security, Performance and Scalability

$31.30

Bestseller No. 4

Computer Networking A Top-Down Approach

$193.32

SaleBestseller No. 5

The TCP/IP Guide: A Comprehensive, Illustrated Internet Protocols Reference

Used Book in Good Condition

$67.09

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.