MCP (Model Context Protocol) interview questions
The Model Context Protocol (MCP) is an open standard, introduced by Anthropic in 2024, for connecting AI applications to external tools and data. Instead of writing a custom integration for every app and every service, a service exposes an MCP server once and any MCP-compatible application can use it.
AI engineer interviews increasingly include MCP questions. The questions below cover the architecture, building servers and the security issues interviewers care about most.
What interviewers assess
- What MCP solves and how its architecture fits together
- The main building blocks: tools, resources and prompts
- Transports, sessions and authorisation for remote servers
- Security risks of connecting models to real systems
Fundamentals questions
What problem does MCP solve?
What a good answer covers: Without a standard, each AI application needs a separate integration for each tool or data source. MCP defines one protocol, so a server written once works with any compatible client, much like a common port for devices.
Explain the roles of host, client and server in MCP.
What a good answer covers: The host is the AI application the user runs; it creates one client per server connection; each server exposes capabilities such as tools or data. The host controls what the model can access and asks the user for consent.
What are the three main things a server can expose?
What a good answer covers: Tools (actions the model can call, such as creating a ticket), resources (data the application can read and add to context, such as files) and prompts (reusable templates the user can pick). Mention who controls each: model, application and user respectively.
What message format does MCP use?
What a good answer covers: JSON-RPC 2.0 messages: requests, responses and notifications, starting with an initialisation handshake where client and server agree on the protocol version and capabilities.
How is MCP different from ordinary function calling?
What a good answer covers: Function calling is how a model asks to use a tool inside one application. MCP standardises how tools and data are discovered and provided across applications, so tools become reusable and independent of any one app or model.
Building and running servers questions
What transports does MCP support, and when would you use each?
What a good answer covers: stdio for local servers launched by the host as a subprocess; Streamable HTTP for remote servers shared over a network, which replaced the earlier HTTP-with-SSE transport.
How would you design the tools for an MCP server wrapping a company API?
What a good answer covers: A small number of task-focused tools rather than one per endpoint, clear names and descriptions, strict input schemas, helpful errors, pagination for large results and read-only tools where possible.
How does authorisation work for remote MCP servers?
What a good answer covers: The specification uses OAuth 2.1: the client obtains an access token for the user and sends it on each request, and the server validates that the token was issued for it. Local stdio servers usually take credentials from the environment instead.
What can a server ask the client to do?
What a good answer covers: Client features include sampling (asking the host's model to generate text), roots (which folders or locations the server may work in) and elicitation (asking the user for more information). All of these stay under the host's and user's control.
How would you test and debug an MCP server?
What a good answer covers: Unit test the tool logic, use an inspector tool to call the server directly, check schema validation and error cases, then test inside a real host with realistic prompts.
Security questions
What are the main security risks of MCP servers?
What a good answer covers: Prompt injection through tool results, malicious or poisoned tool descriptions, servers with too many permissions, leaked credentials, and untrusted third-party servers. Defences include least privilege, user confirmation for risky actions, and only installing trusted servers.
Why should a server not simply pass the user's token through to another API?
What a good answer covers: Token passthrough breaks the security boundary: the downstream API can't tell which client is calling and audit trails are lost. The specification says servers must only accept tokens issued for themselves and obtain separate tokens for upstream services.
How should a host handle a tool that can delete data or send messages?
What a good answer covers: Show the user what will happen, require explicit approval, and log the action. The model's request is a suggestion, not an authorisation.
How would you roll out MCP servers safely inside a company?
What a good answer covers: An approved list of servers, central authentication, scoped permissions per team, monitoring and audit logs of tool calls, and a review process for new servers.
When is MCP not the right choice?
What a good answer covers: For a single application with a couple of internal functions, plain function calling may be simpler. MCP pays off when tools are shared across applications, teams or models.
Common mistakes
- Describing MCP as a model or a framework rather than a protocol.
- Mixing up tools, resources and prompts and who controls each.
- Designing a server that mirrors every API endpoint as a separate tool.
- Not mentioning security when asked how to connect a model to production systems.
How to prepare
- Build a small MCP server with one or two tools using an official SDK, and connect it to a host you use.
- Read the official specification overview at modelcontextprotocol.io for the current transports and authorisation rules.
- Be ready to compare MCP with plain function calling and explain when each fits.
- Prepare an answer on how you would secure a server that touches real data.
Reading questions only goes so far: the real test is answering them aloud, under follow-up questions. Career Scan builds a mock interview from your own resume and the job, then shows exactly which answers need work.
Frequently asked questions
Is MCP only for Claude?
No. Anthropic introduced it as an open standard, and it is now supported by many AI applications, development tools and model providers.
Which languages can I build MCP servers in?
There are official SDKs for several languages, including Python and TypeScript, as well as others such as Java, C# and Go.
How is MCP related to AI agents?
Agents need tools; MCP is a standard way to give agents tools and data. Many agent frameworks can use MCP servers directly.