Free Linux Foundation Model Context Protocol Associate Sample Questions

Correct answer: A — JSON-RPC 2.0

• A. MCP is built on JSON-RPC 2.0, using its request, response, and notification message shapes for all communication between clients and servers.
• B. GraphQL is a query language for APIs with its own schema and resolver model; it is not the message format MCP specifies for client-server communication.
• C. SOAP is an older XML-based messaging protocol commonly used in enterprise web services; MCP does not use SOAP envelopes or XML for its base protocol.
• D. gRPC with Protocol Buffers is a binary RPC framework used in many microservice architectures, but MCP specifies JSON-RPC 2.0 rather than a binary, schema-compiled format like Protobuf.

Correct answer: A — Statefulness, since the connection maintains session context across multiple interactions rather than treating every call independently.

• A. This reflects statefulness: the client-server session persists negotiated capabilities and context across the interaction, so the assistant does not have to rediscover or renegotiate everything before each individual tool call.
• B. Interoperability is about the same server working across different host applications, which is a separate concern from a single session maintaining continuity across many calls within one connection.
• C. Tool safety concerns obtaining consent before invoking tools; it does not describe why a session retains context and negotiated capabilities across multiple calls.
• D. Vendor neutrality describes MCP's open, non-proprietary governance model, which is unrelated to a session persisting state across multiple tool calls.

Correct answer: A — JSON-RPC 2.0

• A. MCP defines all requests, responses, and notifications as JSON-RPC 2.0 messages, which is the base protocol layer every implementation must support.
• B. gRPC with Protobuf is a binary RPC framework used in many microservice systems, but MCP does not use it as its message format.
• C. GraphQL over HTTP is a query language and runtime for APIs, not the message format MCP specifies for client-server exchanges.
• D. REST with JSON bodies describes a resource-oriented HTTP style, which is not how MCP structures its stateful request/response/notification messages.

Correct answer: A — Host

• A. The Host is the LLM application itself, and it manages the lifecycle of one or more Clients, each of which connects to a Server.
• B. A Client is the connector instance living inside the host that maintains a 1:1 stateful session with a single server, not the application managing multiple such connections.
• C. A Server is the separate process or service that exposes resources, prompts, and tools; it does not manage clients from within the LLM application.
• D. Transport refers to the communication channel (such as stdio or Streamable HTTP) carrying messages, not the role that manages connector instances.

Correct answer: A — MCP is a standardized, open protocol rather than a vendor-specific format

• A. Because MCP defines a common, open protocol for exposing resources, prompts, and tools, any compliant host can connect to any compliant server without bespoke, one-off integration code.
• B. MCP explicitly does not require single-vendor ownership of both sides; its value comes from decoupling host and server development across different vendors.
• C. MCP servers do not rewrite themselves per host; instead, both sides implement the same standardized protocol so no per-host customization is needed.
• D. MCP does not require a shared underlying LLM model between hosts; it is agnostic to which model a host uses internally.

Correct answers: A, B, C — Statefulness; Interoperability; Agent-centric design

• A. This is correct: MCP sessions maintain state through capability negotiation and ongoing context, which is one of the pillars commonly cited for the protocol.
• B. This is correct: enabling the same servers and clients to work together across different vendors and applications is a core pillar of MCP's design.
• C. This is correct: MCP is designed around how autonomous or semi-autonomous agents discover and invoke tools, making agent-centric design one of its stated pillars.
• D. Cost minimization is not one of the pillars used to describe MCP; the protocol's goals are about integration and interaction patterns, not infrastructure economics.
• E. MCP is a protocol for programmatic communication between applications and tools; it makes no requirement about or guarantee of any graphical user interface.
• F. MCP is language-agnostic by design, built on JSON-RPC so implementations can exist in many programming languages, not a single mandated one.

Correct answer: A — It turns what would otherwise be three separate integrations into a single reusable one, cutting the integration count from a multiplicative problem toward a linear one.

• A. This is correct: one server serving three internal applications is a direct, concrete example of turning an N-times-M integration problem into a much smaller N-plus-M one.
• B. The knowledge base's own storage and query logic does not need to change; the MCP server is the integration layer, and the underlying knowledge base stays as it was.
• C. The three applications remain separate; MCP standardizes how they talk to the shared server, not how their own user interfaces are presented to end users.
• D. MCP clients and the server they connect to can run on entirely different machines; there is no requirement that consuming applications share identical hardware with the server.

Correct answer: A — The host forwards the model-initiated action to the client connected to the Git server, the client sends a request to the Git server, and the server's response flows back through the client to update the host's context

• A. This matches the documented request flow: a user- or model-initiated action goes from host to client, the client issues the request to the server, and the response flows back through the client to update the host's UI or model context.
• B. The host never talks to a server directly; every server interaction is mediated by that server's dedicated client, which is the entire point of the client-host-server separation.
• C. Servers do not push unsolicited results based on a model action; server-initiated communication follows the separate request pattern used for things like sampling, not spontaneous pushes tied to model actions.
• D. Each server has its own dedicated client with a 1:1 session; servers do not relay requests to each other, and two servers never share a single client connection.

Correct answer: A — Features can be added to servers and clients progressively, with the core protocol providing minimal required functionality and backwards compatibility maintained

• A. This is correct: the progressive feature addition principle states the core protocol offers minimal required functionality, additional capabilities are negotiated as needed, and backwards compatibility is maintained as servers and clients evolve independently.
• B. There is no requirement to implement every optional capability upfront; servers are meant to focus on well-defined capabilities and can add more over time, which is the opposite of a mandatory full feature set.
• C. Capabilities are explicitly negotiated during the initialize handshake, not automatically adopted; a client only relies on a feature after it has been declared and agreed upon.
• D. MCP's value comes from a shared protocol letting one server implementation work across different client types without rebuilding, which is the opposite of what this option describes.

Correct answer: A — `name`, `title`, `description`, `mimeType`, and `size` are all optional.

• A. The Resource data type lists uri as required and name, title, description, mimeType, and size as optional metadata fields.
• B. Resources have no inputSchema field; that concept belongs to tools, which accept structured call arguments.
• C. Resources have no arguments field; parameterization instead happens through resource templates and their URI templates.
• D. Resources have no outputSchema field; that concept belongs to tools that validate their structured call results.

Correct answer: A — A resource template with a `uriTemplate`, e.g. `file:///{path}`, letting clients build a URI per file.

• A. Resource templates use RFC 6570 URI templates so a server can expose a whole family of parameterized resources without enumerating each one.
• B. mimeType only describes a single resource's content type; it cannot substitute for enumerating an entire directory of files.
• C. This describes a tool invocation pattern rather than the resource template mechanism the protocol defines for browsable file-like resources.
• D. Prompt arguments customize prompt messages; they are not the protocol's mechanism for exposing parameterized resources.

Correct answer: A — The client requests the resource on the model's or user's behalf and passes the returned content into the model's context

• A. Correct. Consistent with how models request tools and receive results, resource access is mediated by the client, which fetches the content on behalf of the user- or model-initiated action and surfaces it to the model through the host.
• B. Incorrect. Resources are dynamic content exposed by a server at runtime, not something baked into the server's binary ahead of time.
• C. Incorrect. The model has no independent network identity or side channel to a server; every exchange is routed through its client's session.
• D. Incorrect. The host does not bypass the client to reach a server's local resources; the client-server session is the only path for that access.

Correct answer: A — The client sends `tools/call` with the ticket arguments, the server executes and replies with a result, and the client relays that result to the model

• A. Correct. Once the model selects the tool, the client issues `tools/call` with the arguments, the server performs the action and returns a result, and the client passes that result back for the model to use.
• B. Incorrect. The model cannot send protocol messages itself; the client always mediates between the model/host and the server.
• C. Incorrect. Reading a resource is a different primitive than invoking a tool, and `sampling/createMessage` is used for server-requested LLM generation, not for returning ticket-creation results.
• D. Incorrect. Re-initializing mid-session is not how a tool invocation is triggered, and servers always return a response to a `tools/call` request rather than acting silently.

Correct answers: A, B, C, E — An upstream weather API returning a rate-limit failure while the tool was executing; A tool receiving arguments that fail its own business-logic validation, such as a negative quantity for a purchase; A downstream database rejecting a write because a record already exists; A tool's internal computation producing a division-by-zero condition while processing valid input

• A. Correct. A rate-limit response from an upstream API happens during execution of a tool that was otherwise correctly invoked, so it is an execution error surfaced via `isError: true` and descriptive content.
• B. Correct. Business-logic validation failures on otherwise well-formed arguments occur inside the tool's own execution, matching the specification's example of invalid input data as an execution error.
• C. Correct. A downstream system rejecting a write during execution is a business/API failure that happens after the tool call has been correctly dispatched, so it belongs in the execution-error category.
• D. A JSON body that fails to parse never reaches tool execution at all; this is a transport/protocol-level malformation reported as a standard JSON-RPC parse or invalid-request error, not `isError: true`.
• E. Correct. A runtime fault like division by zero happens while the tool is actively executing on accepted input, making it an execution-time failure reported through the tool result content.

Correct answer: A — The failure is delivered to the model as readable content within the normal response flow, letting it adjust its next action instead of losing the entire session

• A. Correct. Returning a structured `isError: true` result keeps the session alive and gives the model human-readable failure text it can reason about, such as trying a different filename, rather than terminating the connection.
• B. Reporting one error gracefully does not eliminate the need for ongoing input validation on future calls; validation remains a standing server responsibility regardless of how any single failure is reported.
• C. Returning an error result describes the failure but has no side effect of creating the missing file; the tool would need separate logic to do so, which is not implied by error reporting.
• D. The scenario intentionally keeps the failure as a tool execution error rather than converting it into a protocol-level JSON-RPC error, so this describes the opposite of what happens.

Correct answer: A — There are no further pages of results left to fetch from this server now

• A. Correct. Clients SHOULD treat a missing `nextCursor` as the end of the result set, since pagination only continues when the server explicitly supplies a cursor for the following page.
• B. Incorrect. A missing `nextCursor` on a successful result is not an error condition; the result still returned the current page of resources without signaling any failure.
• C. Incorrect. `resources/list` is one of the operations that explicitly supports pagination, and switching methods would not be a meaningful response to reaching the last page.
• D. Incorrect. There is no requirement to send a confirmation request with an empty cursor; the absence of `nextCursor` is itself sufficient to signal completion.

Correct answer: A — Letting the server send requests unrelated to any concurrent client request

• A. Correct. A client MAY issue an HTTP GET to open an SSE stream that lets the server communicate independently; messages sent there SHOULD be unrelated to any concurrently-running client request.
• B. Incorrect. The server MUST NOT send a JSON-RPC response on this standalone GET stream unless it is resuming a previous request's stream; responses to POSTed requests belong on the stream opened by that POST.
• C. Incorrect. The GET-initiated SSE stream is not a query mechanism or history log; it exists so the server can proactively send its own requests and notifications to the client.
• D. Incorrect. The lifecycle's initialization phase is still required regardless of transport; opening a GET stream does not substitute for or skip the `initialize` handshake.

Correct answer: A — It carries structured JSON output produced by the server, distinct from LLM outputs

• A. This field holds a JSON object representing the tool's structured result, and it is explicitly unrelated to LLM structured-output generation despite the similar name.
• B. The schema describing accepted arguments is the inputSchema on the tool definition itself, not a field on the call result.
• C. Capability negotiation happens in the initialize exchange and has no relationship to the data returned from a single tool call.
• D. Pagination cursors apply to list-style operations such as listing tools, not to the payload of a single tool invocation's result.

Correct answer: A — A JSON-RPC protocol error indicating the requested tool is unknown

• A. An unknown tool name is a request-level problem rather than a failure inside tool logic, so it is reported as a standard JSON-RPC protocol error rather than as tool output.
• B. The isError flag inside a successful result is reserved for failures that occur once a valid tool has begun executing, not for a call that never named a real tool.
• C. Returning a listing response would not answer the tools/call request at all and would not communicate that the requested tool does not exist.
• D. This notification announces changes to the tool catalog and is not used as a substitute for reporting an invalid call.

Correct answer: A — initialize

• A. The client MUST send a request with this exact method name as the first interaction in a session, carrying protocolVersion, capabilities, and clientInfo.
• B. This is not a defined MCP method name; the spec uses a shorter, dedicated method for starting a session rather than a namespaced session method.
• C. MCP does not use this term as a JSON-RPC method; capability negotiation happens through the dedicated initialization request instead.
• D. This is not an MCP JSON-RPC method; transport-level connection establishment happens before any MCP messages are exchanged.

Correct answers: A, B, C — The requested tool name does not exist anywhere on the connected server; The `arguments` object fails validation against the tool's declared inputSchema; The server experiences an unexpected internal failure while handling the request

• A. An unknown tool name is a protocol-level problem with the request itself, so the server replies with a JSON-RPC error rather than attempting execution.
• B. Arguments that do not conform to the declared inputSchema mean the request was invalid before execution could begin, which is reported as a protocol error such as invalid params.
• C. An unexpected server-side fault while processing the request is a protocol-layer failure, typically surfaced with an internal error code rather than inside a tool result.
• D. A timeout that occurs after the tool has already started running is a business/API-level failure during execution, so it belongs in a successful result with `isError: true`, not a protocol error.
• E. An unfavorable but successfully produced business result is not an error at all; it is a normal, valid tool result that the model or user may simply disagree with.

Correct answer: A — Servers must not use session identifiers as the mechanism for authenticating requests

• A. Correct: servers that implement authorization must still verify each inbound request and must not treat possession of a session ID alone as proof of identity, since a guessed or leaked session ID would otherwise let an attacker impersonate the original client.
• B. Transport encryption prevents eavesdropping in transit but does not address the deeper flaw of relying on a session ID as authentication, since the ID can still be obtained or guessed through other means.
• C. Streamable HTTP does not require using session IDs as an authentication mechanism; sessions and authentication are handled as separate concerns in the transport and authorization guidance.
• D. Session identifiers and access tokens serve different purposes, and the guidance explicitly warns against conflating them, since a session ID is not validated the way an access token is.

Correct answers: A, B, C — Show the exact command, including every argument, in a consent dialog before it ever runs; Launch the server in a sandbox with minimal default privileges and restricted filesystem access; Warn the user whenever the command touches sensitive locations like the home directory or SSH keys

• A. Correct: displaying the full, untruncated command before execution lets the user actually evaluate what will run, which is the specific consent requirement the guidance calls for.
• B. Correct: sandboxing with minimal default privileges and restricted filesystem and network access limits the damage even if the server itself turns out to be malicious or buggy.
• C. Correct: flagging commands that touch sensitive locations like the home directory or SSH keys gives the user a concrete signal to scrutinize before approving, which the guidance recommends as an additional check.
• D. Auto-approving based on the source of a link is exactly the missing-consent scenario the guidance warns about, since marketing emails are not a trust signal for executing local commands.
• E. Running every server with full client privileges and no restriction removes the sandboxing protection the guidance recommends and maximizes the impact of a malicious or buggy server.
• F. Hiding the command text removes the user's ability to review what will execute, which directly contradicts the requirement to show the exact command without truncation.

Correct answer: A — Servers must not use elicitation to request sensitive information such as passwords or full financial details

• A. The elicitation security considerations state plainly that servers must not use elicitation to request sensitive information, regardless of how the request is framed.
• B. There is no schema flag that authorizes requesting sensitive data; the restriction is on the category of information being requested, not on how the field is annotated.
• C. Elicitation is specifically a mechanism for servers to request new structured input from users mid-interaction, so it is not limited to read-only lookups.
• D. Client-side encryption addresses transport confidentiality but does not lift the prohibition on requesting sensitive information through elicitation in the first place.

Correct answer: A — The user must consent to exposing those boundaries, consistent with MCP's human-in-the-loop control model

• A. Roots require user consent before exposure, keeping the human in the loop over which filesystem or URI boundaries a server can see, matching MCP's general consent-first approach.
• B. The specification does not ask servers to prove read-only behavior as a substitute for consent; user approval is still needed regardless of what the server claims about its access pattern.
• C. Narrowing the scope to one directory reduces exposure but does not eliminate the requirement for the user to explicitly approve exposing that root.
• D. Permanently disabling roots is not the mechanism MCP specifies; the requirement is obtaining consent for exposure, not a one-way lockout of the feature.

Correct answer: A — alert

• A. This is the level positioned directly above critical in the RFC 5424 ordering, reserved for situations such as data corruption where immediate action is required.
• B. This level indicates a normal but significant event, such as a configuration change, and sits far below critical in severity, not above it.
• C. This level indicates a warning condition, such as deprecated feature usage, and is several steps below critical rather than above it.
• D. This is the lowest severity level, used for detailed information like function entry and exit points, and is the opposite end of the scale from critical.

Correct answers: A, B, C — The downstream service's logs show requests coming from the proxy rather than the true originating client, complicating investigation.; Security controls such as rate limiting that depend on token audience can be bypassed entirely.; The MCP server cannot reliably distinguish between the different clients calling through it.

• A. The spec directly describes this accountability problem: downstream logs reflect the forwarding proxy rather than the originating client, making incident investigation harder.
• B. The spec lists circumvention of audience-dependent security controls, such as rate limiting, as a documented risk of accepting and forwarding tokens without proper validation.
• C. The spec notes that a server receiving an opaque, upstream-issued token this way is unable to identify or distinguish between the different clients using it.
• D. Automatic credential revocation is not a behavior the spec describes; passthrough is a security anti-pattern, not a mechanism that triggers credential rotation.
• E. The authorization specification explicitly forbids token passthrough rather than requiring it, so this statement inverts the actual guidance.
• F. The spec ties passthrough to accountability and audit trail problems, not to improved auditability, so this claim contradicts the documented risk.

Correct answer: A — A shell can interpret crafted characters in a malicious URL as extra commands, letting an attacker achieve code execution

• A. This is the documented risk: a malicious server can craft a URL with shell metacharacters so that a shell used to open it interprets part of the string as an additional command, achieving arbitrary code execution on the user's system.
• B. Performance is not the reason cited in the guidance; the concern is a security vulnerability, command injection, not the speed of shelling out to open a browser.
• C. Shells are capable of invoking browsers with `https://` URLs; the guidance's concern is not about scheme support but about command injection through unsanitized input passed to the shell.
• D. Rendering of the consent screen is handled by the browser itself, not by whichever mechanism launched it, so this is not the reason shell execution is discouraged.

Correct answers: A, B, C — Between the LLM and the client, since the model cannot independently verify a tool's description is accurate; Between the client and the server, since the client must authenticate the server and validate its responses; Between the server and downstream systems, since the server acts as an agent with potentially broad permissions

• A. The model has no independent way to verify that a tool description it is shown is accurate or has not been tampered with, which is exactly why this boundary between the LLM and the client is called out.
• B. The client cannot blindly trust a server's responses; it must authenticate the server and validate what comes back, which is why this pairing is treated as its own trust boundary.
• C. The server often has broad permissions to downstream systems on behalf of the model, so this boundary is highlighted because a compromised or malicious server can misuse those permissions.
• D. MCP does not define a shared trust context between separate clients within one host; each client maintains its own 1:1 session with a server, so this is not one of the described trust boundaries.
• E. The security best practices guidance addresses application-level trust relationships between hosts, clients, and servers, not the transport layer's relationship to the underlying network stack.
• F. `listChanged` and `subscribe` are sub-capabilities negotiated as part of server capabilities, not a described trust boundary in the security guidance.

Correct answer: A — A local server runs as a process on the user's machine, typically over stdio

• A. Local servers run as processes on the user's own machine and typically communicate over the stdio transport, using environment-provided credentials rather than a full OAuth flow. Remote servers instead run as independent services over Streamable HTTP, potentially serving many clients.
• B. The reverse is true in practice: stdio-based local servers use environment-provided credentials, while HTTP-based remote servers are the ones that typically implement the OAuth 2.1 authorization framework. Requiring OAuth is not a defining trait of local deployment.
• C. Serving many clients at once is characteristic of remote servers running as independent network services, not local ones. A local server is scoped to the single machine it runs on.
• D. Both local and remote servers can be published to the registry, since the registry only records discovery metadata regardless of deployment model. Publication is unrelated to whether a server runs locally or remotely.

Correct answer: A — Internal knowledge retrieval through a server exposing wiki and document resources

• A. Letting an assistant answer questions from a company's wiki and documents by exposing them as MCP resources is the canonical internal knowledge retrieval use case described in MCP adoption guidance. It matches the scenario's goal of surfacing internal content through the assistant.
• B. A coding assistant integration is centered on filesystem and Git operations for writing and managing code, not on answering questions from wiki or document content. It addresses a different operational use case.
• C. Chaining payment tool calls describes a transactional agentic workflow, unrelated to retrieving answers from internal documentation. It does not match the knowledge-lookup scenario described.
• D. A market-analysis pipeline with ingestion, analysis, and reporting stages is built for data analysis tasks, not for answering employee questions from a wiki. It is a different modular use case than knowledge retrieval.

Correct answer: A — Granting or denying consent when the host prompts for permission to invoke a specific tool

• A. End users are responsible for granting or denying consent when a host presents a permission prompt for a tool invocation, which is the primary user-facing control point in the operational model.
• B. Implementing tool business logic is the responsibility of server developers, not end users interacting with an already-deployed assistant.
• C. Selecting and implementing the transport mechanism is a technical decision made by client and server developers, not something an end user configures during normal use.
• D. Publishing servers to the registry is typically handled by the engineering or platform team that owns the server, not by individual end users of the assistant.

Correct answer: A — An agentic workflow chaining calls across multiple distinct tools to complete a multi-step task

• A. Pulling helpdesk data, cross-referencing a CRM, and drafting an email requires sequencing multiple tool calls toward a goal, which is the defining characteristic of an agentic workflow.
• B. The scenario explicitly involves multiple tools and steps, not a single isolated tool call, so describing it as one stateless exchange understates what is happening.
• C. Capability negotiation happens once during connection setup to establish what a server supports, not during the ongoing multi-tool task execution described here.
• D. A transport handshake is a low-level connection detail between one client and one server, not a description of a multi-step business task spanning several tools.

Correct answers: A, B, C — MCP was contributed as one of the founding projects at the moment the AAIF was formed and announced.; The AAIF operates as a directed fund under the Linux Foundation rather than as a fully independent legal entity.; Anthropic donated MCP to the AAIF, and the foundation received backing from other AI vendors as well.

• A. This is correct: MCP was one of the founding project contributions announced alongside the formation of the AAIF.
• B. This is correct: the AAIF was set up as a directed fund under the Linux Foundation, giving it a formal but foundation-hosted structure rather than a fully separate independent organization.
• C. This is correct: Anthropic donated MCP into the new foundation, and the effort was backed by additional AI vendors, reflecting broader industry support beyond the protocol's originator.
• D. The AAIF is a governance and stewardship structure; it did not change MCP's underlying transport or message format, which remains JSON-RPC based.
• E. Support for the foundation came from companies already invested in the agentic AI ecosystem, including MCP's originator and adopters, not exclusively from newcomers who had never used it.
• F. The explicit intent of moving MCP into a foundation is to provide neutral, multi-stakeholder governance, which is the opposite of locking control to a single vendor.

Correct answer: A — Granting or denying consent for specific data access and tool operations that the host surfaces on their behalf.

• A. This is correct: end users primarily interact with the human-in-the-loop consent flow, approving or denying access to data and tool invocations that the host application surfaces to them.
• B. Defining `inputSchema` for tools is a responsibility of the server developer building the tool, not something an end user does before connecting to a server.
• C. Protocol version negotiation during `initialize` happens between the client and server software directly; it is not a manual step performed by the end user.
• D. Publishing servers to the registry is typically a task for the server's developer or maintainer, not an activity expected of the everyday end user consuming that server through a host application.