MCP from Zero

Read every Model Context Protocol message on the wire, build a server that gives an agent your own tools and data, then put it on the internet behind OAuth.

Watch lesson 01

Free preview01 Why a protocol for tools

Lessons
10
Modules
3
Running time
~3.5 hours
Before you start
Used an LLM API or a coding agent
Free to watch
3 lessons
Last updated
Oct 17, 2026

Part of

[01] Access

[02] Who it's for

  • Engineers who want to give an agent their own tools and data, in a product or in their team's coding agent.
  • Developers who use Claude Code, Cursor or another MCP client and want to know what happens on the wire.
  • No prior knowledge of MCP, JSON-RPC or OAuth is needed. You should be able to read JSON and an HTTP request.

[03] What you'll learn

  • 01Read any MCP message on the wire and say what it does, from initialize to a tool call
  • 02Build a server with the TypeScript SDK that gives an agent your own tools, resources and prompts
  • 03Keep a tool list small enough that the model still picks the right tool
  • 04Serve MCP over Streamable HTTP and deploy it to Cloudflare Workers
  • 05Protect the server with OAuth so only the right user, with the right scopes, can call it
  • 06Name the attacks that come with MCP, prompt injection first, and the defence for each

[04] Syllabus

Module 01

The protocol

3 lessons57 min
  1. 01

    Why a protocol for tools

    Free
    15m
  2. 02

    JSON-RPC on the wire

    Free
    19m
  3. 03

    Tools: list, call, and the model in between

    Free
    19m

  4. Module quiz

    5 questions, about 5 minutes

Module 02

Building the server

4 lessons80 min
  1. 04

    Tools cost context: choosing servers and keeping the list small (locked)

    25m
  2. 05

    From hand-rolled to the SDK (locked)

    18m
  3. 06

    Resources and prompts (locked)

    25m
  4. 07

    Writes, confirmation and long calls (locked)

    27m

  5. Module quiz

    5 questions, about 5 minutes

Module 03

Remote and secure

3 lessons69 min
  1. 08

    Going remote with Streamable HTTP (locked)

    25m
  2. 09

    Who is calling: OAuth for MCP (locked)

    31m
  3. 10

    When the data fights back (locked)

    28m

  4. Module quiz

    5 questions, about 5 minutes

[05] How it's made

The curriculum is curated by karnstack and reviewed by senior engineers in the industry before it ships. Narration is an AI voice (ElevenLabs) reading human-written, human-reviewed scripts. Read how courses are made.