Exam Day Checklist

Knowledge self-check

You should be able to answer “yes” to all of these:

• I can explain the N×M problem and how MCP solves it
• I can name all six primitives and who offers/controls each one
• I can describe the discover → call → result flow in order (and how the legacy initialize handshake differed)
• I know the difference between a protocol error and a tool execution error
• I can list the two transports and when each is used
• I can explain prompt injection, tool poisoning, rug pull, and confused deputy
• I know which participant enforces consent (the host)
• I can explain audience-bound tokens and why passthrough is forbidden
• I know what belongs in an MCP audit log
• I can match a use-case scenario to the right primitive

sequenceDiagram
participant C as Client
participant S as Server
C->>S: server/discover
S-->>C: versions + capabilities
C->>S: tools/call (with _meta version + capabilities)
S-->>C: result (or InputRequiredResult)

Modern (2026-07-28) request flow

High-yield facts (last-minute review)

• Tools = model-controlled · Resources = application-driven · Prompts = user-controlled
• Client primitives: sampling, roots, elicitation — sampling and roots are deprecated in 2026-07-28; elicitation remains
• Messages: JSON-RPC 2.0; notifications have no id
• Transports: stdio (local subprocess) and Streamable HTTP (remote; POST-only single MCP endpoint in 2026-07-28)
• Authorization is optional; HTTP transports use OAuth 2.1 (server = resource server, client = OAuth client); stdio should use environment credentials instead
• Execution errors → isError: true inside a successful response; protocol errors → JSON-RPC error objects
• Versions: date-based (YYYY-MM-DD); in 2026-07-28 each request carries the version in _meta (unsupported → error -32022); legacy revisions negotiated it in the initialize handshake
• 2026-07-28 is stateless: no initialize, no sessions; capabilities come from server/discover, and server-initiated requests are replaced by MRTR (InputRequiredResult)
• stdio logs → stderr, never stdout
• Annotations (readOnlyHint, etc.) are untrusted hints unless the server is trusted

Caution

The spec changed heavily in 2026-07-28. If your exam sitting targets an earlier revision (2025-06-18 / 2025-11-25), remember the legacy behaviors: initialize handshake, sessions, server-initiated sampling/elicitation/roots requests, and resources/subscribe.

Logistics

• Verify exam requirements on the official page (online, proctored, multiple-choice, 120 minutes, one retake included)
• Test your webcam, microphone, and internet connection
• Prepare a valid government-issued ID
• Clear your desk and room per proctoring rules
• Close all applications; only the exam browser open
• Schedule for a time when you are alert and undisturbed

Good luck! 🍀