MCP Interview Guide: Architecture, Security & 2026 Changes

Understand Model Context Protocol architecture and the 2026 stateless, routable, authorization-hardened protocol core.

Core mental model

Separate protocol transport, application state, tool/resource contracts, and authorization.

2026 protocol shift

The 2026-07-28 release moved the protocol core to stateless request/response operation, removed protocol sessions, added header-based routing, cacheable list results, and multi-round-trip requests.

Authorization

Validate issuers, scope credentials narrowly, separate user consent from model intent, and enforce permissions at tool/resource boundaries.

Security

Defend against malicious tool descriptions, prompt injection, confused-deputy behavior, SSRF/data exfiltration, and over-broad credentials.