Anthropic released the Model Context Protocol (MCP) in November 2024 and it went from experimental to table-stakes in under twenty months. Every serious agentic-AI stack — Claude Desktop, Cursor, Windsurf, Cline, Zed, and increasingly custom enterprise deployments — consumes MCP servers to reach internal systems. But the content ecosystem is stuck on hello-world weather servers. Every consultancy pitching agentic AI needs to build MCP servers over Salesforce, Jira, Confluence, SAP, and legacy SOAP APIs, and there is no canonical guide.
This hub is for enterprise platform engineers, backend developers building agentic products, and consultants standing up MCP servers over regulated systems. It curates the skills you actually need beyond the "how to expose a weather API" quickstarts: OAuth 2.1 flows with per-tenant scoping, rate-limit and cost governance for expensive tool calls, audit logging for compliance, and the operational tradeoffs between MCP-over-HTTP and stdio at scale. If you have been given the assignment "let our internal Claude and Cursor deployments read our systems," this is the reading list.
Who this hub is for
Enterprise architects, platform engineers, and backend developers at Fortune 500 or scale-up companies building MCP servers for internal systems.
An MCP server is a small program that exposes tools, resources, and prompts to an AI agent over a standard protocol Anthropic released in November 2024. Instead of building custom integrations for every AI client, you build one MCP server and every MCP-capable client — Claude Desktop, Cursor, Windsurf, Cline — can use it. Think of it as USB for AI tool calling: one plug, many devices.
Function calling is proprietary to OpenAI and other vendors that have adopted its shape. MCP is an open protocol that any AI client can implement. If you are building a tool that only your OpenAI-based app will use, function calling is fine. If you want the same tool available to Claude, Cursor, and future agents, build an MCP server. The two are not mutually exclusive — you can wrap an MCP server behind a function-calling façade.
MCP servers accept an OAuth 2.1 access token per request. For multi-tenant deployments you scope the token to the tenant and pass it through to the downstream system on the user's behalf. Store refresh tokens in a KMS-encrypted store, never in the MCP server's memory. Rotate short-lived access tokens every 15–60 minutes. See our full pattern in the linked skill.
stdio (subprocess) is fine for single-user local tools — Claude Desktop reads your filesystem, Cursor talks to a local dev database. HTTP (or SSE) is required for multi-tenant, remote, or high-availability MCP servers. HTTP also lets you put a normal API gateway in front for rate limiting, WAF, and observability. For any production deployment beyond a single laptop, use HTTP.
Yes. Every tool call is effectively an authorization boundary. Enforce least-privilege scopes per tenant, log every tool invocation with the prompt that triggered it (for audit), and never let an MCP server execute arbitrary code without a signed policy. The OWASP LLM Top 10 (v2) applies — indirect prompt injection through retrieved documents is the top real-world attack vector against MCP.
Anthropic ships official SDKs for TypeScript and Python — both are production-ready. For enterprise systems where you already have Java or C# backends, community SDKs exist and are viable. Start with TypeScript for prototyping, move to Python if your ML team owns the integration, use Java only if you must live inside an existing JVM monolith.