MCP · Series

MCP: Building a Production Server

Building a production-grade MCP (Model Context Protocol) server that wraps a self-hosted Moodle LMS — role-gated tools, resources, and prompts, with real OAuth 2.1 auth. One post per build phase, from a stdio prototype to a secured, deployed server. Code lives in the companion repo.

Code & notebooks on GitHub

0 of 6 posts complete0%

What is MCP, Actually?

~8 min read

FoundationsConcept

The gentle intro: what the Model Context Protocol is, why it exists, and what its three building blocks do — no code, USB-C analogy, built for someone who has never heard of MCP.

I Built an MCP Server for Moodle

~12 min read

Phase 3Build

A step-by-step build log: an MCP server that lets an AI use a real learning platform, pinned to real commits — the messy legacy API, and the clean tools that hide it.

RBAC in MCP: Different Tools for Different Users

Phase 4Build

Streamable HTTP transport and per-caller token mapping — a student and a teacher connect to the same server and see different tool lists.

MCP Auth, Done Right

Phase 5Deep Dive

The flagship: full OAuth 2.1 per the MCP spec — Keycloak, Protected Resource Metadata, scopes, Dynamic Client Registration, and why token passthrough is forbidden.

Securing an MCP Server

Phase 6Build

Sampling-powered tools plus a hardening pass: tool poisoning, prompt injection, the confused deputy, and least privilege.

From Docker to Kubernetes on GCP

Phase 7Ops

The deferred deployment story: Compose → kind → GKE Autopilot / Cloud Run, packaged with a Helm chart — portable, with no paid dependency until the end.