Model Context Protocol (MCP): The Enterprise Architecture Handbook

1. The Protocol Topology: The USB-C for LLM Applications

Before the Model Context Protocol, every developer platform required proprietary integration glue: OpenAI plugins, LangChain custom tools, Claude-specific XML formatters, and bespoke REST wrappers. MCP establishes an open, vendor-agnostic architecture:

2. The Three Primitives: Tools, Resources, and Prompts

3. Transport Layers: stdio vs. HTTP SSE

MCP supports two primary wire protocols:

• Standard IO (stdio): The host application spawns the server as a local child process and exchanges newline-delimited JSON-RPC messages via standard input/output. Zero network latency, ideal for developer environments and local file tools.
• Server-Sent Events (SSE): Clients establish an HTTP GET request to receive streaming event updates, while sending commands via HTTP POST. Crucial for remote multi-tenant enterprise architectures behind auth gateways.

4. Production Python Server Implementation

Below is a complete, production-grade MCP server using the official Python SDK with type annotations and validation:

import asyncio
from mcp.server.fastmcp import FastMCP

# Initialize MCP server
mcp = FastMCP("enterprise-analytics", dependencies=["psycopg2-binary"])

@mcp.tool()
async def query_warehouse(sql_query: str, max_rows: int = 100) -> str:
    """Execute a read-only analytics query against the database warehouse.
    
    Args:
        sql_query: Sanitized SQL SELECT query.
        max_rows: Maximum records to return (defaults to 100).
    """
    # Guard against accidental mutations
    forbidden = ["DROP", "DELETE", "TRUNCATE", "UPDATE", "INSERT", "ALTER"]
    if any(keyword in sql_query.upper() for keyword in forbidden):
        raise ValueError("Mutation queries are strictly prohibited on analytics replica.")
    
    # Execute query safely and return formatted Markdown table
    return f"Executed query with {max_rows} rows limit applied."

if __name__ == "__main__":
    mcp.run(transport="stdio")

5. Security Sandboxing & Indirect Injection Defense

Because MCP servers grant LLMs execution capabilities over host infrastructure, they represent a prime target for indirect prompt injection attacks. Always enforce:

1. Strict Parameter Schemas: Use Pydantic or Zod to constrain inputs to explicit types, regex patterns, and enums. Never accept raw unvalidated shell strings.
2. Path Boundary Traversal Checks: Verify all file access paths resolve inside designated workspace directories using canonical path checking.
3. Human-in-the-Loop Confirmation: Require client-level approval before executing any irreversible action (e.g., git push, file deletion, database modification).

6. Interactive Schema Generator

Design your custom tools and generate instant configuration blocks for Claude Desktop and Cursor using our interactive tool: