Lecture 05. Tools and MCP as API contracts
Part 2 · The Agent as Tested Subsystems · Scheduled 6 Dec 2026 · 1-hour lecture
Upcoming course outline. This class has not been recorded as studied.
Learning objectives
- From function calling to MCP: host, client and server roles; JSON-RPC messages; stdio and Streamable HTTP transports.
- The client side: initialize, list tools, call a tool, handle errors and timeouts; how the host merges tools from many servers.
- The server side: tool, resource and prompt definitions; descriptions written for a model reader; versioning.
- Auth and least privilege; audit before connect, read-only default, project scope (Day 2 pp. 15-17).
- Attacks: tool shadowing, injected tool descriptions, supply chain (OWASP ASI04).
Why this class matters
- Industry: MCP is the integration layer companies now ask for; students design both sides and know the security checklist.
- Academic: Tool-use papers (Toolformer, BFCL) give the vocabulary to study tool selection and failure.
- Elsewhere: Students connect any coding agent to internal systems without a vendor SDK.
Preparation requirements
- Stanford CS329Z L4 slides.
- Google Day 2 2026 paper pp. 15-17 and Google Agent Tools & MCP 2025.
- OWASP Agentic Top 10 2026 (ASI04); MCP specification.
- The paper (Schick et al. 2023) as pre-reading.
These are preparation requirements in the draft; staff materials are not bundled with this site.
Preparation and readings
- Stanford CS329Z L4: Tool use and function calling (slides)
- Google/Kaggle 2026, Day 2: Agent Tools & Interoperability
- OWASP Top 10 for Agentic Applications 2026
- MCP specification
- Schick et al., Toolformer (NeurIPS 2023)
The linked reference library contains the source URLs extracted from the course PDF. Availability notes above reflect the draft of 4 November 2026.
Paired lab
Continue with Lab 05: Tools and MCP as API contracts. Every lab contributes an artifact to the same repository and a measurement to the results ledger.
Personal notes
[Lecture notes and observations]