MCP Academy is the premier free interactive learning platform by Infinity Tech Stack for Anthropic's Model Context Protocol (MCP), now governed by the Linux Foundation. It features 13 modules, 48 lessons, 48 hands-on terminal labs, and 140 quizzes covering MCP servers, clients, tools, Streamable HTTP, OAuth 2.1, and the 2026-07-28 stateless specification with zero sign-up required.

How is Infinity MCP Academy different from official Model Context Protocol documentation?

While modelcontextprotocol.io provides the core technical specifications and basic SDK quickstarts, Infinity Tech Stack's MCP Academy is an independent, 100% free interactive curriculum with 13 modules, 48 lessons, 48 in-browser terminal labs, and 140 quizzes. It teaches real-world server and client development, Streamable HTTP, OAuth 2.1, the 2026-07-28 stateless core specification, multi-server gateways, and enterprise security with zero sign-up required.

How long does MCP Academy take to complete?

MCP Academy contains approximately 4 to 5 hours of interactive training across 13 modules and 48 lessons. Progress is saved locally in your browser so you can learn at your own pace.

Is the MCP Academy free?

Yes. The MCP Academy is free to access, with modules, lessons, quizzes, and labs available without sign-up.

What is the Model Context Protocol (MCP)?

MCP is an open standard (now governed by the Linux Foundation) that provides a universal way for AI models and agents to connect to tools, data sources, and external systems. Think of it as USB-C for AI.

What topics does the MCP Academy cover?

The course covers MCP architecture, server/client development, tools & function calling, resources & prompts, transport layers (stdio, Streamable HTTP), OAuth 2.1 security, production deployment, MCP Gateways & Proxies, Linux Foundation governance, enterprise audit logging, multimodal/audio content, client SDK development, MCP Inspector debugging, integration testing, the official MCP Registry, and real-world case studies from DevOps, CRM, and AI coding assistant deployments.

What is an MCP Gateway?

An MCP Gateway sits between AI clients and multiple MCP servers, providing semantic routing, tool aggregation, token optimization, and centralized observability - similar to an API gateway but for the MCP protocol.

Do I need programming experience?

Basic familiarity with JSON and APIs is helpful but not required. The course starts from fundamentals and builds progressively to advanced production patterns, including hands-on server building tutorials.

How do I debug MCP servers?

The course teaches you to use the MCP Inspector (an official interactive debugging tool), write automated integration tests using the Client SDK, and diagnose common issues like stdout corruption and capability negotiation failures.

Does the MCP Academy include hands-on labs?

Yes. Hands-on terminal labs are embedded in relevant lessons, including objectives, hints, solution commands, and XP rewards.

What is the latest version of MCP?

The current MCP specification revision is 2026-07-28, which shipped after its Release Candidate and made the protocol fully stateless - removing the initialize handshake and protocol-level sessions entirely, adding a mandatory server/discover RPC, and moving Tasks out of the core spec into an official extension. The previous 2025-11-25 revision introduced experimental Tasks, URL-mode elicitation, tool calling in sampling, icon metadata for tools and resources, OpenID Connect Discovery, OAuth Client ID Metadata Documents, and JSON Schema 2020-12 as the default dialect.

MCP Tasks (originally introduced experimentally as SEP-1686 in 2025-11-25 and formalized in 2026-07-28 as the official io.modelcontextprotocol/tasks extension) support long-running, durable operations. Instead of blocking on a single HTTP request, a server returns a task handle that the client polls via tasks/get or updates via tasks/update - essential for agent workflows that run for minutes or hours.

What is the difference between MCP and function calling?

Function calling lets a single model invoke functions you define inline for that one app. MCP is an open, transport-based standard that exposes tools, resources, and prompts from independent servers to any compatible client - so one MCP server works across Claude, ChatGPT, Cursor, and VS Code without rewriting integrations.

How do I build an MCP server?

Scaffold a server with the official Python or TypeScript SDK, register tools (functions), resources (data), and prompts, then expose it over stdio for local use or Streamable HTTP for remote use. The MCP Academy includes hands-on labs that build, connect, and inspect a real server step by step.

What is the best MCP course?

The MCP Academy is a free, interactive course with 13 modules, 48 lessons, 48 hands-on terminal labs, and 140 quiz questions - covering everything from MCP architecture to production security, gateways, the official MCP Registry, and the latest 2026-07-28 stable spec. Progress saves locally with no sign-up required.

What do .well-known endpoints (such as /.well-known/oauth-protected-resource under RFC 9728 and MCP Server Cards) provide?

Standardized JSON metadata for OAuth authorization server discovery, required scopes, and server capabilities — RFC 9728 (/.well-known/oauth-protected-resource) lets clients discover trusted Authorization Servers and scopes, while MCP Server Cards expose server identity and capabilities before tool execution.

Why is audit logging critical for enterprise MCP?

To provide full visibility into which agents called which tools with what arguments — Audit logging provides the compliance trail enterprises need - who did what, when, and with what result.

Enterprise Security & Audit — MCP in 2026

← Back to Dashboard

1. Governance & the Linux Foundation2. MCP Gateways & Proxies3. Enterprise Security & Audit4. Multimodal & Audio Content5. The Official MCP Registry

Enterprise Security & Audit

📚 MCP in 2026⏱ 9 min⭐ 130 XP⌨ Hands-on lab

Production-ready MCP

Production MCP deployments in 2026 require security controls far beyond basic OAuth tokens. The Security Working Group has defined standards for:

Audit Logging

Every MCP interaction should be logged with:

Field	Purpose
Timestamp	When the action occurred
Client ID	Which user/agent made the request
Server ID	Which MCP server handled it
Tool Called	Exact tool name and arguments
Result	Success/failure + truncated response
Token Count	Tokens consumed for billing

Incremental Scope Consent

Instead of granting an MCP server blanket access, users can grant incremental permissions:

First request: "Can I read your calendar?" → User approves read:calendar
Later: "Can I create events?" → User approves write:calendar

Each scope is granted individually via WWW-Authenticate step-up challenges (insufficient_scope), never all-or-nothing.

Discovery via `.well-known` (RFC 9728 & Server Cards)

Remote MCP servers expose /.well-known/oauth-protected-resource (RFC 9728) so clients discover trusted OAuth 2.1 authorization servers and required scopes upfront, alongside emerging .well-known MCP Server Cards describing capabilities and publisher identity before invoking tools.

🔒 Security Rule: In enterprise environments, all MCP servers should be registered in an internal catalog with mandatory audit logging and RFC 8707 audience validation. Shadow MCP servers are as dangerous as shadow IT.

⌨ HANDS-ON LABInspect Central MCP Audit Log

⭐ +125 XP

Verify tool call telemetry and audit trail entries in the central security log.

1Inspect or initialize the MCP security audit log.

lab-sandbox — simulated environment

INFINITY LAB SANDBOX v2.6 — simulated shell
Type the command for the current objective. Helpers: "hint", "solution", "clear".
$

OBJECTIVE 1 / 1 — type "hint" if stuck

🧪 Knowledge Check

Press 1-4 to select1 of 3

What is incremental scope consent?

Granting all permissions at once

Granting permissions one at a time via step-up OAuth challenges as the server needs them

Revoking all access periodically

Using a master password