MCP Academy is the premier free interactive learning platform by Infinity Tech Stack for Anthropic's Model Context Protocol (MCP), now governed by the Linux Foundation. It features 13 modules, 48 lessons, 48 hands-on terminal labs, and 140 quizzes covering MCP servers, clients, tools, Streamable HTTP, OAuth 2.1, and the 2026-07-28 stateless specification with zero sign-up required.

How is Infinity MCP Academy different from official Model Context Protocol documentation?

While modelcontextprotocol.io provides the core technical specifications and basic SDK quickstarts, Infinity Tech Stack's MCP Academy is an independent, 100% free interactive curriculum with 13 modules, 48 lessons, 48 in-browser terminal labs, and 140 quizzes. It teaches real-world server and client development, Streamable HTTP, OAuth 2.1, the 2026-07-28 stateless core specification, multi-server gateways, and enterprise security with zero sign-up required.

How long does MCP Academy take to complete?

MCP Academy contains approximately 4 to 5 hours of interactive training across 13 modules and 48 lessons. Progress is saved locally in your browser so you can learn at your own pace.

Is the MCP Academy free?

Yes. The MCP Academy is free to access, with modules, lessons, quizzes, and labs available without sign-up.

What is the Model Context Protocol (MCP)?

MCP is an open standard (now governed by the Linux Foundation) that provides a universal way for AI models and agents to connect to tools, data sources, and external systems. Think of it as USB-C for AI.

What topics does the MCP Academy cover?

The course covers MCP architecture, server/client development, tools & function calling, resources & prompts, transport layers (stdio, Streamable HTTP), OAuth 2.1 security, production deployment, MCP Gateways & Proxies, Linux Foundation governance, enterprise audit logging, multimodal/audio content, client SDK development, MCP Inspector debugging, integration testing, the official MCP Registry, and real-world case studies from DevOps, CRM, and AI coding assistant deployments.

What is an MCP Gateway?

An MCP Gateway sits between AI clients and multiple MCP servers, providing semantic routing, tool aggregation, token optimization, and centralized observability - similar to an API gateway but for the MCP protocol.

Do I need programming experience?

Basic familiarity with JSON and APIs is helpful but not required. The course starts from fundamentals and builds progressively to advanced production patterns, including hands-on server building tutorials.

How do I debug MCP servers?

The course teaches you to use the MCP Inspector (an official interactive debugging tool), write automated integration tests using the Client SDK, and diagnose common issues like stdout corruption and capability negotiation failures.

Does the MCP Academy include hands-on labs?

Yes. Hands-on terminal labs are embedded in relevant lessons, including objectives, hints, solution commands, and XP rewards.

What is the latest version of MCP?

The current MCP specification revision is 2026-07-28, which shipped after its Release Candidate and made the protocol fully stateless - removing the initialize handshake and protocol-level sessions entirely, adding a mandatory server/discover RPC, and moving Tasks out of the core spec into an official extension. The previous 2025-11-25 revision introduced experimental Tasks, URL-mode elicitation, tool calling in sampling, icon metadata for tools and resources, OpenID Connect Discovery, OAuth Client ID Metadata Documents, and JSON Schema 2020-12 as the default dialect.

MCP Tasks (originally introduced experimentally as SEP-1686 in 2025-11-25 and formalized in 2026-07-28 as the official io.modelcontextprotocol/tasks extension) support long-running, durable operations. Instead of blocking on a single HTTP request, a server returns a task handle that the client polls via tasks/get or updates via tasks/update - essential for agent workflows that run for minutes or hours.

What is the difference between MCP and function calling?

Function calling lets a single model invoke functions you define inline for that one app. MCP is an open, transport-based standard that exposes tools, resources, and prompts from independent servers to any compatible client - so one MCP server works across Claude, ChatGPT, Cursor, and VS Code without rewriting integrations.

How do I build an MCP server?

Scaffold a server with the official Python or TypeScript SDK, register tools (functions), resources (data), and prompts, then expose it over stdio for local use or Streamable HTTP for remote use. The MCP Academy includes hands-on labs that build, connect, and inspect a real server step by step.

What is the best MCP course?

The MCP Academy is a free, interactive course with 13 modules, 48 lessons, 48 hands-on terminal labs, and 140 quiz questions - covering everything from MCP architecture to production security, gateways, the official MCP Registry, and the latest 2026-07-28 stable spec. Progress saves locally with no sign-up required.

Why is authentication crucial for HTTP MCP servers?

Because exposed Tools could allow attackers to execute internal code or read private databases. — Unprotected servers expose their capabilities globally, leading to severe remote-code execution or data-breach vulnerabilities.

Does stdio transport require OAuth?

No, stdio relies on the local user's OS-level process permissions. — Since it is an internal subprocess, stdio inherits the host user's permissions and requires no external network authentication.

OAuth & Security — Production & Sec

← Back to Dashboard

1. OAuth & Security2. Deployment Strategies3. MCP Across Tools4. Agentic Orchestration5. Remote MCP & Connectors

OAuth & Security

📚 Production & Sec⏱ 9 min⭐ 110 XP⌨ Hands-on lab

OAuth 2.1 Authorization over Streamable HTTP

When running local stdio servers, access relies on local OS process permissions. Once you deploy an MCP Server over Streamable HTTP, the MCP specification mandates a rigorous OAuth 2.1 security architecture where the MCP server acts strictly as an OAuth 2.1 Resource Server:

Protected Resource Metadata (RFC 9728): Unauthenticated requests receive 401 Unauthorized with a WWW-Authenticate header pointing to /.well-known/oauth-protected-resource, telling clients which Authorization Server(s) and scopes protect the MCP endpoint.
Authorization Server Discovery (RFC 8414 & OIDC 1.0): Clients inspect /.well-known/oauth-authorization-server or /.well-known/openid-configuration to locate authorization, token, and JWKS endpoints automatically.
Client ID Metadata Documents (CIMD): Introduced in 2025-11-25 (and deprecating RFC 7591 Dynamic Client Registration in 2026-07-28), clients identify themselves using an HTTPS URL as their client_id that hosts a signed/verified client metadata JSON document.
Mandatory PKCE & Resource Indicators (RFC 8707): Clients execute OAuth 2.1 with PKCE and pass the resource parameter (e.g., resource=https://mcp.acme.com/mcp) to bind the minted Bearer token strictly to that MCP server's audience—preventing confused-deputy token passthrough to downstream APIs.

🔒 Security Invariant (No Token Passthrough): An MCP server MUST validate that incoming Bearer tokens were explicitly issued for its own canonical URI (RFC 8707 audience check) and MUST NEVER blindly forward a client's MCP access token to upstream APIs.

⌨ HANDS-ON LABAuthenticate Remote Client with OAuth Bearer

⭐ +150 XP

Authorize against an enterprise MCP OAuth 2.1 protected endpoint with a Bearer token.

1POST to the enterprise Streamable HTTP /mcp endpoint with an Authorization Bearer header.

lab-sandbox — simulated environment

INFINITY LAB SANDBOX v2.6 — simulated shell
Type the command for the current objective. Helpers: "hint", "solution", "clear".
$

OBJECTIVE 1 / 1 — type "hint" if stuck

🧪 Knowledge Check

Press 1-4 to select1 of 3

What protocol stack is standardized for securing remote Streamable HTTP MCP servers?

Basic Auth over plain text

OAuth 2.1 with PKCE, RFC 9728 Protected Resource Metadata, and RFC 8707 Resource Indicators

IP Whitelisting only

Custom cryptographic handshakes