MCPA Study Guide: Domain by Domain

In this lesson you will build a study map for the MCPA (Model Context Protocol Associate) exam. For each of the five official domains you will see its weight, the topics the Linux Foundation lists, the parts of the MCP specification to read, the key ideas to know cold, and a few self-check questions.

This is an unofficial guide written by eSEOspace. It is not endorsed by the Linux Foundation or the Agentic AI Foundation, and it does not contain real exam questions. The domain names, weights and topics come from the official MCPA exam page, checked on 28 October 2026. Which spec pages map to which domain is our own reading, so treat it as a suggestion.

If you are new to the credential itself, read what the MCPA covers and proves first.

The five domains at a glance

Study time roughly in proportion to weight, with extra time on whatever feels weakest.

Step 1: MCP Fundamentals (16%)

Read: the specification overview and the introduction on modelcontextprotocol.io. Our what is MCP guide is a plain-English warm-up.

Know cold:

• MCP is an open protocol that connects AI applications to external data and tools, using JSON-RPC 2.0 messages.
• Server features: resources, prompts and tools. Client feature: elicitation.
• The three security principles in the spec: user consent and control, data privacy, and tool safety.
• MCP is governed by the Agentic AI Foundation under the Linux Foundation.

Self-check: Can you explain in two sentences why a standard protocol beats one-off integrations? Can you name each server feature and say who controls it (model, application or user)?

Step 2: Architecture & Components (14%)

Read: Hosts, clients and servers, the spec's base protocol overview and the Tools page sections on inputSchema and outputSchema.

Know cold:

• A host runs one or more clients; each client connects to one server.
• Every 2026-07-28 request carries its protocol version and client capabilities in _meta.
• Tools declare input with JSON Schema and can declare an output schema; the changelog says any JSON Schema 2020-12 keywords are now allowed.
• Structured results go in structuredContent, and the spec suggests also returning the serialized JSON as text for older clients.

Self-check: Draw the path of one tool call from the user's prompt to the result. Where does the model decide, and where does the host ask for consent?

Step 3: Interactions & Execution (26%)

This is the biggest domain. Spend the most time here.

Read: the Tools page, Versioning and Compatibility, the 2026-07-28 changelog, and the pattern pages for multi round-trip requests, progress and cancellation.

Know cold:

• The tool lifecycle: discovery with tools/list, invocation with tools/call, and a result with resultType.
• Two kinds of tool errors. Protocol errors (unknown tool, malformed request) are JSON-RPC errors. Tool execution errors (bad input, API failure) come back in the result with isError: true so the model can self-correct. See how MCP servers report tool errors.
• Unsupported versions return UnsupportedProtocolVersionError (-32022) with a list of supported versions.
• Multi round-trip requests: a server returns resultType: "input_required" with inputRequests instead of sending its own requests to the client.
• server/discover is mandatory for servers; clients may call it first but don't have to.
• What was removed in 2026-07-28: the initialize handshake, protocol-level sessions, ping and logging/setLevel.

Self-check: A tool receives a date in the past. Which error type should it return, and why? A client asks for version 1900-01-01. What comes back?

Step 4: Security & Governance (24%)

Read: the spec's Security Best Practices, the authorization overview, and the Tools page's security section. Our MCP security best practices page summarizes them.

Know cold:

• Hosts must get explicit user consent before invoking tools, and there should always be a human able to deny a tool call.
• Tool annotations are hints and are untrusted unless they come from a trusted server.
• Servers must not accept tokens that were not issued for them (no token passthrough).
• Confused deputy: proxy servers must get per-client consent and match redirect URIs exactly.
• Servers must not treat a state handle as authentication.
• Least-privilege scopes with step-up via insufficient_scope.
• For auditability: clients should log tool usage, and servers should log scope elevation events with correlation IDs.

Self-check: Name three things a tool-calling server MUST do according to the Tools page. (Answer: validate inputs, implement access controls, rate limit, sanitize outputs.)

Step 5: Use Cases & Ecosystem (20%)

Read: the extensions overview, the MCP Registry docs, the official SDK list, and our MCP examples for business scenarios.

Know cold:

• Official extensions include Tasks, MCP Apps, Skills over MCP and the authorization extensions; all are opt-in on both sides.
• The MCP Registry hosts metadata, not code, verifies namespaces, and is in preview as of October 2026.
• Local servers usually use stdio; remote servers use Streamable HTTP. HTTP+SSE is deprecated.
• Portability: one server works with any compliant host, which is the core value of a standard.

Self-check: A team wants an AI app to read their CRM and post to chat. Which roles (host, client, server) does each part play, and who is responsible for consent?

Step 6: Turn the map into a routine

Read one spec page a day, write five flashcards from it, and answer a few practice questions at the end of each week. Our 4-week MCPA study plan lays this out day by day.

Try it

Pick the domain you feel weakest in. Open its first "Read" link and write:

1. Three facts from the page, in your own words.
2. One MUST and one SHOULD from the page, quoted exactly.
3. One question you would expect a careful examiner to ask about it.

Repeat for a second domain tomorrow.

Recap

You now have a map of all five MCPA domains, with weights, official topics, the spec pages to read and the core ideas to know. Half the weight sits in runtime interactions and security, and the 2026-07-28 spec changes are central. Next, test yourself with original practice questions.

Course navigation

Previous lesson: Lesson 30: Capstone: Plan a Real Server.

Next lesson: MCPA Practice Questions (Original, With Answers).

Back to the Learn MCP course outline.

Frequently asked questions