This lesson is part of Learn MCP, our free course on the Model Context Protocol, within The MCP Guide.
In this lesson you will build a four-week plan to prepare for the MCPA (Model Context Protocol Associate) exam. Each week covers a block of the official exam domains with spec reading, a small hands-on task and a self-test. The last week ends with review and booking.
The plan assumes about five to six hours a week, for example 45 minutes on weekdays and a longer session at the weekend. That is our suggestion, not an official requirement. Stretch it to six or eight weeks if you are newer to APIs or security.
This plan is unofficial. The domains and weights come from the Linux Foundation's MCPA exam page, checked on 28 October 2026. The exam page tells candidates to prepare against MCP specification version 2026-07-28, so every reading link below points at that version.
Key Takeaways
- Spend weeks in rough proportion to domain weight, and give the two heaviest domains, Interactions & Execution (26%) and Security & Governance (24%), a full week each.
- Read primary spec pages daily and turn each one into flashcards in your own words.
- Do one small hands-on task a week; seeing real JSON messages makes the rules stick.
- Self-test at the end of every week and re-read the source for every miss.
- Check the booking rules early: you can schedule up to 90 days out, and you can't change a booking within 24 hours of the start time.
Before you start: set up three things
- A notes file with one heading per domain. Copy the topic list for each domain from the exam page.
- The spec bookmarked at modelcontextprotocol.io/specification/2026-07-28. Make sure the version in the URL says 2026-07-28.
- A test environment. Python 3.11+ or Node.js 20+, plus MCP Inspector. Lesson 13 walks through setup.
Step 1 (Week 1): MCP Fundamentals and Architecture & Components (30%)
Goal: explain what MCP is, its parts, and how one request flows through them.
| Day | Task |
|---|---|
| 1 | Read the spec overview. Write the three security principles from memory. |
| 2 | Read the spec's architecture overview. Draw host, clients and servers. |
| 3 | Read the server features overview. Learn who controls tools, resources and prompts. |
| 4 | Read the base protocol overview sections on _meta and JSON Schema. |
| 5 | Skim our MCP glossary and flag every term you can't define. |
| Weekend | Build the tiny server from Lesson 14 or Lesson 15. Answer practice questions 1 to 4. |
Step 2 (Week 2): Interactions & Execution (26%)
Goal: know the tool call lifecycle, error handling and the 2026-07-28 protocol changes.
| Day | Task |
|---|---|
| 1 | Read the Tools page: listing, calling, results, isError. |
| 2 | Read Versioning and Compatibility: per-request versions, server/discover, the error for unsupported versions. |
| 3 | Read the 2026-07-28 changelog. List every removed and deprecated feature. |
| 4 | Read the multi round-trip requests, progress and cancellation pattern pages. |
| 5 | Read our summary of what changed in the July 2026 spec and compare it with your notes. |
| Weekend | In MCP Inspector (Lesson 19), call a tool with good and bad input and save both raw responses. Label the protocol error and the tool execution error. Answer practice questions 5 to 9. |
Step 3 (Week 3): Security & Governance (24%)
Goal: explain trust boundaries, consent, the main attacks and their mitigations.
| Day | Task |
|---|---|
| 1 | Read the security principles in the spec overview again, then the security section of the Tools page. |
| 2 | Read Security Best Practices: confused deputy and token passthrough. |
| 3 | Same page: SSRF, state handle hijacking and local server compromise. |
| 4 | Same page: scope minimization. Then the authorization overview's step-up flow. |
| 5 | Read the elicitation page's rules on form mode versus URL mode for sensitive data. |
| Weekend | Write a one-page threat model for your Week 1 server, using Lesson 24. Answer practice questions 10 to 15. |
The exam page lists "Auditability & Observability" in this domain. Add the Tools page's client guidance to "log tool usage for audit purposes," and the deprecation of the Logging feature, to your notes.
Step 4 (Week 4): Use Cases & Ecosystem (20%), review and booking
Goal: connect MCP to real roles and products, then consolidate.
| Day | Task |
|---|---|
| 1 | Read the extensions overview plus the Tasks and MCP Apps overviews. |
| 2 | Read the MCP Registry about page and the transports overview (stdio vs Streamable HTTP). |
| 3 | Write five real business scenarios and name the host, client, server and tools in each. |
| 4 | Answer practice questions 16 to 18, then redo every question you missed in earlier weeks. |
| 5 | Re-read your weakest domain's notes. Run the official system check described in Lesson 34. |
| Weekend | Take all 18 practice questions again under a timer, then rest. |
Step 5: Decide when to book
The Linux Foundation's scheduling rules say you can choose a slot up to 90 days out, and the earliest slot is the following day because exams need 24 hours' lead time. You can cancel or reschedule up to 24 hours before the start. Inside 24 hours, no changes are possible.
A sensible approach: buy the exam when you start, book a slot at the end of Week 4, and move it if your Week 3 self-test goes badly. The exam page lists 12-month exam eligibility, and the handbook says that window covers scheduling and taking the exam plus any retake. Lesson 34 covers the rest of the logistics.
Try it
Copy the four weekly tables into your calendar right now. Then:
- Mark the two sessions each week you are most likely to skip, and move them to a better time.
- Pick a target exam date at least 24 hours after your final review day.
- Write down which practice questions you will answer at the end of each week.
Recap
You now have a four-week plan: fundamentals and architecture first, then interactions, then security, then ecosystem and review. Each week mixes primary spec reading, one hands-on task and a self-test. You also know the booking windows so you can schedule without stress. The full course lives at Learn MCP.
Course navigation
Previous lesson: MCPA Practice Questions (Original, With Answers).
Next lesson: MCPA Exam Day: Booking, Rules and What to Expect.
Back to the Learn MCP course outline.
Frequently asked questions
Is four weeks enough?
For someone who already works with APIs and has read about MCP, often yes. If JSON-RPC, OAuth or JSON Schema are new to you, give yourself six to eight weeks. The exam page says the MCPA is a beginner-level exam with no prerequisites, but it recommends some background in those areas.
Do I need to build a server to pass?
The exam page doesn't require it. We recommend a small hands-on task each week because seeing real requests and errors makes the rules easier to remember.
Should I study older spec versions?
Only to understand what changed. The exam page points candidates to version 2026-07-28. Older material may describe the initialize handshake or the Logging feature as current.
What if I miss a week?
Push the plan back a week rather than cramming two domains together. If you already booked, you can reschedule up to 24 hours before the start time, according to the handbook.
Are there official MCPA practice tests?
We did not find any on the exam page when we checked on 28 October 2026. Our practice questions are original and unofficial.
