🌍 Real-World Projects

Project planning involves defining which features the task manager will have, how data will be stored, and which tools will be exposed via MCP. This is the time to think before coding.

Planning before implementation avoids rework and ensures that you build a cohesive server. This discipline is essential in any professional project.

Requirements gathering, scope definition, tool design, data architecture, MVP.

The data structure defines how each task will be represented in JSON—with fields such as id, title, description, status, creation date, and priority. The JSON file serves as a simple, portable database.

Modeling data correctly is the foundation of any application. A well-defined schema makes tool implementation easier and prevents inconsistency bugs.

JSON schema, data modeling, required vs. optional fields, data types, file persistence.

The creation tool receives a title, description, and priority as parameters, generates a unique ID, records the creation date, and saves the new task to the JSON file. It is the server's first CRUD operation.

Create is the most fundamental operation. Implementing it as an MCP tool teaches you the complete workflow: receive parameters, validate, process, and return a result.

CRUD, ID generation, input validation, file writing, structured response, inputSchema.

The listing tool reads the JSON file and returns the tasks, with options to filter by status (pending, in progress, completed) and priority. It lets Claude present the tasks to the user in an organized way.

Filtered listing is an essential operation in any system. You’ll learn to implement optional parameters and output formatting for the model.

File reading, data filtering, optional parameters, output formatting, pagination.

The update and remove tools complete CRUD. Update lets you change the status, title, or priority of an existing task. Remove deletes a task by ID. Both include validation to ensure the task exists.

Write operations require extra care: existence validation, error handling, and atomicity. These practices are essential in any real project.

Update, delete, ID validation, error handling, atomicity, feedback to the model.

End-to-end testing of the task manager: configure it in Claude Desktop, create tasks through natural conversation, list them with filters, update their status, and remove tasks. Verify that the JSON file persists correctly between sessions.

Testing the complete workflow reveals bugs that unit tests don't catch. This is the time to validate that everything works as an integrated system.

End-to-end testing, usage scenarios, edge cases, persistence, MCP server debugging.

SQLite is an embedded relational database that doesn't need a separate server. With Python, we use the built-in sqlite3 module to create, query, and manipulate data. It's perfect for MCP projects because of its simplicity and portability.

SQLite is the most widely used database in the world. Mastering it with Python gives you the foundation to connect any database to an MCP Server.

SQLite, sqlite3 module, connection, cursor, embedded database, zero configuration.

Creating a sample database with tables such as customers, products, and orders, populated with realistic data. This database will serve as the basis for queries to the MCP Server, simulating a real business scenario.

Having realistic data to test with is essential. You learn to create relational schemas and populate tables, essential skills for any developer.

CREATE TABLE, INSERT, SQL data types, primary keys, foreign keys, seed data.

The query tool receives an SQL query or a description in natural language, runs the SELECT against the database, and returns formatted results. Claude translates natural-language questions into SQL and presents the results in a readable format.

Natural language queries about databases are one of MCP's most powerful use cases. You turn raw data into information anyone can access.

SELECT, result formatting, natural language to SQL translation, row limit, column metadata.

Tools for INSERT and UPDATE let Claude add new records and update existing data in the database. Includes field validation, confirmation before execution, and feedback on affected rows.

Write operations are more delicate than reads. You’ll learn to implement confirmations, rollback, and feedback—essential patterns for servers that modify data.

INSERT, UPDATE, validation, confirmation, affected rows, commit, rollback.

SQL injection is an attack in which malicious code is inserted into SQL queries. Protection involves using parameterized queries, sanitizing inputs, limiting database permissions, and restricting which operations the MCP Server can execute.

Security isn't optional. An MCP Server that accesses a database without protection against injection is a serious vulnerability. This knowledge protects your data and your users.

SQL injection, parameterized queries, sanitization, principle of least privilege, operation whitelist.

Hands-on test where you ask Claude questions like "what orders were placed last month?" or "which customer bought the most?" and it translates them to SQL, runs them via the MCP Server, and presents the results in a user-friendly way.

Seeing the complete flow in action—from the natural-language question to the formatted result—reinforces everything you've learned and shows the real power of a database MCP Server.

Natural language to SQL, interactive testing, complex scenarios, joins, aggregations, data presentation.

Planning defines which file operations the MCP Server will offer: reading, summarizing, searching content, statistics, and automatic organization. Each feature becomes a tool with well-defined parameters and return values.

Planning the tools before implementation ensures consistency and avoids overlapping functionality. Good API design is the foundation of a usable server.

API design, file operations, permission scope, separation of responsibilities, naming conventions.

The read tool opens a file by path and returns its contents to Claude, which can then summarize or explain it, or answer questions about it. It supports different formats such as text, Markdown, code, and CSV.

Reading and interpreting files is one of the most practical uses of MCP. You turn Claude into an assistant that understands your local documents.

File reading, encoding detection, size limit, supported formats, IO error handling.

The search tool scans files in a folder for a term or pattern. It returns files that contain the term, with context snippets around each occurrence, similar to an intelligent grep.

Searching files is extremely useful for finding information in projects, documentation, or notes. Claude becomes a research assistant for your local files.

Recursive search, regex, match context, extension filter, performance in large directories.

The statistics tool analyzes a folder and returns metrics such as total number of files, total size, distribution by file type, largest files, most recent files, and subdirectory structure.

Having a quick overview of a folder is useful for understanding projects, identifying organizational problems, and finding files that need attention.

Directory analysis, file metrics, grouping by extension, formatted size, directory tree.

The organization tool moves files into subfolders based on their type: images to /imagens, documents to /documentos, and code to /codigo. It includes a preview before execution and an option to undo.

Organization automation is a powerful, practical use case. You’ll learn to implement destructive operations safely — preview, confirmation, and rollback.

File movement, categorization by extension, operation preview, dry run, rollback.

Hands-on test of the file assistant: ask Claude to summarize a document, search for information across multiple files, show project statistics, and organize a messy folder. Complete validation of all tools.

Testing with real-world scenarios ensures the server works in practical conditions. You discover edge cases and improve the user experience.

Functional testing, real-world usage scenarios, file edge cases, permissions, encoding, large files.

The GitHub REST API lets you access repositories, issues, pull requests, and more via HTTP. Understanding its endpoints, JSON response format, pagination, and rate limits is essential for creating an MCP Server that consumes it.

The GitHub API is one of the best-documented REST APIs in the world. Learning to consume it via MCP prepares you to integrate any REST API with the protocol.

REST API, endpoints, HTTP methods, JSON, pagination, rate limiting, API documentation.

Authentication with the GitHub API uses Personal Access Tokens (PAT). You’ll learn to create tokens with minimal scopes, store them securely using environment variables, and use them in the MCP Server without exposing them in the code.

Managing credentials securely is critical in any integration. The practices learned here apply to any API that requires authentication.

Personal Access Token, scopes, environment variables, .env, credential security, Bearer token.

The repository listing tool queries the GitHub API and returns the authenticated user's repositories, with information such as name, description, language, stars, and last updated date. It supports filters by visibility and sorting.

It’s the first tool that consumes a real external API. You’ll learn the complete pattern: making an HTTP request, handling the response, formatting it for the model, and dealing with network errors.

GET request, JSON parsing, data formatting, filters, sorting, HTTP error handling.

The issue search tool lets you query issues in a specific repository, filtering by status (open, closed), labels, and search terms. It returns each issue’s title, description, author, labels, and comments.

Issues are at the heart of project management on GitHub. With this tool, Claude can help analyze, prioritize, and respond to issues intelligently.

Issues API, state filters, labels, text search, result pagination, nested data.

The issue creation tool sends a POST to the GitHub API with a title, body, labels, and assignees. Claude can create well-formatted issues from the user's natural-language descriptions.

Creating resources via API is a write operation that requires care. You learn to implement confirmation before execution and format data for sending via POST.

POST request, request body, input validation, action confirmation, creation response, status 201.

End-to-end testing of the GitHub integration: list repos, search for a project's issues, create a new issue, and verify that it appears on GitHub. Includes error tests such as an invalid token and a nonexistent repository.

Testing integrations with external APIs requires considering scenarios that don't occur in local projects: latency, network errors, rate limits, and unexpected responses.

Integration testing, mocking, error scenarios, timeout, retry, rate limiting, data validation.

The MCP architecture lets a Host connect to multiple Servers simultaneously. Each server specializes in a task, and Claude automatically orchestrates between them, creating an assistant that combines various capabilities.

Combining servers is what makes MCP truly powerful. Instead of one monolithic server, you compose modular capabilities that can be reused in different contexts.

Server composition, modularity, specialization, model orchestration, reuse.

Configuring multiple servers in Claude Desktop involves adding several entries to the claude_desktop_config.json file, each with its own command, arguments, and environment variables. Claude connects to all of them simultaneously at startup.

Knowing how to configure multiple servers is the practical skill that turns Claude Desktop into a personalized assistant with all your favorite tools.

claude_desktop_config.json, multiple entries, environment variables per server, simultaneous startup, naming.

When multiple servers are connected, Claude receives the full list of available tools and automatically chooses which one to use based on the user's intent. Each tool's name and description are essential for this intelligent routing.

Understanding how Claude routes between servers helps you create tools with names and descriptions that make it easier to choose the right one, avoiding ambiguity and conflicts.

Tool routing, descriptive names, ambiguity resolution, tool discovery, decision context.

Practical example combining the task manager (Module 4.1) with the database consultant (Module 4.2). Claude can create tasks based on database data or query the database to prioritize existing tasks.

This concrete example shows how two independent servers complement each other. It’s practical proof that modularity works and produces emergent capabilities.

Practical composition, multi-server flow, emerging capabilities, business scenario, cross-referenced data.

Practical example combining the file assistant (Module 4.3) with the GitHub integration (Module 4.4). Claude can read local code, analyze bugs, and automatically create GitHub issues with relevant context.

This scenario simulates a real development workflow. Combining local code reading with issue management creates a truly useful development assistant.

Development workflow, code analysis, automatic issue creation, cross-context, automation.

Full test of the multi-server assistant: chat with Claude using 3-4 servers simultaneously, verify that it chooses the right server for each task, test scenarios involving multiple servers in sequence, and evaluate the overall experience.

The multi-server test reveals naming problems, tool conflicts, and context limits. It is the definitive test of your MCP architecture.

Multi-server testing, name conflicts, context limit, performance, user experience, debugging.

MCP Servers have access to real resources: files, databases, APIs, and systems. An insecure server can expose sensitive data, perform destructive actions, or be exploited through prompt injection. Security isn’t an extra; it’s a necessity.

Understanding the real risks motivates you to implement security practices. Without this awareness, developers create servers that work but are dangerous in production.

Attack surface, prompt injection, data exposure, destructive actions, developer responsibility.

The principle of least privilege states that a server should have access only to the resources strictly necessary for its function. A file-reading server doesn't need write permission. A SQL query server doesn't need DELETE permission.

This principle is the most effective defense against errors and attacks. Limiting permissions drastically reduces the impact of any security failure.

Least privilege, granular permissions, minimum scope, sandboxing, resource isolation.

Secure credential management means never hardcoding tokens in code, using environment variables or secret managers, rotating tokens periodically, and using the minimum required scopes. Each server should have its own isolated credentials.

Credential leaks are among the most common and serious vulnerabilities. Good token management practices protect your services and users.

Environment variables, secret managers, token rotation, minimum scopes, .gitignore, credentials by environment.

Common risks include exposing the entire file system, allowing arbitrary command execution, failing to validate inputs, blindly trusting what the model sends, failing to limit request rates, and failing to log sensitive operations.

Knowing the most common risks lets you avoid them proactively. Preventing a vulnerability is much easier than fixing one after an incident.

Path traversal, command injection, input validation, rate limiting, logging, zero trust.

A practical checklist to review before publishing any MCP Server: input validation, least-privilege permissions, secure credentials, rate limiting, logging, error handling without exposing data, security documentation, and abuse testing.

Having a checklist eliminates the risk of forgetting security items in the rush to publish. It is a practical tool you'll use in every MCP project.

Security checklist, pre-publication review, validation, permissions, logging, documentation, abuse testing.

Auditing and monitoring involve recording all server operations (who requested what, and when), monitoring unusual usage, alerting on suspicious attempts, and keeping logs for investigation. This gives you visibility into what your server is doing.

Without monitoring, you won't know if your server is being used maliciously. Logs and alerts are the difference between discovering a problem in minutes and discovering it in months.

Structured logging, audit trail, monitoring, alerts, metrics, anomaly detection, log retention.