25 Questions — Domain 8 : Tools and MCPs

Expand any question to reveal the correct answer and explanation.

1. 1 A developer needs to ensure that Claude prioritizes a specific data-scrubbing tool before performing any other actions in a sensitive workflow. Which configuration of the $tool\_choice$ parameter should be implemented?

   Consider which option moves the decision-making from the model's discretion to a strict requirement for a single identified function.

   tool_choice = {"type": "tool", "name": "scrub_data"}

   This configuration forces the model to invoke a specific named tool, ensuring deterministic behavior for a critical step in the application logic.

   • ✗ tool_choice = {"type": "auto"}

     This setting is the default and allows the model to choose between using any tool or simply responding with a text turn, which does not guarantee tool invocation.

   • ✗ tool_choice = {"type": "any"}

     While this forces the model to use a tool, it does not specify which one, allowing the model to select any tool from the provided definitions.

   • ✗ tool_choice = {"type": "forced"}

     'forced' is not a valid type value for the tool_choice parameter in the Claude API; the correct keywords are 'auto', 'any', or 'tool'.

2. 2 In the context of the Model Context Protocol (MCP), where should the management of API credentials and user approval policies reside to maintain the intended security trust boundary?

   Think about which component in the client-host-server architecture serves as the gateway to external systems and user-defined rules.

   In the MCP Client layer

   The client acts as the trusted orchestrator responsible for security policies, credential management, and mediating user permissions before requests reach the server.

   • ✗ In the MCP Server layer

     The server should remain isolated and only execute logic, as exposing credentials there would violate the decoupling of tool execution from context management.

   • ✗ Within the Claude Model runtime

     Large language models do not have native facilities for securely storing environment-specific credentials or enforcing programmatic access control lists.

   • ✗ In the stdio transport channel

     Transport channels like stdio or SSE are only communication conduits and should not hold persistent state or security logic.

3. 3 A production tool returns a '429 Too Many Requests' error from a downstream service. According to the recommended structured error envelope, which category and retry state should be returned to Claude?

   Reflect on how to classify an error that is caused by external resource exhaustion rather than a flaw in the request itself.

   category: "transient", isRetryable: true

   Transient errors designate temporary failures that may resolve themselves, allowing the system to attempt the operation again after a backoff.

   • ✗ category: "validation", isRetryable: false

     Validation errors imply a problem with the input schema which retries cannot fix, whereas rate limits are infrastructure issues.

   • ✗ category: "business", isRetryable: true

     Business errors typically relate to logical constraints like insufficient funds, rather than temporary network or service availability.

   • ✗ category: "permission", isRetryable: false

     Permission errors indicate a lack of authorization, which a simple retry will not resolve without manual intervention or credential updates.

4. 4 When defining a JSON schema for a complex tool, why is the 'description' field considered a critical architectural component rather than just documentation?

   Consider how the model knows which function to use when it encounters a user's request that doesn't explicitly name a tool.

   It provides the semantic context that Claude uses to decide when and how to call the tool.

   Claude relies on the text description to understand the tool's purpose and the meaning of its parameters, directly influencing invocation accuracy.

   • ✗ It is used by the application's parser to map JSON keys to internal functions.

     The mapping of keys to functions is handled by programmatic dispatch logic, not by the string descriptions within the schema.

   • ✗ It serves as a required field for client-side regex validation of the model's output.

     Descriptions are for the model's benefit; the application layer uses the 'properties' and 'type' definitions for actual output validation.

   • ✗ It is used to generate the system prompt automatically by the Claude SDK.

     While descriptions are passed to the model, they do not replace the developer's responsibility for crafting an effective system prompt.

5. 5 An agent needs to query a database but receives an error stating 'Access Denied: IP address not whitelisted'. Which 'errorCategory' should the structured error envelope utilize?

   Focus on the root cause being a failure of authentication or authorization rules.

   permission

   Permission errors are appropriate when the identity or the environment lacks the necessary rights to access a resource.

   • ✗ transient

     IP whitelisting is a static configuration issue that will not resolve with time or retries, unlike network congestion.

   • ✗ validation

     This is an authorization failure rather than a malformed request or schema mismatch.

   • ✗ business

     Business logic errors refer to constraints within the application domain, such as a user having a balance too low for a transaction.

6. 6 A developer is choosing between implementing a 'Skill' in Claude Code versus an 'MCP Server'. What is a primary reason to choose the MCP Server approach for a production environment?

   Think about reusability and the ability to maintain tool logic independently of a single codebase.

   MCP Servers allow for easier sharing of tools across multiple disparate Claude applications.

   The MCP standardizes connections, allowing one server to expose resources and tools to various hosts and clients independently of specific project files.

   • ✗ Skills support more complex logical loops and state management than MCP tools.

     MCP tools can call full backend systems and handle complex state, whereas Skills are generally repository-specific markdown/instructions.

   • ✗ MCP Servers do not require an active internet connection to communicate with Claude.

     While MCP uses local transports like stdio, it still functions within a stack that typically requires API connectivity for the model itself.

   • ✗ Skills are the only way to enforce programmatic guardrails in the application layer.

     Programmatic guardrails are implemented in the application code (the Host/Client), which is common to both MCP and standard tool use.

7. 7 If the Claude API returns $stop\_reason: "tool\_use"$, what is the next mandatory step for the application developer to maintain the interaction loop?

   Recall the alternating sequence required by the Messages API when a function call is initiated.

   Parse the 'tool_use' block, execute the local function, and return the result in a new 'tool_result' block.

   The developer must act on the model's request by running the specified tool and feeding the output back into the conversation for the next model turn.

   • ✗ Terminate the session and display the model's reasoning to the user.

     The 'tool_use' reason indicates the model is waiting for data from the application to continue its reasoning, not that it is finished.

   • ✗ Send a new user message asking the model to retry without using tools.

     Asking the model to retry ignores the model's specific request for information and will likely lead to a logic error or refusal.

   • ✗ Increase the 'max_tokens' parameter and resend the original request.

     A 'tool_use' stop reason is not caused by token limits; it is a planned pause in generation to gather external data.

8. 8 In the structured error envelope, which field is specifically designed to help Claude recover from a failure by suggesting a different course of action?

   Look for the property that offers constructive paths forward rather than just describing the current failure.

   alternativeApproaches

   This array provides specific suggestions (e.g., 'try get_user_by_email instead') that help the model pivot its logic when a tool fails.

   • ✗ isRetryable

     This boolean only tells the model whether repeating the exact same call might work, not how to change the strategy.

   • ✗ errorCategory

     Categories help with classification but do not offer specific functional alternatives to the failed operation.

   • ✗ attemptedOperation

     This field merely logs what went wrong for debugging purposes and does not guide the model toward a resolution.

9. 9 When building an MCP server using stdio as the transport, how is the communication between the host and the server typically structured?

   Focus on the specific protocol and stream types used for local process communication in MCP.

   Through bidirectional JSON-RPC messages over standard input and output streams.

   MCP leverages JSON-RPC for structured requests and notifications, using stdio as a simple and effective local transport mechanism.

   • ✗ Using a RESTful API over a local Unix socket.

     While sockets are a valid transport, stdio communication is distinct from REST/HTTP patterns and uses standard input/output directly.

   • ✗ By sharing a specific memory buffer defined in settings.json.

     MCP uses message-passing protocols rather than shared memory buffers for security and modularity.

   • ✗ Via periodic file system polls in the .claude/ directory.

     Polling is inefficient; stdio provides a continuous, real-time stream for message exchange.

10. 10 A developer wants to ensure Claude always attempts to use a weather tool but lets it choose which specific weather-related function to call. Which $tool\_choice$ is most efficient?

    Identify the option that forces action but allows flexibility in the selection of the specific tool.

    {"type": "any"}

    The 'any' type forces the model to select at least one tool from the available list, ensuring a tool call while leaving the specific choice to the model.

    • ✗ {"type": "auto"}

      Auto allows the model to bypass tools entirely and answer with text, which doesn't meet the requirement of 'always attempting to use' a tool.

    • ✗ {"type": "tool", "name": "get_current_weather"}

      This forces a single specific function, which removes the model's ability to choose among multiple weather-related functions.

    • ✗ {"type": "multiple"}

      'multiple' is not a valid type in the Claude tool_choice parameter schema.

11. 11 What is a major advantage of utilizing 'Resources' in an MCP server compared to 'Tools'?

    Consider the difference between a static data lookup and an active functional call.

    Resources provide a way to expose read-only data (like logs or docs) that Claude can fetch as needed.

    Resources act like URIs that Claude can 'read', whereas Tools are designed for active functions that perform operations or state changes.

    • ✗ Resources are the only way to perform write operations to a database.

      Tools are the correct mechanism for write operations or any action that has side effects.

    • ✗ Resources automatically bypass the user approval layer in the MCP Client.

      While permissions vary, resources do not inherently bypass security; they are simply a different category of data access.

    • ✗ Resources are handled entirely in the model's weight space, reducing token usage.

      Resources are external data fetched via the API, which still consumes tokens when included in the model's context.

12. 12 In a secure MCP implementation, why is it recommended to run the MCP Server in a 'sandbox' or isolated execution environment?

    Focus on the principle of 'least privilege' and preventing the escalation of a prompt injection attack.

    To ensure that compromised model instructions cannot gain unauthorized access to the host file system or network.

    Sandboxing restricts the server's reach, ensuring that even if a model is manipulated into making dangerous calls, the impact is contained.

    • ✗ To prevent the model from seeing the server's source code.

      The model only interacts with the tool's interface (schema) and results; it never has direct access to the server's source code by default.

    • ✗ To reduce the latency of stdio communication between the client and server.

      Sandboxing typically adds a small amount of overhead and does not improve communication speed.

    • ✗ To allow the server to automatically rotate its own API keys without host intervention.

      Credential management should be handled by the trusted Client, not by an isolated Server.

13. 13 A tool fails because the provided 'start_date' is later than the 'end_date'. Which 'errorCategory' is most appropriate for the response?

    Consider that the model has provided parameters that are logically inconsistent with the function's requirements.

    validation

    Validation errors are used when the inputs provided by the model do not meet the semantic or logical requirements of the tool.

    • ✗ transient

      The logic error in the date range is permanent for that specific set of inputs and will not change with a retry.

    • ✗ permission

      The failure is due to invalid data, not a lack of authorization.

    • ✗ business

      While it relates to logic, 'validation' is the more specific standard for malformed or illogical input parameters.

14. 14 A developer notices that Claude often confuses two tools with similar names. What is the most effective first step for remediation according to architectural best practices?

    Think about the primary source of information the model uses to understand the 'contract' of a tool.

    Improve the 'description' fields for both tools to clearly state their unique use cases and differences.

    Clear, disambiguated descriptions provide the model with the necessary semantic signals to choose the correct tool for a given context.

    • ✗ Switch from Claude Sonnet to Claude Opus to improve reasoning capacity.

      Upgrading the model tier is an expensive and often unnecessary fix for a problem that can be solved with better metadata.

    • ✗ Merge the two tools into one single tool with an optional parameter.

      Merging tools can increase complexity and lead to more frequent parameter errors; it is better to maintain distinct tools if the functions are different.

    • ✗ Implement a hard-coded classifier in Python to route requests before they reach Claude.

      Hard-coding routing defeats the purpose of an agentic system; the model should be empowered to route correctly via clear instructions.

15. 15 Which field in the structured error envelope would you use to indicate that a database connection timed out, but the model should try again immediately?

    Combine a category that describes a temporary glitch with a flag that allows the model to repeat the request.

    category: "transient", isRetryable: true

    Transient errors reflect temporary infrastructure issues, and 'isRetryable: true' explicitly signals to the model that a second attempt is valid.

    • ✗ category: "permission", isRetryable: true

      Permission errors are not transient and typically do not become valid through a simple retry.

    • ✗ category: "validation", isRetryable: false

      A timeout is not a validation failure, and setting retry to false would prevent the model from recovering.

    • ✗ category: "business", isRetryable: false

      Timeouts are infrastructure failures, not business logic constraints.

16. 16 In an MCP architecture, what is the role of the 'Host' application (e.g., Claude Desktop or a custom IDE extension)?

    Think about where the user 'lives' in this three-part system (Host-Client-Server).

    It provides the user interface and initiates connections to MCP Clients and Servers.

    The Host is the environment where the user interacts with Claude and where the integration of MCP capabilities is managed.

    • ✗ It executes the tool logic and returns data to the model.

      The tool logic is executed by the Server; the Host merely facilitates the connection.

    • ✗ It generates the JSON-RPC messages and performs the model reasoning.

      The Client generates messages, and the model (on Anthropic's servers) performs the reasoning.

    • ✗ It acts as a secure firewall that redacts PII before it leaves the local machine.

      While a Host may have security features, its primary architectural role is as the environment that hosts the Client and connects to Servers.

17. 17 When configuring a tool in the Claude API, what is the purpose of the 'required' array within the 'parameters' object?

    Consider how you ensure the model doesn't 'forget' to provide a piece of data like a customer ID.

    It defines which parameters must be provided by Claude for the tool call to be considered valid.

    The 'required' array enforces that the model cannot omit essential information, enabling the application to validate the request effectively.

    • ✗ It lists the API keys needed to access the tool.

      API keys are managed in the application layer and are not part of the tool's JSON schema definition.

    • ✗ It specifies the minimum token count required to invoke the tool.

      Token counts are a result of the model's output length and do not serve as a constraint for tool invocation.

    • ✗ It lists the alternate tools that should be called if this one fails.

      Error recovery is handled by the structured error response, not by the initial tool definition.

18. 18 A developer wants to implement a 'Human-in-the-loop' pattern for a tool that deletes user data. Where is the most appropriate place to implement the approval prompt?

    Think about which part of the system has the authority to 'gate' a sensitive action and talk to the user.

    In the Application (Client/Host) layer before dispatching the tool call

    The application layer is responsible for safety and user interaction, making it the correct place to intercept a 'tool_use' request and ask for confirmation.

    • ✗ Inside the MCP Server code

      The server should be an isolated execution layer; it shouldn't have direct access to the user interface for prompts.

    • ✗ In the system prompt instructions

      Prompt-based instructions for approval are not enforceable guardrails and can be bypassed by the model's stochastic nature.

    • ✗ As an 'alternativeApproach' in a structured error envelope

      Approval is a prerequisite for execution, not a fallback after a failure has already occurred.

19. 19 Why would a developer use 'Server-Sent Events' (SSE) instead of 'stdio' for an MCP Server?

    Consider the limitations of standard input/output when components are not running on the same local computer.

    To allow the MCP Server to run on a remote machine rather than as a local subprocess.

    SSE provides a network-based transport mechanism, enabling distributed architectures where the server is not on the same physical machine as the host.

    • ✗ Because SSE is faster for transferring large binary files like images.

      SSE is a text-based protocol and is not specifically optimized for binary data compared to other network protocols.

    • ✗ To bypass the need for JSON-RPC formatting.

      MCP still uses JSON-RPC regardless of the transport layer (stdio or SSE).

    • ✗ To ensure that Claude can call the tool even when the application is offline.

      Tool calls require an active connection between the Client and the Server; SSE does not enable offline functionality.

20. 20 If a tool call returns an error with category 'business', how should the model typically interpret this result?

    Focus on errors that represent 'valid request, but the answer is no' according to the rules of the project.

    As an indication that the request was valid but blocked by an application rule (e.g., 'Account Frozen').

    Business errors convey that a rule in the logic domain (not the code or transport) prevented the action, and the model should inform the user.

    • ✗ As a sign that the tool is broken and should not be used again.

      A business error means the tool worked correctly but could not fulfill the request due to domain rules.

    • ✗ As a prompt to automatically retry the operation with more tokens.

      Business rules are deterministic; retrying with more tokens will not change a logical constraint like a frozen account.

    • ✗ As a permission failure that requires new API keys.

      Permissions are about access rights; business rules are about the state of the data or the user's eligibility.

21. 21 Which $tool\_choice$ parameter value is used by default if the developer does not explicitly provide one in the API request?

    Think of the most flexible option that allows the model to lead the conversation.

    auto

    'auto' is the standard behavior where Claude determines if a tool call is helpful based on the user's input.

    • ✗ any

      'any' is a specialized setting that forces a tool call and is not the default behavior.

    • ✗ none

      'none' would disable tools entirely, which is not the default if tools are defined in the request.

    • ✗ tool

      Forcing a specific tool requires explicit naming and cannot be a generic default.

22. 22 An MCP server provides a 'Prompt' resource. How does this differ from a standard 'Tool'?

    Consider the role of templates in guiding user behavior versus the role of functions in executing code.

    Prompts are reusable templates that help users (and Claude) structure their interactions with specific tools.

    MCP Prompts are pre-defined instruction sets or templates that can be used to standardize how a user or model performs a task.

    • ✗ Prompts are used to store API keys for the server.

      Credentials should never be stored in prompts; they belong in the Client's secure environment.

    • ✗ Prompts allow the server to directly modify the model's weights during a session.

      Model weights are fixed; prompts only provide context for the current generation.

    • ✗ Prompts are required for SSE transports but not for stdio.

      Prompts are a functional category in MCP, independent of the transport layer used.

23. 23 In the structured error envelope, what is the purpose of the 'partialResults' field?

    Think about how to prevent a 'total loss' when a complex, multi-stage task only partially fails.

    To provide any data that was successfully retrieved before the error occurred, allowing for a more graceful failure.

    If a tool performs several actions and only the last one fails, 'partialResults' prevents the loss of useful information already gathered.

    • ✗ To show the model exactly where the syntax error occurred in the JSON.

      Syntax errors are handled by the 'validation' category; partialResults is for successful parts of a multi-step operation.

    • ✗ To list the partial tokens consumed by the failed tool call.

      Token tracking is handled by the API's usage block, not by the tool's error envelope.

    • ✗ To store the encrypted version of the error message for audit logs.

      The error envelope is for model context and shouldn't contain encrypted data the model cannot read.

24. 24 A developer wants Claude to only use one specific tool and never respond with just text. Which $tool\_choice$ is most restrictive and safe for this use case?

    Identify the option that combines a forced action with a named destination.

    tool_choice = {"type": "tool", "name": "target_tool"}

    This forces the model to use the specified tool and prevents it from responding with text, ensuring a deterministic functional output.

    • ✗ tool_choice = {"type": "any"}

      This forces a tool call but could allow the model to pick a different tool if multiple are defined.

    • ✗ tool_choice = {"type": "auto"}

      Auto allows for text-only responses and is the least restrictive option.

    • ✗ tool_choice = {"type": "required"}

      'required' is not a valid key for the tool_choice parameter; the correct keyword is 'any' or 'tool'.

25. 25 When building a production-grade MCP Server, why might you implement 'sampling' in the Client?

    Think about the Server needing to 'ask a follow-up question' to the AI before it finishes its job.

    To allow the server to ask the model for additional reasoning or information while it is executing a tool.

    Sampling allows the MCP Server to 'call back' to the model via the Client to handle ambiguous situations during tool execution.

    • ✗ To reduce the number of tokens sent to the MCP Server.

      Sampling actually involves an additional model turn, which increases token usage but provides higher quality outcomes.

    • ✗ To ensure that the Server stays within its memory limits.

      Memory limits are an infrastructure concern and are not managed through model sampling requests.

    • ✗ To provide random data to the server for testing purposes.

      Sampling refers to model generation, not to random data generation for unit tests.