Capstone: build and deploy a real MCP server with auth

Final project: build and deploy a real MCP server with auth

This is the moment you stop following examples and build something that is yours: a real MCP server, useful, that runs, that connects to a real client, and that you can show off. It doesn't have to be big or perfect. It has to work, be well thought out, and be secure. If you pull it off, you already know how to build MCP servers — full stop.

What you'll build

An MCP server, in Python (FastMCP) or TypeScript (official SDK) — you choose — that exposes 2 or 3 useful tools wrapping a real free API (for example weather, quotes, Wikipedia) or local data (a CSV, a folder of notes). It runs over the right transport for its case, and if it's remote it adds auth. You test it with the Inspector and connect it to a real client.

Requirements (checklist)

• A server that starts without errors and exposes at least 2 tools (ideally 3).
• Well-designed tools: clear name, description/docstring that explains what they do, and typed arguments. Remember: the model chooses the tool by reading its description.
• A real API or local data behind the tools — no made-up values.
• The right transport: stdio if local, Streamable HTTP if remote.
• Auth (if remote): OAuth 2.1, validating the token's issuer, audience, and scope.
• Security applied: least privilege on each tool, and treat every output as untrusted content (data to display, never a command to obey).
• Tested with the MCP Inspector: list and run each tool before connecting.
• Connected to a real client: Claude Code or Claude Desktop, actually working.
• A short README: what it does, how to run it, and how to connect it.

Project ideas (pick one or invent your own)

1. Weather assistant. Tools: current_weather(city) and forecast(city, days) over a free public API. Local via stdio. Ideal if it's your first project.
2. Quotes dashboard. Tools that query prices (crypto, stocks, or currencies) via a keyless API. Add a conversion tool. A good effort/impact balance.
3. Notes searcher. Local data: a folder of .md files or a CSV. Tools: search(text) and read(file). Perfect for practicing least privilege (read-only, without leaving the folder).
4. Mini remote server with auth. Take any of the above, move it to Streamable HTTP, and protect it with OAuth 2.1. The most complete challenge — and the most impressive.

How it's evaluated

Your project is measured against the capstone rubric (you download it below). It covers six criteria — server works, tool design, right transport, auth/security, testing with the Inspector, and documentation — each at three levels: insufficient / good / excellent. Read the rubric before you start: it tells you exactly what each criterion looks at, so you aim for "excellent" from day one.

Quick glossary

• Capstone: the final integrating project that brings everything from the course together into something of your own, end to end.
• Rubric: the table of criteria × levels (insufficient / good / excellent) used to evaluate the project; read it before starting.
• Deliverable: each concrete thing you're expected to hand in (the server that runs, the README, etc.).
• Least privilege: giving each tool only the permissions it needs, nothing more — a key security principle of the capstone.

To download

• 📄 Capstone brief (PDF with the objective, requirements, ideas table, deliverables, and suggested steps — the project's full roadmap).
• 📄 Evaluation rubric (PDF with the criterion × level table to self-assess before submitting).
• 🧩 Skill pack mcp-server-starter (scaffolding that brings together server + tools + transport + auth/security notes; part of the mcp-python-starter / mcp-ts-starter starters you already used).

Before you start

Don't chase the perfect project: pick one from the list, make it work end to end, and only then polish it. The order that never fails: one tool that works → test it in the Inspector → connect it to a client → add the next one. When you see it respond from Claude, you'll understand why you did this whole course. Now, for real: build it.