MCP Done Safely: Connect AI to Your Tools
MCP is the standard way to plug AI agents into your tools: tickets, docs, databases, your own product. Most tutorials stop at « it works ». This one starts there. You'll connect servers in Claude Code with the right scope and permission rules, learn what a malicious or compromised server can do, get OAuth right, and design tools that stay safe when the model is fooled. The last part is a real case study: the MCP server of a production SaaS, including the gaps found while writing this very course, and how they were fixed.
New
Offered by ITwithDom- Last updated November 2026
- Language: English
- 1 h 36
- E-learning
What you'll learn
- Connect remote and local MCP servers in Claude Code with the right scope, approvals and permission rules
- Recognise server-side threats: tool poisoning, rug pulls, lookalike servers and local code execution
- Get MCP authorisation right: audience-bound tokens, no token passthrough, per-client consent, minimal scopes
- Design server tools that are narrow, annotated and authorised on every call, and refuse metadata URLs that point inside your network
- Review an MCP setup (yours or a sample team's) against a security checklist, and see how a production server applies it
Practical information
- Format
- E-learning
- Location
- Online
- Schedule
- Self-paced online, about 1 h 35.
Course content
7 lessons, 1 h 35 in total
- What MCP is, and why safety is the hard part11 min
- Connecting servers in Claude Code13 min
- Threats from the server side14 min
- Authorisation done right15 min
- Building a safe server14 min
- Case study: a production MCP server12 min
- Final project: an MCP security review16 min
Description
A practical course on the Model Context Protocol from a security point of view: connecting servers in Claude Code with the right scope and permissions, the threats that come from servers (tool poisoning, rug pulls, local code execution), OAuth done right (no token passthrough, per-client consent, minimal scopes), and how to build a server that is safe by design. Includes a real production case study.
Key information
- Learning objectives
- Configure MCP servers and tool permissions in Claude Code at the right scope
- Threat-model an MCP setup from the client and the server side
- Review an MCP server's authorisation flow against the specification's best practices
- Design a minimal, annotated tool set with server-side authorisation and audit
- Who it is for
- Developers who connect AI agents to their tools or build MCP servers, platform and security engineers who approve them.
- Prerequisites
- Basic web and OAuth vocabulary (token, scope, redirect) helps. Claude Code installed for the hands-on steps.
- Duration
- 1 h 36
- Price
- Free
- Teaching format
- E-learning
- Access conditions and lead time
- Free. Create a learner account on the course page and start immediately. Immediate access after enrolment.
- Teaching methods
- Short explanations, diagrams and an animated walkthrough, hands-on configuration, a server design exercise and a real case study.
- Assessment
- Short checkpoint quiz on every page (one mistake allowed), final exam at 70 %, Three hands-on exercises with a rubric, Final project: an MCP security review, reference solution provided
- Accessibility for people with disabilities
- Self-paced, no time limit. Diagrams have text descriptions, the animation has captions, all code is text.
- Contact
- Dominik Heinrich (ITwithDom)
The training provider
ITwithDomSee the profile and all its courses 
