# AI Agents and MCP From Zero: A Free Beginner Course

> Four free lessons on AI agents and MCP from zero: how a tool call travels, least-privilege servers, prompt injection in tool output, and agent sandboxes.

URL: https://www.matthewswong.com/en/learn/ai-agents-mcp/

Reviewed on 17 October 2026 · Checked against MCP specification 2026-07-28 · By Matthews Wong (https://www.matthewswong.com/en/about/)

> AI agents act by calling tools, and the Model Context Protocol is how many of them reach those tools. These four lessons follow one tool call from the model to an MCP server and back, then show how to keep it safe: a server that holds only what the job needs, tool output treated as untrusted, and an agent inside a sandbox.

Free, no sign-up, no certificate. Built from the setup that runs this website.

## What you will be able to do

- Explain what an MCP server is, and trace a tool call through the host, the client and the server.
- Scope a server to least privilege, and prove it from the tool list a client receives.
- Treat tool output as untrusted, and put agents behind a boundary that holds when the model is fooled.

## Who it is for

Developers who have used an AI coding agent or a chat app with tools, and want to connect MCP servers without handing over more than they mean to.

## Before you start

- A terminal and Node.js 22.19 or newer, for the MCP Inspector exercises.
- Claude Code installed and signed in, for the permission and sandbox exercises.

## Lessons

1. [What Is an MCP Server? How One Tool Call Travels](https://www.matthewswong.com/en/learn/ai-agents-mcp/what-is-mcp-how-a-tool-call-travels/): What an MCP server is, from zero: how one AI agent tool call travels from client to server and back, and when to use stdio or Streamable HTTP transport.
2. [MCP Server Least Privilege: Read-Only Mode and Toolsets](https://www.matthewswong.com/en/learn/ai-agents-mcp/scope-an-mcp-server-read-only-toolsets/): MCP server least privilege from zero: a credential that cannot write, read-only mode, toolsets, allow lists and a client deny list, proven with tools/list.
3. [Indirect Prompt Injection Explained: Tool Output Is Untrusted](https://www.matthewswong.com/en/learn/ai-agents-mcp/prompt-injection-through-tool-output/): Indirect prompt injection explained for beginners: why text an MCP tool returns is untrusted input, two real incidents, and the controls that still hold.
4. [How to Sandbox an AI Agent: Files, Network and Secrets](https://www.matthewswong.com/en/learn/ai-agents-mcp/run-an-ai-agent-in-a-sandbox/): How to sandbox an AI agent from zero: what a sandbox contains and what it misses, from files and network to credentials, in Claude Code, Docker and K8s.

---

- HTML version: https://www.matthewswong.com/en/learn/ai-agents-mcp/
- Bahasa Indonesia: https://www.matthewswong.com/id/learn/ai-agents-mcp/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json