MCP for DevOps Engineers

This is for you if

• You're a DevOps, platform or SRE engineer asked to connect an AI assistant to real infrastructure
• You want to review third-party MCP servers instead of trusting their README
• You're preparing for platform or AI-infrastructure interviews where MCP comes up
• You know Python, kubectl and basic Terraform, and want the security story right

What's inside

• How MCP really works on the wire: hosts, clients, servers, JSON-RPC, and the stateless 2026-07-28 revision
• stdio vs Streamable HTTP, DNS rebinding protection, and running stateless behind a load balancer
• A complete Python server on the official SDK 2.x with Kubernetes, GitHub and Terraform-plan tools
• Least-privilege RBAC, fine-grained GitHub tokens and plan-only Terraform with destroy detection
• OAuth resource-server auth: protected resource metadata, audience checks, per-tool scopes
• Testing with pytest, the MCP Inspector web UI and a CI smoke test with contract snapshots
• Tool poisoning, prompt injection through tool results, over-broad tokens and supply-chain risks
• Production patterns: container, Kubernetes manifests, audit logging, gateways and safe write tools
• A troubleshooting playbook, 20 interview Q&As, a dense cheat sheet and a 30-day plan

After this guide you can

• Explain MCP's architecture and both protocol eras clearly in a design review or interview
• Build and test a read-only MCP server with typed tools, resources and prompts
• Lock it down with allowlists, Kubernetes RBAC, scoped tokens and bearer-token auth
• Recognise and mitigate tool poisoning and prompt injection in a real deployment
• Deploy it to Kubernetes with health checks, audit logs and a CI contract test
• Debug a broken MCP integration layer by layer

Contents

1. The mental modelp. 4
2. Transports and the wirep. 11
3. Designing tools, resources and promptsp. 16
4. Building the server: Kubernetes toolsp. 23
5. GitHub and Terraform-plan toolsp. 36
6. Testing and connecting clientsp. 45
7. Auth and least privilegep. 54
8. Security: tool poisoning, prompt injection and over-broad tokensp. 62
9. Production patterns and the checklistp. 67
10. Troubleshooting playbookp. 75
11. Interview questionsp. 78
12. Cheat sheetp. 85
13. 30-day practice planp. 89