MCP and Tools
Connecting the model to your database, browser, and issue tracker so it can check reality instead of guessing.
Read first: Rules Files
Everything so far has assumed the model can only read your files. Tools change that: they let it check reality — query your database, open your page in a browser, read the actual issue — instead of reasoning about what is probably there.
Why this changes the failure mode
Recall why models invent things: when they cannot see something, they produce the most plausible version of it. Tools attack that at the root.
Without tools
“Your users table probably has an email column, so here is a query.” Plausible, confident, and possibly wrong.
With a database tool
It runs a schema query, sees the column is actually email_address, and writes a query that works the first time.
What MCP actually is
The Model Context Protocol is a shared standard for connecting an AI tool to an external system. Before it, every editor needed a bespoke integration for every service. With it, a server written once works with any client that speaks the protocol.
Practically, you install a small server, tell your AI tool about it, and the model gains a set of actions it can call. Nothing about your prompting changes — the model simply has more ways to find things out.
- 1A filesystem server
Read and write files outside the current project.
- 2A database server
Inspect schemas and run read-only queries.
- 3A browser server
Open a page, click things, and read what actually rendered.
- 4An issue-tracker server
Read the ticket rather than being told a summary of it.
Two kinds of tool, and only one is free
Not every tool carries the same risk, and collapsing them into one category is how people end up granting write access somewhere they only meant to grant read access.
Read tools
Query a database, fetch a page, search the issue tracker. A wrong call wastes a turn. You catch it on the next line, because nothing outside the conversation has changed yet.
Write tools
Run a migration, push a commit, close a ticket, send an email. A wrong call has already happened by the time you notice it, and undoing it is a second task, not a correction to the first.
Before connecting a tool, ask what a confident, wrong call would cost and whether you could undo it. The risk matters more than the specific integration.
Setting one up
Configuration is a JSON file naming the servers to launch. The exact path differs per tool, but the shape is consistent:
{ "mcpServers": { "postgres": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-postgres"], "env": { "DATABASE_URL": "${DATABASE_URL}" } } }}Note the environment variable rather than a literal connection string. This file gets committed; your credentials must not be in it.
The one worth setting up first
If you only add one, make it a browser tool. It closes the loop that is otherwise longest and most tedious: the model changes CSS, cannot see the result, and asks you whether it worked.
The mobile nav overlaps the header below 400px. Open the pageat 375px wide, look at it, fix the CSS, then check it againand show me the result.That is a full observe-change-verify cycle with you out of the middle. It is also where AI assistance starts feeling qualitatively different rather than just faster.
The risks, stated plainly
Tools give a model the ability to act on the world, so the honest framing is that you are widening what a mistake can reach.
- 1Scope every credential down
Read-only where possible; a scratch database rather than production.
- 2Read what it proposes before approving
Especially anything that deletes, migrates, or installs.
- 3Only install servers you trust
An MCP server runs code on your machine with your permissions.
- 4Watch for injected instructions
Content the model fetches — an issue body, a web page — can contain text designed to look like instructions. Treat fetched data as data, never as commands.
Key takeaways
- Tools let the model check reality instead of predicting it — that is the whole value.
- A read tool that gets something wrong costs you a bad turn. A write tool that gets something wrong has already happened. Grant them differently.
- MCP is a shared protocol, so one server works across tools rather than per-editor integrations.
- Reference credentials from the environment. The config file gets committed.
- Read-only by default. Widen access only when you have a specific reason.
- A browser tool is a useful first addition because it closes the observe-change-verify loop.
- Content the model fetches is data, not instructions — that distinction is a real attack surface.
Before you move on
Quick check
Answer these to unlock the next chapter: 3 of 4 to pass. You can retake it anytime.
Make a free account to read on
Every chapter is free — an account lets your course progress follow you from your laptop to your phone. No payment, no trial.