MCP Client
MCPDefinition
An application that connects to MCP servers to access their tools, resources, and prompts. Responsible for tool-list filtering, tool_use_id routing, and enforcing which capabilities the model can call. Claude Code is the canonical MCP client in the CCA-F curriculum.
Example Usage
Claude Code acts as an MCP client, connecting to all servers in .mcp.json, filtering tools by the allowed-tools list, and routing tool_use blocks back to the correct server.
Why It Matters for the CCA-F Exam
Exam questions test whether you can assign responsibilities to the correct side of the client-server boundary. Clients discover capabilities, filter allowed tools, route tool_use_id results, and enforce auth separation. Servers implement and expose capabilities. Confusing these roles is a common distractor.
In Depth
The MCP client is the orchestrator in an MCP session: it connects to servers, decides what the model is allowed to call, routes invocations to the right server, and maps results back to the conversation. Understanding what the client owns is essential for exam questions that ask where a given responsibility lives.
Tool Filtering: The Allowed-Tools Gate
After discovering a server's full tool list, the client does not automatically expose every tool to the model. Claude Code's allowedTools setting in .mcp.json lets you specify exactly which tools from which server the model may call. Tools absent from the allow-list are never sent to the model — it cannot invoke what it cannot see.
This is a client-side security control. Even if an MCP server exposes a broad surface (create, read, update, delete), the client can expose only the read tools to a session that should be read-only. The server does not change; the client restricts the view.
tool_use_id Mapping
When the model invokes a tool, it emits a tool_use content block with three fields: id, name, and input. The client must:
- Identify which MCP server registered the tool named
name. - Forward the call to that server's
tools/callendpoint. - Collect the result and return it as a
tool_resultblock whosetool_use_idexactly matches the originalid.
Getting the tool_use_id wrong — or omitting the pairing entirely — causes the model to lose the result or produce a protocol error. This is the same pairing rule as native tool_use blocks; MCP adds the indirection of routing through a server process.
Auth Separation
The client authenticates to the server; the server authenticates to upstream services. The MCP client does not hold API keys for GitHub, Slack, or any external system the server talks to. Those credentials live inside the server process, injected via environment variables at server startup. This separation keeps credential exposure minimal: a compromised client process does not automatically expose upstream service credentials.
The Anthropic API as Client
In custom agentic pipelines, your application code can act as the MCP client programmatically: manage the session, retrieve the tool list, translate it into the API tools array format, and forward tool_result blocks back. Claude Code does this automatically; custom clients must implement the same routing logic explicitly.
Example
The client's .mcp.json config. allowedTools is a client-side filter: the server still exposes delete_ticket, but the model never sees it because the client omits it from the tool list it sends to Claude.
// .mcp.json — project-scoped client config showing allowed-tools filtering
{
"mcpServers": {
"internal-api": {
"command": "node",
"args": ["./mcp-servers/internal-api/index.js"],
"env": {
"API_KEY": "${INTERNAL_API_KEY}" // credential lives in server env, not client
},
"allowedTools": [
"get_ticket", // read-only: exposed to model
"search_tickets" // read-only: exposed to model
// "delete_ticket" intentionally omitted — client gate keeps it hidden
]
}
}
}Frequently Asked Questions
Is Claude Code the only MCP client?
No. Any application that implements the MCP client spec can act as an MCP client. Claude Code is the primary client in the CCA-F curriculum, but you can build a custom client using the official MCP SDKs, or use any third-party host that has adopted the standard.
Who is responsible for enforcing which tools Claude can call — the client or the server?
Both layers can enforce restrictions, but the client is the primary gatekeeper for what the model sees. Claude Code's allowedTools configuration is a client-side filter applied before the tool list reaches the model. The server controls what it exposes in the first place; the client decides what subset to pass through.
Does the MCP client handle authentication with external services?
No — that is the server's responsibility. The server authenticates against the external system (database, API) using its own credentials. The client authenticates to the server, not to the upstream service. This separation keeps credential handling inside the server process, away from the orchestrating client.