Appendix K: Glossary
Sorted alphabetically, ignoring punctuation. “Taught in” links to the section that explains the term.
| Term | Definition | Taught in |
|---|---|---|
| Annotation | Tool metadata: the four hints below plus title. Hints, not controls; the server must make them true. An unannotated tool is assumed destructive, non-idempotent and open-world. | ch06, ch20 |
Audience (aud) | The resource a token was issued for. A server rejects tokens not issued for its own canonical URI. | ch19 |
| Blast radius | Everything one failure or one compromised credential can reach. | ch20 |
| Capability | A feature one side declares: server capabilities in server/discover, client capabilities in each request’s _meta. Never rely on an undeclared one. | ch02, App A |
| CIMD (Client ID Metadata Document) | Registration where the client ID is an HTTPS URL serving client_id, client_name and redirect_uris. Preferred over DCR. | ch19 |
| Client | The component that talks to one server on behalf of a host. | ch02 |
| Completions | Argument autocompletion via completion/complete. | App A |
| DCR (Dynamic Client Registration) | RFC 7591 self-registration at registration_endpoint. Deprecated in 2026-07-28; use CIMD. | ch19 |
destructiveHint | The tool may destroy or overwrite data; confirm specifically. | ch06 |
| Elicitation | Structured input the server asks the user for mid-call. In 2026-07-28 it arrives in an InputRequiredResult; the answer comes back on a retry. | ch10 |
| Gateway | A proxy in front of MCP servers that centralizes auth, policy, routing and audit. | ch26 |
| Host | The application that owns the conversation, approvals and model, running one client per server. | ch02 |
idempotentHint | Repeating the call changes nothing further, so a retry is safe. | ch06 |
InputRequiredResult | A result with resultType: "input_required", inputRequests and an opaque requestState. Only on tools/call, resources/read, prompts/get. | App A |
| Inspector | Developer tool that drives a server with no model. Keep it on localhost. | ch04, ch21 |
Issuer (iss) | The authorization server’s identifier, compared exactly against metadata (RFC 8414) and authorization responses (RFC 9207). | ch19 |
| JSON-RPC | MCP’s message format: requests with an id, results, errors, notifications. | ch02 |
Mcp-Method / Mcp-Name | Streamable HTTP headers repeating the body’s method and name, for routing. A mismatch returns -32020. | ch07 |
| MCP Apps | The io.modelcontextprotocol/ui extension: interactive HTML rendered inside the host. | Part V opener |
_meta | Metadata on every request and result: protocol version, client capabilities, client/server info, trace context. | App A, ch23 |
| MRTR (Multi Round-Trip Request) | The server returns InputRequiredResult; the client retries with inputResponses. Resolvers run every round. | ch10 |
| Notification | A JSON-RPC message with no id and no response. | App A |
openWorldHint | The tool reaches outside systems; treat its output as untrusted. | ch20 |
| PKCE | RFC 7636: proves the code redeemer is the requester. Required for MCP’s Authorization Code flow. | ch18, App B |
| Prompt | A user-invoked message template with arguments. | ch06 |
| Protected resource metadata | The RFC 9728 document naming a server’s resource and authorization_servers. | ch19, App B |
readOnlyHint | The tool changes nothing. Back it with a read-only credential. | ch06 |
| Resource | Readable context addressed by URI; the host decides when to attach it. | ch06 |
| Resource indicator | The RFC 8707 resource parameter binding a token’s audience to one server. | ch19 |
resultType | "complete" or "input_required" on every 2026-07-28 result; absent means complete. | App A |
| Roots | Client-provided workspace boundaries. Deprecated; pass paths as parameters. | ch17 |
| Sampling | A server asking the client’s model for a completion. Deprecated; call a provider directly. | ch17 |
| Server | The process exposing tools, resources and prompts. | ch02 |
server/discover | Returns supported versions, capabilities and identity; replaces initialize. | ch02, App A |
| Server-minted handle | An opaque, caller-bound ID passed back as a tool argument; state without sessions. | ch10 |
| Step-up authorization | A 403 insufficient_scope naming the missing scope; the client re-authorizes with the union. | ch19, App B |
| STDIO | Local transport over stdin/stdout. Logs go to stderr. | ch04, ch05 |
| Streamable HTTP | The remote transport: one POST per message, answered with JSON or a per-request stream. No session header in 2026-07-28. | ch07, App A |
structuredContent | Typed JSON in a tool result, validated against outputSchema. | ch06 |
subscriptions/listen | One long-lived request streaming the change notifications a client opted into. | ch06, ch28 |
| Task | Long-running work polled with tasks/get; an extension since 2026-07-28. | ch10 |
| Tenant | The customer boundary. It comes from the token, never a tool argument. | ch25 |
| Token passthrough | Forwarding the caller’s token downstream. Forbidden. | ch19 |
| Tool | An action the model invokes with typed arguments. | ch05, ch06 |
| Tool firewall | A control plane that disables, rate-limits or gates tool families per tenant or environment. | ch26 |