← Back to Course Dashboard
Day 2 · Advanced Automation Track · Lesson 10

Tool Integration & MCP Frameworks

Course Target: Connect your AI agents and agentic browsers to the tools and data they need — using the Model Context Protocol (MCP) as the universal connector and code sandboxes for safe data analysis — so automation reaches your real systems without handing it the keys to everything.

Lessons 7–9 built agents that act; this lesson is about what they can reach. MCP is the standard way to plug an AI agent into a tool or data source — "USB-C for AI." As faculty you'll mostly decide which connections to allow in tools you already use, not build them — so we focus on what happens when you click "Allow," and what to check first. You'll also learn to run AI analysis in a sandbox so it can crunch your data without touching the rest of your system. This sets up Lesson 11 (Governance).

Start from your task

A concrete goal for this lessonYou've exported a CSV of this term’s quiz scores and you want AI to analyze it — find the trend, make a chart — without handing it your systems or your students’ names. By the end you'll know how AI reaches your tools (MCP), how to let it run analysis safely (a sandbox), and how to check its results before you trust them.

Learning Objectives

A note on what "able to" means hereThese activities are your first supervised attempts at each skill — a working draft and a repeatable method, not full mastery.

Key Terms

Select any card to flip it. Cards are keyboard-operable — press Enter or Space.

Course Outline & Lesson Modules

If you remember one thing: MCP lets your AI app reach a tool or data source through one standard interface — but you decide which servers it may connect to, and MCP itself doesn’t make a connection safe. Approving a connection is the decision that matters.

The picture

HOST  (your AI app: Claude Desktop, an IDE, an agentic browser)
  |
  |-- client --------▶  SERVER: Catalog      • resource (read)
  |-- client --------▶  SERVER: Ticketing    • tool (act)

resources = data to READ    tools = actions to TAKE    prompts = templates

A server can offer up to three things:

  • Tools — actions the model can take ("create a ticket," "run a query"). Model-initiated, so the riskier ones.
  • Resources — data the model can read ("the syllabus," "a policy doc").
  • Prompts — reusable templates a user invokes ("draft feedback for this rubric").

Read isn’t automatically safe

Exposing a resource feels harmless because the model is "only reading" — but that data can carry hidden instructions (text in a PDF or web page telling the agent to do something). That’s indirect prompt injection, and it’s the bridge to Lesson 11. Reading untrusted content is itself a risk.

Analogy: MCP is like the electrical-outlet standard. Once your building is wired to the standard, any compliant appliance plugs in — no rewiring per device. But you still decide what to plug in, and a faulty appliance on the circuit can still cause problems.

Worked example

An advising agent needs the course catalog (read) and the ticketing system (act). You enable a catalog server (exposes catalog data as a resource) and a ticketing server (exposes "create ticket" as a tool) — and nothing else.

Good to know (you usually won’t need this)MCP servers connect either locally (running on your machine) or remotely (a hosted server over the network, usually requiring a sign-in step). Remote widens the trust boundary. You’ll meet these settings inside the tools you use — you rarely configure them by hand.

Decision aid — "Should I connect this MCP server?"

  1. Who runs it? A vetted/official server, or an unknown third party?
  2. What can it do? Only resources (read), or tools that can change things? Grant the least it needs.
  3. Local or remote? Remote means your data leaves your machine — acceptable here?
  4. Does it touch student data? If yes, it’s also a FERPA question (Lesson 11) — confirm it’s approved or use de-identified data.
Quick check: your agent should read the registrar’s policy PDF (from outside) but never change a record. Safe to connect?

Connect it as a resource (read-only, no write tools) — and remember reading isn’t risk-free: a malicious instruction hidden in that PDF could still try to hijack the agent, which is why human sign-off on actions (Lesson 11) matters.

Cumulative Check

You want an agent to read a de-identified quiz CSV, analyze it, and post a summary to your course site. Name one risk at each stage — connection, execution, analysis — and a control.

Reveal model answer

Connection (MCP): only connect servers you need; expose the CSV as a read-only resource, not a write tool, and remember a resource can still carry injected text. Execution (sandbox): run the analysis in an isolated, no-network sandbox on the de-identified copy. Analysis: recompute one statistic and check the chart claim before posting; require your sign-off before it publishes.

Hands-on Workspace Modules

Activity 01

Decide the Connections

Map a sample agent workflow, classify what each MCP server exposes (tool / resource / prompt), run the "Should I connect this server?" aid, and mark the one connection you’d refuse.

  • each server’s primitives identified;
  • decision aid applied to each;
  • the unsafe connection refused with a reason.
Open Activity 1
Activity 02

Scope a Sandbox

Given an AI-generated analysis script and a dataset, decide sandbox-or-not, set least-privilege, and justify each setting — catching the risky line in the script.

  • network off, read-only, de-identified;
  • risky network call caught;
  • each setting justified.
Open Activity 2
Activity 03

Verified Data Analysis

Run a guided analysis on a de-identified sample; recompute one statistic, check one chart claim, flag any hallucination, and write a defensible summary.

  • one statistic recomputed;
  • one chart claim checked;
  • hallucination flagged + summary written.
Open Activity 3

Wrap-up

Reflect (2 minutes)Think of one AI tool you use that offers to connect to your files, LMS, or a database. Run the "Should I connect this server?" aid on it — what would you change?
Model what you teach: disclose your AI useWhen AI helped analyze data or draft materials, say so — briefly and plainly. A one-line note is enough.
RecapConnect: allow only the MCP servers you need, least privilege, and remember MCP connects but doesn’t secure. Execute: run AI code in an isolated, no-network sandbox on de-identified data. Analyze: verify one number and one claim before you trust it.

Sources & Further Reading

  1. Primary Model Context Protocol specification & introduction — modelcontextprotocol.io (hosts/clients/servers; tools/resources/prompts; local vs. remote connections).
  2. Primary Anthropic MCP announcement & documentation (Nov 2024 introduction; current client/server support).
  3. Primary FERPA, 20 U.S.C. § 1232g; U.S. Dept. of Education, Student Privacy Policy Office (studentprivacy.ed.gov) — whenever student data is involved.

MCP architecture and security concepts are stable; specific server names, client support, and features change quickly — verify against current vendor docs before relying on them.