Prepared by VMExam • www.vmexam.com Model Context Protocol Associate (MCPA) MCPA Certification Guide Linux Foundation Model Context Protocol Associate The MCPA is the first certification written for the Model Context Protocol, and it is new enough that almost nothing has been written about it yet. Everything here comes from the Linux Foundation’s own certification page, from VMExam’s MCPA syllabus and sample-question pages, and from the MCP specification itself. Inside you will find the exam fact sheet, all five domains with their published weightings, the protocol concepts behind the seventeen competencies, what the 2026-07-28 release deprecated and why that matters for the study material already in circulation, a five-step route from first read to booked seat, and ten sample questions with a full answer key. 60 Questions 120 Minutes 75% To pass $250 Fee Linux Foundation MCPA Certification Guide Model Context Protocol Associate www.vmexam.com 2 Exam Overview Exam code MCPA Certification Model Context Protocol Associate Offered by The Agentic AI Foundation, part of the Linux Foundation Level Beginner Format Online, proctored, multiple choice Exam length 120 minutes Questions 60 Passing score 75% Exam fee USD 250 Protocol version MCP release 2026-07-28 Eligibility 12 months from purchase, one retake included Prerequisite None Recommended background JSON-RPC or similar message-based protocols, working with LLM APIs, agentic patterns such as ReAct and tool use, API keys and OAuth 2.1 token handling, and reading MCP server manifests and capability definitions Valid for 2 years Format, level, validity, eligibility and the recommended background come from the Linux Foundation certification page. The fee, the question count and the 75% pass mark are the figures published on VMExam's MCPA syllabus page - the Linux Foundation's own page states the duration but not those three, so treat them as VMExam's reporting rather than a vendor quote, and confirm the price at checkout. There is no prerequisite exam. The Linux Foundation does recommend you arrive already comfortable with JSON-RPC-style messaging, calling LLM APIs, agentic patterns such as ReAct and tool use, and the basics of API keys and OAuth 2.1 token handling. None of that is examined directly; all of it is assumed. Linux Foundation MCPA Certification Guide Model Context Protocol Associate www.vmexam.com 3 A Certification For A Protocol That Is Still Moving The MCPA is run by the Agentic AI Foundation, part of the Linux Foundation, and is the first official certification for MCP. That is worth knowing before you start collecting study material: there is very little of it, and what exists was mostly written against an earlier release of the protocol. The exam is written against MCP release 2026-07-28 , and that release deprecates three things a lot of existing material still presents as current practice: • Sampling - a server borrowing the host’s model for a completion - is deprecated and scheduled for removal; new implementations are told to integrate with LLM provider APIs directly. • Roots - a client telling a server which filesystem directories are in scope - is deprecated in favour of passing paths through tool parameters, resource URIs or server configuration. • Server-side logging is deprecated; new implementations log to stderr on the stdio transport, or use OpenTelemetry. Deprecated is not the same as gone, and the sample questions later in this guide still treat sampling and roots as live capabilities - so knowing what they do is still worth marks. Knowing that they are on the way out, and what replaced them, is what tells an examiner you have read the current specification rather than last year’s tutorial. The Blueprint, Domain by Domain Fundamentals 16% Architecture 14% Interactions 26% Security 24% Use cases 20% Bars are the weightings the Linux Foundation publishes, not an estimate. Five domains, 17 competencies - a short blueprint even by associate standards, which means each line covers more ground than it looks like it does. Note where the weight sits: interactions and execution plus security and governance are half the paper between them, while the fundamentals everyone starts with are only 16%. The full syllabus on VMExam is the canonical version of this list. MCP Fundamentals (16%) • MCP Purpose & Scope • Core MCP Concepts • Interoperability & Value Architecture & Components (14%) • Schemas & Structured Data Linux Foundation MCPA Certification Guide Model Context Protocol Associate www.vmexam.com 4 • MCP Hosts, Clients and Servers • Model Interaction Flow Interactions & Execution (26%) • Interaction Patterns & Response Handling • Error Handling • Tool Invocation Lifecycle • Protocol Primitives Security & Governance (24%) • Trust Boundaries • Permissions & Consent • Risk & Safety Controls • Auditability & Observability Use Cases & Ecosystem (20%) • Roles, Responsibilities & Adoption • Operational Use Cases • Ecosystem & Portability The Protocol Behind The Blueprint Seventeen competency lines do not tell you much on their own. What they are asking about is a small, well-defined protocol, and it is worth getting the shape of it straight before you start memorising anything. MCP is a client-server protocol carried over JSON-RPC 2.0. A host is the AI application - an IDE, a desktop assistant - and it creates one client for each server it connects to. A server is just a program that supplies context and actions, running locally over the stdio transport or remotely over Streamable HTTP. The protocol splits into a data layer - the JSON-RPC messages, the discovery exchange and the primitives - and a transport layer , which handles connection, framing and authorization. Remote servers use standard HTTP authentication, and the specification recommends OAuth for obtaining tokens. That split is exactly what the architecture and components domain is testing. Primitive Offered by Driven by What it is for Tools Server The model Functions the model can call to take an action - query a database, hit an API, write a file. Discovered with tools/list, run with tools/call. Resources Server The application Passive, read-only data the application pulls in as context, each with a URI and MIME type. resources/list, resources/templates/list, resources/read. Linux Foundation MCPA Certification Guide Model Context Protocol Associate www.vmexam.com 5 Primitive Offered by Driven by What it is for Prompts Server The user Reusable instruction templates the user invokes deliberately, often behind a slash command. prompts/list, prompts/get. Elicitation Client The user Lets a server stop mid-request and ask the user for something - a confirmation, a missing field, or an out-of-band URL for sensitive input. Sampling (deprecated) Client The user Lets a server borrow the host’s model for a completion instead of shipping its own LLM SDK. Deprecated in 2026-07-28. Roots (deprecated) Client The application Lets a client tell a server which filesystem directories are in scope. Advisory, never a security boundary. Deprecated in 2026-07-28. Two patterns from that table come up repeatedly in the sample questions. The first is discover then use : a client asks the server what it has before it tries to use anything, and a server advertises its versions and capabilities through a discovery request every server must implement. The second is who is in control : tools are the model’s to invoke, resources are the application’s to pull in, prompts are the user’s to trigger. Getting those three straight answers a surprising number of questions on its own. One more piece of the current release worth carrying into the exam: MCP is stateless. Every request carries the protocol version and the caller’s capabilities with it, so a server infers nothing from what came before, and change notifications are opt-in rather than automatic - a client subscribes to the event types it wants and the server delivers matching notifications on that stream. Where Half The Marks Are Interactions and execution is 26% of the exam, security and governance another 24%. Read the sample questions and the pattern is obvious: they are scenario questions about consequences, not definitions. A server was granted read-write access to all of a user’s files when it only needed to list one folder, and then the operator was breached. Nobody can reconstruct which tools ran, with what arguments, during an incident window. The four security competencies map onto that cleanly. Trust boundaries - the host, the client, the server and the model are separate parties, and a boundary crossed is a decision made. Permissions and consent - least privilege at the point where scopes are requested, and human review at the point where a server asks for something. Risk and safety controls - what a compromised server or token can reach. Auditability and observability - if you cannot answer "which tool, called by whom, with what arguments", you have the weakness the sample set is pointing at. Worth remembering on the same theme: roots were never a security boundary even before they were deprecated. The specification says servers should respect root boundaries, not that they must enforce them - real enforcement belongs to the operating system. Linux Foundation MCPA Certification Guide Model Context Protocol Associate www.vmexam.com 6 What This Credential Is Worth An honest answer: nobody knows yet, and any guide quoting an MCPA salary figure is inventing it. The credential is too new for salary surveys, and it is a beginner-level associate certification rather than a senior architecture one, so it is not going to move a salary band by itself. What it does do is arrive at the right moment. MCP went from a proposal to the default way AI applications connect to external tools and data in about a year, and the launch announcement is explicit about who the exam is for: people in AI engineering, platform engineering and AI governance roles who are building assistants, agents and tool integrations. Being demonstrably current on the protocol those teams are standardising on is the value here, and being early is part of it - this is the first credential of its kind. It also pairs naturally with whatever cloud or platform certification you already hold, since MCP is where those platforms are being wired into agentic applications. The VMExam Linux Foundation hub lists the other Linux Foundation exams with their own syllabus and practice material if you are planning a route rather than a single exam. A Five-Step Route to the Seat Step 1 — Read the specification, not a blog post about it This credential is new and the protocol moves fast, so most third-party write-ups are already describing an older release. The specification and the learn pages on modelcontextprotocol.io are short enough to read end to end in an evening, and they are the only source guaranteed to match the release the exam is written against. Step 2 — Pin down the version you are studying The exam covers the 2026-07-28 release. Anything you read that treats sampling, roots or server-side logging as current practice predates it. Knowing what each of them does is still fair game - knowing that they are on the way out is what separates current knowledge from stale. Step 3 — Build one server and one client A beginner-level exam still assumes you have watched a real session go past. Write a small server that exposes one tool and one resource, point a host at it over stdio, then watch discovery, a tools/list and a tools/call go by. Half the blueprint stops being abstract the moment you have seen the JSON. Step 4 — Give security and interactions the time their weight deserves Interactions and execution is 26% of the paper and security and governance another 24%. Half the exam sits in those two domains, and the sample questions bear that out: least privilege, audit logging of tool calls and arguments, trust boundaries between host, client and server, and what happens when a call fails. Step 5 — Book it and use the eligibility window Registration is through the Linux Foundation. The seat comes with twelve months of eligibility and one free retake, so there is no reason to sit it underprepared - but equally no reason to let the window lapse. The credential is valid for two years. Linux Foundation MCPA Certification Guide Model Context Protocol Associate www.vmexam.com 7 Sample Questions These ten come straight from the VMExam MCPA sample set, in a shuffled order. One asks you to select all that apply; the rest take a single answer. Two of them are built on sampling and one option refers to roots - both deprecated in the release this exam covers, as set out earlier. They are reproduced exactly as published, and what they test about those capabilities is still accurate. The answer key follows. Q1. A client has just connected to an unfamiliar MCP server and wants to work with what it offers, following the discover-then-use pattern. What must the client do first? a) Immediately invoke the tool it expects to exist and handle the error if it does not. b) Ask the server to enumerate its available tools, resources, and prompts first. c) Select a prompt on the user’s behalf and run it without asking the user first. d) Write a new resource to the server in order to register the connecting client. Q2. Without a shared standard, connecting M AI applications to N tools tends to require on the order of M × N custom integrations. How does an ecosystem-wide protocol like MCP change that integration cost? a) It keeps the cost at M × N but makes each integration easier to write. b) It shifts effort toward roughly M + N, since each side implements the standard once. c) It increases the cost to M × N × 2 because both sides must be adapted. d) It removes the need for any integration work at either the application side or the tool side. Q3. While answering a question about today’s weather, the model decides on its own that it needs live conditions and invokes a function the server exposes for that purpose. What is happening, in terms of control? a) The model is invoking a tool, the model-controlled primitive for fetching live data. b) The host is loading a resource, since live weather counts as external data. c) The user is controlling a prompt simply by asking the model about the current weather. d) The server is autonomously running a prompt in order to answer the user’s question. Linux Foundation MCPA Certification Guide Model Context Protocol Associate www.vmexam.com 8 Q4. A host connects to a remote MCP server that requested and received full read-write access to the user’s entire file storage, even though the only feature in use lists file names in one folder. Months later the server operator is breached. Why does the original permission decision make this breach worse than it needed to be? a) Because full access somehow forces the server to fall back to a local stdio transport instead of HTTP. b) The breach only really matters because audit logging happened to be enabled and dutifully recorded every one of the accesses. c) A compromised token can read and alter all of the user’s files, far beyond the single list-only feature that was used. d) Because requesting broad scopes causes the issued OAuth tokens to never expire, keeping them valid indefinitely. Q5. After a security incident, an organization cannot determine which MCP tools were invoked, by whom, or with what arguments during the affected window. Which governance weakness does this reveal? a) The tools had each been carefully scoped according to the principle of least privilege. b) The host happened to communicate with the server over a local stdio transport. c) The servers were configured to use OAuth authorization instead of static API keys for callers. d) Missing audit logging of tool invocations and their arguments. Q6. Two client-facing capabilities both involve reaching outside the server, but for different reasons: one obtains generated text from the host’s model, the other obtains an answer from the person using the application. Which pairing correctly matches the capability to what it obtains? a) Sampling obtains generated text from the host’s model; elicitation obtains an answer from the user b) Sampling obtains an answer from the user, while elicitation obtains generated text from the host’s model c) Both sampling and elicitation obtain generated text from the host’s model d) Both sampling and elicitation obtain an answer directly from the user Q7. Consider the two main roles in the MCP ecosystem: those who build servers and those who build hosts. Which pairing correctly matches each role to what it typically builds? a) The protocol maintainers build all servers and hosts centrally. b) End users build both the servers and the hosts for every integration. c) Tool and data providers build servers, while AI-application vendors build hosts. d) AI-application vendors build servers, while tool and data providers build hosts. Linux Foundation MCPA Certification Guide Model Context Protocol Associate www.vmexam.com 9 Q8. When a server issues a sampling request, the host typically pauses to let the user review the prompt and the generated result before either is used. Why is this human-in-the-loop step built into sampling? a) Because the protocol forbids servers from ever receiving any generated text from the model b) Because the server needs the user to supply the model’s API credentials for each call c) Because the language model cannot produce output unless a human types part of the prompt d) So the user keeps oversight over what the server asks the model and receives Q9. Which of the following are realistic MCP use cases for connecting an assistant to enterprise systems? (Select all that apply.) a) Letting the assistant pull records from a CRM to answer account questions b) Letting the assistant create or update tickets in an issue tracker c) Physically rewiring the company’s on-premises network switches and cabling d) Letting the assistant search a knowledge-base wiki to ground its answers Q10. Midway through handling a client request, a server determines it needs one more piece of information from the user, such as which of two accounts to act on. Which client-facing capability is designed for this? a) Roots, which lets the server learn the filesystem directory boundaries it may use b) A list-changed notification, which tells the client an offered list has changed c) Sampling, which lets the server obtain a language-model completion from the host d) Elicitation, which lets the server request more input from the user. Answer Key Q1 b Q2 b Q3 a Q4 c Q5 d Q6 a Q7 c Q8 d Q9 a, b, d Q10 d Linux Foundation MCPA Certification Guide Model Context Protocol Associate www.vmexam.com 10 Where To Go Next The specification is short, the protocol is young, and the fastest way to be ready for this exam is to read the current release and then watch one real session go past. When you want to test that under timed conditions, the MCPA practice exam runs practice papers built to these five weightings, and the MCP specification discussions on GitHub is where the protocol is actually argued out - including the deprecations this guide flags, and what is replacing them. 5 Domains 17 Competencies 75% To pass 2 years Valid for Guide prepared by VMExam. Exam facts follow the Linux Foundation certification page and VMExam’s MCPA syllabus page; protocol detail follows the MCP specification at release 2026-07-28; sample questions are reproduced from VMExam’s sample set. This certification and the protocol behind it are both new - verify the current exam details with the Linux Foundation before you book.