Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Rabobank MCP Training Demo Retrieve customer CUST-1001 and list active products."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A minimal, realistic training project for a 1-hour MCP session with developers.
The project demonstrates how GitHub Copilot in Visual Studio Code can use an internal MCP server to safely access approved internal APIs, documentation and review prompts.
All data is fictional. No real Rabobank data is included.
rabobank_internal_mcp_uv_demo/
├─ app/
│ ├─ data.py # Fake internal banking data
│ ├─ internal_api.py # Internal FastAPI API
│ ├─ mcp_server.py # MCP server wrapping the internal API
│ ├─ run_api.py # uv script entrypoint for the API
│ └─ __init__.py
├─ .vscode/
│ ├─ mcp.json # VS Code MCP config using uv
│ └─ tasks.json # Optional VS Code tasks
├─ scripts/
│ ├─ demo-calls.ps1 # PowerShell API test calls
│ └─ demo-calls.sh # Bash API test calls
├─ .env.example
├─ .python-version
├─ pyproject.toml
└─ README.mdRelated MCP server: boilerforge
Developers learn that an MCP server can act as a controlled AI-facing layer over internal systems.
GitHub Copilot in VS Code
│
▼
MCP Client
│
▼
Internal MCP Server
│
┌────────┼────────┬─────────────┐
▼ ▼ ▼ ▼
Internal API Policies Architecture
API Catalog / Standards ChecksCheck if uv is available:
uv --versionInstall uv on Windows:
winget install astral-sh.uvAlternative Windows install:
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"macOS/Linux:
curl -LsSf https://astral.sh/uv/install.sh | shFrom the project folder:
uv syncThis creates the virtual environment and installs dependencies from pyproject.toml.
This repository also contains HTML training material:
index.html - self-study guide for MCP and Rabobank Design System context
mcp-extension-lab.html - hands-on developer lab for extending this MCP server
mcp-extension-trainer-answer-key.html - trainer guide with expected solution and demo flow
Terminal 1:
uv run bank-apiOpen the FastAPI docs:
http://127.0.0.1:8000/docsTest the health endpoint:
curl http://127.0.0.1:8000/healthMost endpoints require the demo API key:
curl -H "x-api-key: training-demo-key" http://127.0.0.1:8000/customers/CUST-1001PowerShell alternative:
$Headers = @{ "x-api-key" = "training-demo-key" }
Invoke-RestMethod -Uri "http://127.0.0.1:8000/customers/CUST-1001" -Headers $HeadersNormally VS Code starts the MCP server using .vscode/mcp.json.
For a manual smoke test, open Terminal 2:
uv run bank-mcpThe MCP server uses stdio transport, so it may look like it is waiting. That is expected.
The example config is in:
.vscode/mcp.jsonIt starts the MCP server with:
uv run bank-mcpImportant: keep the internal API running in Terminal 1.
get_customer_profile(customer_id)Example IDs:
CUST-1001
CUST-2002
Example prompt:
Use the internal MCP server to retrieve customer CUST-1001 and summarize the active products.get_product_info(product_id)Example IDs:
MORTGAGE-FLEX
PAYMENT-PLUS
BUSINESS-ACCOUNT
Example prompt:
Use the internal MCP server to explain product MORTGAGE-FLEX for a developer who needs to call the product API.get_api_endpoint_info(api_name)Example API names:
customer-onboarding
product-catalog
Example prompt:
Use the internal MCP server to inspect the customer-onboarding API and tell me which endpoint creates a new onboarding case.run_architecture_check(service_name)Example prompt:
Run an architecture check for CustomerOnboardingService and summarize the findings as action items.policy://api-securityExample prompt:
Use the policy://api-security resource and summarize the security requirements for internal APIs.architecture://event-driven-standardsExample prompt:
Use the architecture://event-driven-standards resource and explain what every event must contain.api_security_review_prompt(api_name, endpoint)Example prompt:
Use the api_security_review_prompt for the customer-onboarding API and endpoint /onboarding/cases.MCP is a standard way to let AI clients use tools, resources and prompts from approved systems.
Open:
http://127.0.0.1:8000/docsShow that it represents internal systems:
Customer API
Product API
API catalog
Policies
Architecture check
Open app/mcp_server.py and explain:
Tools perform actions or retrieve specific data
Resources expose readable knowledge
Prompts standardize repeatable tasks
Run the demo prompts from this README.
Ask participants to add one new tool:
@mcp.tool
def list_customer_products(customer_id: str) -> list[str]:
customer = internal_get(f"/customers/{customer_id}")
return customer["active_products"]Then ask Copilot:
Use the internal MCP server to list the active products for customer CUST-1001.This demo intentionally uses fake data. In a real organization, discuss:
Internal allowlist for MCP servers
Authentication and authorization
Least privilege
Audit logging
Correlation IDs
Output filtering
No direct production database access
API gateway usage
Data classification
Separate dev/test/prod environments
uv is not recognizedRestart the terminal after installing uv.
Add the demo API key header:
x-api-key: training-demo-keyThat is normal for stdio MCP servers. It waits for the MCP client.
Change the port in app/run_api.py or stop the other process.
Retrieve API catalog information for an internal API.
Example API names: customer-onboarding, product-catalog.
| Name | Required | Description | Default |
|---|---|---|---|
| api_name | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. 'Retrieve' implies read-only, but it does not disclose authentication requirements, error handling, pagination, or other behavioral traits. The output schema covers return format, but other aspects are absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the purpose, and no fluff. The example list is directly useful and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema handles return values, but the description lacks usage context, exclusions, and related tool guidance. For a simple single-parameter lookup, this is minimally sufficient but not fully comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It provides example API names ('customer-onboarding', 'product-catalog') which add format context, but does not fully define the parameter's meaning beyond those examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Retrieve') and resource ('API catalog information for an internal API'), with example API names to clarify scope. It distinguishes itself from sibling tools by targeting API catalog info rather than customer or product data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The examples imply what api_name should be, but there is no stated context or exclusion, leaving the agent to infer usage from sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve a fake internal customer profile by customer ID.
Example customer IDs: CUST-1001, CUST-2002.
| Name | Required | Description | Default |
|---|---|---|---|
| customer_id | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description discloses that the profile is 'fake internal', indicating a mock/test context. The read-only nature is implied by 'Retrieve'. Example IDs provide concrete behavioral context, though error handling is not discussed; the output schema likely covers return shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exactly two sentences with no filler. It front-loads the purpose and then provides useful examples, every word earning its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 1-parameter lookup tool with an output schema present, the description is nearly complete. It includes 'fake internal' context and example IDs, making it usable. However, it could explicitly state when not to use it (e.g., for real production data) or reference sibling alternatives for contrast.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description compensates by providing example customer IDs (CUST-1001, CUST-2002), which clarifies the expected format beyond the schema's bare string type. This adds meaningful parameter guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieve') and resource ('customer profile'), clearly distinguishing it from siblings like get_product_info and get_api_endpoint_info. The 'fake internal' qualifier adds specificity about the data source.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Context is clear: this tool retrieves customer profiles, and example IDs guide usage. It does not explicitly mention alternatives or exclusions, but the sibling tools are in different domains, making implicit differentiation sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve fake internal product information by product ID.
Example product IDs: MORTGAGE-FLEX, PAYMENT-PLUS, BUSINESS-ACCOUNT.
| Name | Required | Description | Default |
|---|---|---|---|
| product_id | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the disclosure burden. It adds valuable context by stating the data is 'fake internal', which sets expectations about its nature. The verb 'Retrieve' strongly implies a read-only operation, covering the safety profile despite lacking explicit annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and purpose, and every sentence adds value. The examples are concise and directly useful for invoking the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and an output schema present, the description covers what it does, how to pass the product ID, and gives realistic examples. No additional return format explanation is needed since the output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description compensates by giving concrete example values (MORTGAGE-FLEX, PAYMENT-PLUS, BUSINESS-ACCOUNT) and clarifying that the parameter is a product ID. This adds meaning beyond the bare 'string' type in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Retrieve' with a clear resource 'fake internal product information' and method 'by product ID'. This clearly distinguishes it from sibling tools like get_customer_profile and get_api_endpoint_info.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by providing example product IDs, but it does not explicitly state when to use this tool over alternatives or mention exclusions. Sibling names suggest distinct purposes, but the description itself offers no direct comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a fake internal architecture check for a service.
| Name | Required | Description | Default |
|---|---|---|---|
| service_name | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It only says the check is 'fake,' hinting at no real impact, but it does not explain side effects, permissions, rate limits, or expected behavior. The term 'fake' is ambiguous and lacks elaboration.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It is highly concise and structurally appropriate for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations, the description is incomplete. It provides minimal context about what the check does, what 'fake' means, or what the output represents. The presence of an output schema is not detailed, and the description does not compensate for the missing behavioral context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not mention 'service_name' at all. The parameter name is self-explanatory, but the description adds no semantics about format, constraints, or how the service_name is used. It fails to compensate for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Run') and the object ('a fake internal architecture check') for a service. It distinguishes itself from sibling tools which are all read-only data retrieval (get_*). However, it lacks specificity about what the check entails, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention any exclusions or refer to sibling tools. There is no context for appropriate use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0get_api_endpoint_infoget_customer_profileget_product_inforun_architecture_checkScored across 4 tools
Each tool targets a distinct entity or action: customer profile, product info, API endpoint info, and architecture check. There is no overlap in purpose.
Three tools use the get_ prefix (get_customer_profile, get_product_info, get_api_endpoint_info), while one uses run_ (run_architecture_check). The pattern is mostly consistent but has a minor deviation.
With 4 tools, the server is well-scoped for a training demo. Each tool covers a different aspect, and the count is appropriate without being bloated or thin.
The tools cover the main read-only operations for a demo (customer, product, API info, and architecture check). Missing CRUD operations or additional resources like accounts/transactions could be considered gaps, but the demo purpose is adequately served.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
An MCP server that gives your AI access to the source code and docs of all public github repos
