Claude Certification Tools & MCP Study Guide (Domain 4)

Answer: B. vector_db-search_v2

Tool names must match the regex ^[a-zA-Z0-9_-]{1,64}$: only ASCII letters, digits, underscores, and hyphens, with a length of 1 to 64 characters. Spaces, periods, and accented or other non-ASCII characters are all rejected, which rules out the other three options. Underscores and hyphens are both permitted, so mixing them as in the correct option is fine.

Answer: A. Aim for at least 3 to 4 sentences per tool, and more for complex tools

The documentation says to aim for at least 3 to 4 sentences per tool description, and more for complex tools. Ultra-short descriptions appear as the poor example in the docs, the API does not truncate description text at any short word count, and Claude weighs the description heavily rather than relying on input_schema alone.

Answer: A. Aim for at least 3-4 sentences per tool description, and more when the tool is complex

The documentation recommends at least 3-4 sentences per description, with more detail for complex tools. Descriptions are injected into the tool use system prompt and strongly influence behavior, so they are not inert metadata. The docs' "poor description" example is exactly the terse one-liner style, which leaves Claude with open questions about usage.

Answer: D. name, description, and input_schema (a JSON Schema object describing the tool's expected parameters)

Each custom tool in the tools parameter is defined by a name, a description, and an input_schema expressed as JSON Schema; an optional input_examples array can also be added. The API never invokes your code directly, so there is no endpoint, HTTP method, or handler to register: your application executes the tool when Claude emits a tool_use block. The function_name/arguments/return_type shape belongs to other providers' APIs, not the Claude Messages API.

Answer: B. {"type": "tool_result", "tool_use_id": "toolu_01...", "content": "Rate limit exceeded. Retry after 60 seconds.", "is_error": true}

Anthropic recommends instructive error messages that state what went wrong and what Claude should try next, paired with is_error: true; the docs use 'Rate limit exceeded. Retry after 60 seconds.' as the model example. A generic 'failed' gives Claude nothing to reason about. Omitting is_error makes the text read as successful tool output rather than a failure signal, and omitting content entirely deprives Claude of the context it needs to recover or adapt.

Answer: B. An id to match results to the call, the name of the tool, and an input object conforming to the tool's input_schema

A tool_use block carries an id used to match the eventual result, the name of the tool, and an input object that conforms to the tool's input_schema. tool_use_id, content, and is_error are fields of the tool_result block you send back, not of tool_use. There is no output field because the API does not execute client tools, and input arrives as a parsed JSON object rather than an encoded arguments string.

Answer: A. tool_choice: {"type": "tool", "name": "record_entities"}

tool_choice with type tool plus the tool's name forces Claude to call that specific tool on the request. type any only guarantees that at least one of the provided tools is used, without controlling which. There is no required field on the auto option, and strict: true enforces schema-valid inputs but does not force Claude to call the tool at all.

Answer: B. In a single user message whose content array contains three tool_result blocks, each matched to its call by tool_use_id

Parallel tool calls must be answered with one tool_result per tool_use block, all together in the next single user message, matched by tool_use_id. Spreading results across separate user messages is explicitly called out as a mistake that reduces Claude's tendency to make parallel calls in later turns. Concatenating everything into one block leaves the other tool_use ids unresolved and triggers a 400 error, and tool_result blocks always travel in user messages.

Answer: D. Tools, resources, and prompts

MCP servers expose tools (executable functions), resources (data sources for context), and prompts (reusable templates). Sampling, roots, and elicitation are client-side features, not server primitives (and as of the 2026-07-28 spec, Roots and Sampling are deprecated, leaving Elicitation as the active client feature). Hooks and skills are Claude Code concepts rather than MCP protocol primitives.

Answer: D. A resource, identified by a unique URI, that the client retrieves with resources/read

Resources are passive, read-only data sources with unique URIs that the application retrieves and decides how to use, which matches static policy content exactly. Tools are for executable actions the model invokes, sampling is a server-initiated request for an LLM completion rather than a way to publish data, and roots are client-provided filesystem boundaries, not something a server exposes.

Answer: B. JSON-RPC 2.0, with requests, responses, and notifications encoded as UTF-8 JSON.

MCP's data layer is built on JSON-RPC 2.0, and every transport (stdio, Streamable HTTP, or a custom transport) must preserve that message format, encoded as UTF-8. MCP is not defined in terms of Protocol Buffers, REST resource semantics, or GraphQL, even though Streamable HTTP happens to use HTTP as a carrier.

Answer: D. The client launches the server as a subprocess and exchanges JSON-RPC messages over its stdin and stdout.

In the stdio transport the client launches the server as a subprocess, writes JSON-RPC messages to the server's stdin, and reads responses from its stdout, with messages delimited by newlines. WebSockets, shared memory, and Unix domain sockets are not part of the two standard MCP transports, which are stdio and Streamable HTTP.

Answer: B. The server exposes one MCP endpoint; each JSON-RPC message is a new POST, answered with JSON or an SSE stream.

Streamable HTTP uses a single MCP endpoint: every client message is a new HTTP POST, and the server responds with Content-Type application/json or text/event-stream for that request. In the 2026-07-28 revision the old GET listening endpoint was replaced by subscriptions/listen, a long-lived POST-response stream for opted-in change notifications. The two-endpoint design describes the deprecated HTTP+SSE transport, and MCP's standard transports do not use WebSockets or pipelined POST bodies.

Answer: C. Host the server so it is publicly reachable over HTTP (Streamable HTTP or SSE transport), because the connector cannot connect to local STDIO servers

The connector's documented limitation is that servers must be publicly exposed through HTTP (Streamable HTTP or SSE transports); local STDIO servers cannot be connected directly, so the team must deploy the server behind an HTTPS URL. The mcp_servers type field currently supports only "url", so there is no stdio option with command and args. The Files API and the code execution container do not host or execute MCP servers.

Answer: A. Prompt injection: untrusted content returned in tool results enters the model's context and can steer the agent toward unintended actions

Tool results flow into the model's context just like user input, so instructions hidden in fetched content can attempt to hijack the agent's behavior; this is the prompt injection risk Anthropic highlights for tools that touch external content. Mitigations include using trusted servers, restricting risky tools, and keeping human approval in front of consequential actions. Large pages can cost tokens but that is not the attack shown, OAuth tokens are transmitted in request headers rather than tool results, and model weights are never updated by inference-time text.