Claude MCP Certification: Domain 2 Tool Design Guide

The claude mcp certification exam tests far more than API familiarity. Domain 2, Tool Design & MCP Integration, accounts for 18 per cent of the CCAR-F exam's 60 items, and every question in it places you inside a production scenario: a misrouted tool call, a staging MCP server leaking credentials into a production workflow, an agent looping because it cannot distinguish a real error from a valid empty result. This guide walks through what that 18 per cent covers, where candidates drop marks, and how to build the judgment the exam rewards.

What is Domain 2 on the CCAR-F exam?

Domain 2, Tool Design & MCP Integration, sits at 18 per cent of the total CCAR-F weight, making it the second smallest domain by share but one of the most scenario-dense. Every item requires practical diagnosis rather than recall. The full domain breakdown, per Anthropic's CCAR-F exam guide, is:

The exam is scored on a 100-to-1000 scale with a passing score of 720. Anthropic does not publish the raw-to-scaled conversion, so we never quote a raw question count as the pass mark.

How does the exam test tool descriptions?

Tool descriptions function as a routing mechanism, not documentation. Tool Descriptions as Selection Mechanism is one of the highest-yield concepts in Domain 2 because it underlies almost every misrouting scenario: a tool is called when it should not be, or never called when it should. In both cases, the first diagnostic question is whether the description is precise enough to disambiguate from adjacent tools.

A weak description that causes misrouting:

{
  "name": "get_data",
  "description": "Gets data from the system."
}

A description that routes correctly:

{
  "name": "get_invoice_line_items",
  "description": "Returns line-item detail for a single invoice by invoice ID. Use only when the user explicitly asks for invoice breakdown, not for order summaries or payment history."
}

The second version names the data type, the required parameter, and the negative cases. The exam consistently asks you to pick the description that most reduces ambiguity, not the one that sounds most comprehensive. When two tools overlap in scope, Tool Splitting for Specificity is almost always the proportionate fix rather than rewriting both descriptions.

What does the MCP isError flag test on the architect exam?

The MCP isError Flag Pattern is Domain 2's sharpest diagnostic concept. An agent that ignores isError and infers status from result length will misclassify access failures as valid empty responses, or loop indefinitely when a genuine error needs escalation.

MCP tool calls return a structured result object. When isError is true, the content field carries an error message rather than usable data:

{
  "isError": true,
  "content": [
    {
      "type": "text",
      "text": "Permission denied: invoices schema is not accessible to this role."
    }
  ]
}

The exam presents scenarios where an agent receives this response and must decide whether to retry, escalate, or return a structured error upstream. The correct answer traces to the Four Error Categories: transient failures warrant a retry with backoff; permission failures warrant escalation or a graceful fallback, never a loop.

How does MCP scoping affect exam scenarios?

MCP Scoping Hierarchy governs which servers are available in which contexts: user-level, project-level, or instance-level. Domain 2 tests scoping in two directions.

First: a tool that should be available is missing. The answer is almost always a scope mismatch, not a broken server. A project-level MCP server does not propagate automatically to a subagent that inherits only user-level configuration.

Second: a tool that should not be available in a context is being invoked. The answer is almost always that the server was mounted at too broad a scope, or that environment variable expansion in the MCP config is pulling a production connection string when staging was intended:

# Correct: environment variable isolates the connection string per deployment
export INVOICES_DB_URL=postgres://staging-host/invoices

# Wrong: hardcoded production URL baked into project-level config
# visible to every subagent in every context that loads this project

For exam scenarios, the heuristic is scope as narrowly as possible; escalate scope only when a tool is genuinely needed across the broader context. MCP Server Integration Best Practices covers the full decision tree.

How do Skills, MCP servers, and slash commands differ?

This distinction is one of the most-searched questions among CCAR-F candidates, and getting it wrong leads to misattributing faults to the wrong layer in exam scenarios.

MCP prompts can be exposed as slash commands via the /mcp__server__prompt naming convention. The prompts themselves live in the MCP server; the shortcut lives in Claude Code's configuration layer. When the exam asks which layer to modify to fix a broken prompt workflow, trace the fault: wrong prompt content means the MCP server; prompt never invoked correctly means skill or command routing in Domain 3 territory.

The division matters because Domain 2 items ask you to fix tool and server behaviour, while Domain 3 items ask you to fix configuration and invocation patterns. Misidentifying the layer costs marks even when the underlying technical judgment is sound.

What does the exam expect about tool overload and tool_choice?

The Tool Overload Problem emerges when an agent is given more tools than it can reliably route among. The exam presents this as a latency or accuracy regression that appears after a new batch of tools is added. The fix is almost never to rewrite descriptions for all tools. It is to reduce the active tool set visible to that agent, either by splitting agents by responsibility or by using tool_choice to constrain which tools an agent may invoke:

{
  "tool_choice": { "type": "tool", "name": "get_invoice_line_items" }
}

Setting tool_choice to a specific tool forces a call to that tool, which is correct for a gateway agent whose only job is data retrieval. Setting it to {"type": "auto"} is correct for a general-purpose planner. The exam asks you to match the configuration to the agent's role, not to choose the most permissive option.

What MCP security knowledge does the exam require?

Security questions in Domain 2 focus on approval gates and blast radius, not on specific CVEs or security framework syntax.

Approval gates address whether a tool invocation should proceed automatically or require human review. The exam rewards the answer that keeps automation for low-stakes, reversible actions and requires explicit approval for writes, deletes, or external-system operations. Deterministic enforcement in code outranks prompt-based enforcement when the stakes are high. This principle appears across multiple Domain 2 scenarios in the Tool Design & MCP Integration concept library.

Blast-radius questions ask what happens when a tool or server is compromised. The correct answer always favours narrow scoping: a tool that can only read from one schema is less dangerous than one with broad access. The exam rewards least-privilege thinking applied at the scoping and description level, with the same determinism preference that appears throughout the architect track.

How should you structure your Domain 2 preparation?

We recommend three passes through the material.

1. Concepts first. Work through the Tool Design & MCP Integration concept library. Pay particular attention to the four error categories, the isError flag pattern, and the scoping hierarchy. These three areas account for the majority of Domain 2 scenario types.

2. Failure modes second. Every concept needs a failure mode you can recognise under exam conditions. For tool descriptions: misrouting. For MCP scoping: privilege escalation or missing access. For isError: loop-on-error or silent data loss.

3. Elimination practice third. CCAR-F multiple-response items specify how many answers to select. Practice eliminating the "plausible but disproportionate" option, which the exam uses to test whether you reach for the smallest effective fix before a larger architectural change.

The AI Skill Certs adaptive engine uses Bayesian Knowledge Tracing with a 0.90 mastery threshold. If you score below that threshold on a Domain 2 concept, the platform routes you back to targeted practice before advancing. That granularity matters here because five or six closely related concepts can appear in a single exam scenario.

Are you ready to sit the Domain 2 items?

Before you book your $125 exam attempt, verify your confidence on each of these:

1. You can explain why a tool description causes misrouting without seeing the full tool list.
2. You can classify a tool result as access failure versus valid empty result using only the isError flag and content field.
3. You can identify the correct tool_choice configuration for a given agent role.
4. You can name the correct scope level for an MCP server given who needs access and who should not.
5. You can choose between prompt-based and programmatic enforcement for a described security constraint.

If any of these feel uncertain, the concept library covers each as a standalone atomic concept mapped directly to CCAR-F task statements.

AI Skill Certs is an independent prep platform and is not affiliated with or endorsed by Anthropic.