What is MCP? The Model Context Protocol explained

The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to outside systems such as files, databases, search engines and other tools. The official MCP documentation compares it to a USB-C port for AI apps: one standard plug, instead of a custom connector for every pair of app and service. If you are asking what MCP is, that is the short answer. The rest of this page covers how it works, who supports it, and where it can go wrong.

What MCP is for

Before a shared standard, each AI app wrote its own integration for each service. MCP defines one way to do it. A service builds an MCP server once, and any app that speaks MCP can use it. The docs list examples: an agent that reads your Google Calendar and Notion, Claude Code generating a web app from a Figma design, and enterprise chatbots that query several company databases.

The standard covers only the exchange of context. The architecture page says MCP does not dictate how an AI application uses language models or manages the context it receives. That part stays with the app.

How MCP works: hosts, clients and servers

MCP uses a client-server design with three roles.

• Host: the AI application, such as Claude Code, Claude Desktop or Visual Studio Code. It coordinates everything.
• Client: a component inside the host that keeps one connection to one server. The host creates one client per server.
• Server: a program that provides context or actions to clients.

"Server" says nothing about where the program runs. A server that runs on your own machine is called local. One run by a vendor, such as the Sentry MCP server that the docs use as an example, is called remote. A local server usually serves one client, and a remote one usually serves many.

The two layers: data and transport

The protocol has two layers. The data layer defines the messages, which use JSON-RPC 2.0, a simple request and response format built on JSON. It covers discovery of what a server can do, the features servers offer, and notifications. The transport layer carries those messages. MCP defines two transports:

Tools, resources and prompts

Servers offer three kinds of things, which the spec calls primitives.

• Tools are functions the AI can call to do something: run a file operation, call an API, query a database.
• Resources are data the AI can read for context, such as file contents, database records or API responses.
• Prompts are reusable templates that structure an interaction, such as system prompts or few-shot examples.

Each has a listing call, so a client can ask a server what it has before using it. The docs give a database server as the model case: tools to run queries, a resource holding the schema, and a prompt with example questions.

Tools are described with a name, a plain-language description and a JSON Schema for their inputs. The AI app collects the tools from every connected server, shows them to the model, and when the model picks one, the app routes the call to the right server and passes the result back.

Clients can offer a feature in return. Elicitation lets a server ask the user for more information or confirmation in the middle of a task.

What changed in the latest spec

The latest MCP specification release is dated 2026-07-28. The MCP repository on GitHub marks it as the stable release, following a release candidate published on May 29. Its changelog lists the changes since the 2025-11-25 revision. The main ones:

• Stateless protocol. The initialize handshake and protocol-level sessions are gone. Every request carries its protocol version and the client's capabilities.
• Discovery. Servers must support a server/discover call that reports their versions, capabilities and identity.
• Opt-in change notifications. A client opens a subscriptions/listen stream and names the events it wants.
• Deprecations. Roots, Sampling and Logging are deprecated, along with the old HTTP+SSE transport and OAuth Dynamic Client Registration (in favor of Client ID Metadata Documents). The spec sets a minimum twelve-month deprecation window.
• Tasks moved out of the core into an official extension for long-running requests.

Who supports MCP

The MCP docs say the protocol is supported across a wide range of clients and servers. They name AI assistants Claude and ChatGPT, and developer tools including Visual Studio Code, Cursor and MCPJam. Each links to its own MCP documentation. The project also ships official SDKs for several programming languages, a debugging tool called MCP Inspector, and reference server implementations on GitHub.

Limits and risks

MCP gives a model the ability to act, so the risks are mostly about what a connected server can do.

Human in the loop. The tools spec says there should always be a human able to deny tool calls. It tells apps to show which tools the model can use, mark when one runs, and ask for confirmation. It also says clients must treat tool annotations as untrusted unless the server is trusted.

Local servers run code. The security best practices warn that a local server runs with the client's privileges. A malicious startup command or a tampered package can run arbitrary commands or send files off the machine. The docs say clients with one-click setup must show the exact command and get approval first, and should sandbox servers.

Authorization mistakes. The same page describes several attacks on remote servers. In a confused deputy attack, a proxy server lets an attacker obtain tokens without the user's consent. Token passthrough, where a server forwards tokens not issued to it, is forbidden. Other items include server-side request forgery during OAuth discovery and guessable state handles. The spec also asks servers to request narrow permissions rather than broad ones.

It does not fix reliability. MCP standardizes the connection, not how well a model uses it. A controlled study we covered gave six models the same tools through MCP and through a command line. Scores differed by tens of points on some tasks, and neither interface won across the board. The study used research benchmarks and small to mid-size models, so it does not show how production tools behave. The practical lesson is to test your own tools with your own model.

Where to start

To try MCP, check whether your AI app has an MCP or connectors setting and add one server you trust. Read what it can do first, and keep confirmation prompts on. To build one, the official docs have guides for servers and clients, and the SDKs handle most of the protocol details for you.