What is mcp in AI?

Why — the first-principles explanation

MCP is a connection protocol around an AI application, not a new model and not an autonomous agent.

The participants. An AI application is the MCP host. It creates an MCP client for each MCP server it connects to. The server is a program that provides context or actions, and it can run locally on the same machine or remotely over the network. The protocol lets the host discover what a server offers and exchange structured messages without every app inventing a different connector.

The two layers. The data layer uses JSON-RPC semantics and defines capability discovery, notifications and the core primitives. The transport layer handles how messages move and how the connection is authorized. The official architecture documentation describes local STDIO transport and remote Streamable HTTP transport; remote authorization commonly uses OAuth, while local processes often receive credentials from their environment.

The primitives. A server can expose resources such as file contents or database records, prompts such as reusable interaction templates, and tools such as functions that query, create, update or delete something. Resources provide context; tools can create side effects. That distinction matters more than the label “MCP.” A read-only database query and a tool that sends money may use the same protocol but require completely different approvals.

What MCP changes. Without a shared protocol, an AI app and each data source need bespoke integration code. MCP supplies a common discovery and call shape so a client can list available tools, retrieve resources and invoke an allowed tool. It reduces connector duplication; it does not remove the need to design the connector, map data, validate inputs or handle failures.

What MCP does not change. MCP is not a permission bypass, an identity provider, a database, a safety certification or a guarantee that a model understands the tool correctly. A host still decides which servers to trust, which tools to import, what credentials and scopes to provide, and whether a person must approve each call. A tool response can be wrong, malicious or prompt-injection content, and remote servers can see the data sent to them.

The security boundary. The MCP security guidance calls out confused-deputy authorization flaws, token passthrough and SSRF. OpenAI's MCP documentation warns that a malicious remote server can exfiltrate sensitive data in the model context and recommends approval and careful review. Use exact server URLs, least-privilege scopes, allowlisted tools, per-client consent, audience-validated tokens, network isolation, logging and a revocation path. Treat the server and every tool description as untrusted until reviewed.

For a practical decision, start with the smallest read-only connection that proves value. Add write tools only after you have an acceptance test, approval gate, rollback path and audit trail. MCP standardizes the plug; your architecture still decides what is connected, what can change and who is accountable.

An example that makes it click

How to do it

1. Write the workflow and side effects first: read a document, search a database, draft a change, update a record or send an external message.
2. Choose local STDIO or remote Streamable HTTP based on the trust boundary, network policy, latency and deployment model. Do not expose a local credential or private service merely to make remote access convenient.
3. Inspect the server identity, source code or vendor controls, transport endpoint, data it can receive, dependencies, update process and incident contact before connecting it.
4. Inventory the primitives. Separate resources and prompts from tools, and mark every tool as read-only, reversible write, or irreversible/high-impact action.
5. Apply least privilege: allowlist only the tools needed, scope credentials to the smallest data set, validate token audience and use per-client consent for OAuth flows.
6. Keep approval before sensitive calls. Show the server, tool name, arguments, data leaving the boundary and expected side effect; require a person to approve or reject the action.
7. Test with representative data, prompt-injection text, malformed arguments, tool errors, timeouts, revoked credentials and oversized outputs. Verify that failures stop rather than silently broaden access.
8. Log discovery, authorization, tool calls, results, approvals and actor identity without storing unnecessary secrets. Add rate limits, timeouts, rollback and a kill switch.
9. Measure the accepted result, latency, token/tool cost and review burden. Keep the connection read-only or remove it if it does not beat a simpler API, search or workflow.

Key facts

• The official MCP introduction defines MCP as an open standard for connecting AI applications to external systems such as data sources, tools and workflows.
• MCP uses a host-client-server architecture: the host coordinates clients, each client maintains a connection to one server, and the server provides context to the client.
• The MCP architecture documentation separates a JSON-RPC-based data layer from a transport layer that handles connection establishment, messaging and authorization.
• MCP servers can expose resources, prompts and tools. Tools are executable functions and may cause side effects; resources are contextual data and prompts are reusable interaction templates.
• Local MCP servers commonly use STDIO, while remote servers can use Streamable HTTP; remote authentication and authorization need their own security controls.
• MCP standardizes discovery and message semantics; it does not verify that a server is trustworthy or that a model's tool call is correct.
• MCP's security guidance addresses confused-deputy attacks, token passthrough, SSRF, consent, redirect validation, OAuth state and token audience checks.
• OpenAI's MCP documentation says remote servers can expose connectors and tools, supports explicit approval for calls and warns that a malicious server may exfiltrate data in the model context.
• Anthropic announced MCP as an open standard and later described its donation to the Linux Foundation's Agentic AI Foundation; governance and ecosystem stewardship are separate from the protocol's technical permission boundary.

What authoritative sources say

People also ask

The same question, asked other ways

This page answers one intent expressed in 4 phrasings. How the index is organized →

• What is mcp in AI?
• What is model context protocol?
• How does mcp work in AI?

Related questions