What is MCP (Model Context Protocol)? A plain-English guide

Ask an AI assistant which of your invoices are overdue and, out of the box, it can't tell you. It has never seen your accounting app. For years the fix was a custom connector: one for your accounting app in this assistant, another for the same app in that one, and so on for every pairing of AI product and tool. In November 2024 Anthropic published a different answer, one plug that fits everywhere, and a year later ChatGPT, Gemini, Microsoft Copilot, VS Code and Cursor had all adopted it. So what is MCP, how does it work, and is it safe to plug your business into it? This guide answers all three in plain English.

What is MCP?

MCP, the Model Context Protocol, is an open standard for connecting AI applications to outside systems: data (files, databases), tools (search, email, a calculator) and ready-made workflows. An app that speaks MCP can use any tool that speaks MCP, without anyone writing a connector for that particular pair.

The project's own documentation compares it to a USB-C port for AI applications. Before USB-C, every device had its own cable; now one port fits all. MCP does the same for the line between an AI app and the things it needs to reach.

Three things MCP is not, because they cause most of the confusion:

• Not a model. It doesn't make an AI smarter; it lets the AI see and use more things.
• Not an agent. An AI agent plans and acts. MCP is how it reaches its tools; in the docs' words, MCP "does not dictate how AI applications use LLMs or manage the provided context."
• Not a product you buy. It's a published specification with free SDKs. Products build on it.

The specification credits the Language Server Protocol, which did the same for code editors and programming languages, as its inspiration.

Why MCP exists: the connector problem

Take five AI apps and twenty business tools. Without a standard, connecting them all takes up to a hundred integrations, each maintained separately. With a shared protocol, each tool builds one MCP server and each app one MCP client: twenty-five pieces of work instead of a hundred, and every new tool works in every app that speaks the protocol.

Who made MCP, and who uses it

By the time of the donation, Anthropic counted more than 10,000 active public MCP servers and over 97 million monthly downloads of the official Python and TypeScript SDKs. The same maintainers still run it, now on neutral ground.

What adoption looks like in practice today:

• OpenAI: its API can connect models to remote MCP servers, with tool calls either allowed automatically or held for approval, and ChatGPT implements the open MCP Apps standard, so an MCP server can show its own interface inside a conversation.
• Google: runs official remote MCP servers for its cloud products, including BigQuery, Cloud SQL, Cloud Run, Cloud Storage and Google Maps, and publishes open-source ones for Google Workspace, Firebase and more.
• Microsoft: Copilot Studio agents pick up the tools and resources of any MCP server you connect, and VS Code lets its agents use MCP servers you add.

There is also an official MCP Registry, a public catalogue of MCP servers backed by contributors including Anthropic, GitHub, PulseMCP and Microsoft. It's still marked as a preview, so expect it to change.

How does MCP work? Hosts, clients and servers

MCP has three roles:

• The host is the AI application you use: a chat app, a code editor, an agent platform.
• A client is the connector inside the host. The host creates one client for each server it connects to.
• A server is a program that offers something to the AI: your files, a database, GitHub, your accounting app.

A server can run locally, as a small program on your computer that talks to the host through standard input and output, or remotely, on the web, over HTTP (the spec calls it Streamable HTTP). Sentry's official server is remote; the reference filesystem server runs locally. Either way the messages are JSON-RPC 2.0, a simple, long-established format for asking another program to do something.

What a server can offer

A database server, to take the docs' own example, might offer tools to query the database, a resource with its schema, and a prompt with worked examples of good queries.

What a client can offer

Communication goes both ways. A server can use elicitation to ask the user for something mid-task: a missing detail, or a confirmation before it acts. Older features that let a server borrow the host's model (sampling), learn which folders it may touch (roots) or send log messages (logging) still work but were deprecated in the 2026 version, and new software shouldn't adopt them.

A tool call, step by step

Back to the overdue invoices. Say your accounting app runs an MCP server and your AI app is connected to it.

1. Discover. The client asks the server which tools it has (tools/list). Each comes with a name, a description written for the model, and a schema of the inputs it accepts.
2. Decide. You ask your question. The model sees the tool list and decides that a tool called, say, invoices_list_overdue will answer it.
3. Call. The client sends the call. Under the current spec it looks like this (the tool is our illustration; the message shape is the spec's):

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "invoices_list_overdue",
    "arguments": { "days_late": 7 },
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientCapabilities": { "elicitation": {} }
    }
  }
}

1. Answer. The server queries the accounting app and returns the result, marked "resultType": "complete".
2. Reply. The model reads the result and writes your answer. Sending reminders would be another tool call, and a good host asks you first.

If you want the bigger picture of models, tools and loops, see how AI agents work.

What changed in 2026: a stateless MCP

The 2026-07-28 version rebuilt the protocol's foundations. If you've read an older guide, these are the differences:

• No handshake, no sessions. Every request now carries its own protocol version and capabilities, so a server handles each one without remembering the last. A new server/discover request tells a client what a server supports.
• Questions back to the user work differently. A server that needs input returns an "input required" result, and the client retries the request with the answers.
• Long jobs moved to an extension. Tasks, for operations that take minutes, are now an optional extension, alongside MCP Apps for interactive interfaces.
• Tighter sign-in rules, and a policy that deprecated features keep working for at least twelve months, so nothing breaks overnight.

MCP vs API, function calling and A2A

MCP vs API. An API is how one service lets programs talk to it, and every API is different. An MCP server usually wraps an existing API and describes it in a form any AI app can discover and use. MCP doesn't replace APIs; it makes them usable by AI without custom glue.

MCP doesn't replace function calling either: the host still uses it to let the model pick an MCP tool. MCP standardises where the tools come from.

MCP vs A2A. The Agent2Agent protocol, created by Google and a Linux Foundation project since June 2025, connects agents to other agents so they can hand work to each other. MCP connects an agent to tools and data. They're complementary: an agent might use A2A to delegate to a specialist agent, which uses MCP to reach a database. More on agents working together in multi-agent AI explained.

MCP examples: what people connect

• Code and engineering: GitHub's official server lets an assistant read code and manage issues and pull requests; Sentry's lets it search errors and triage issues; the reference Git server reads and searches repositories.
• Data: Google's managed servers for BigQuery, Cloud SQL and Spanner let an assistant work with those databases directly.
• Files and the web: the reference filesystem server, with configurable access controls, and the fetch server, which turns web pages into text a model can read.
• Everyday work: the MCP docs' own examples include an agent working across your Google Calendar and Notion, and turning a Figma design into a web app.

The MCP project's own reference servers are, in its words, "educational examples," not production-ready software. For real work, prefer a server maintained by the tool's own vendor.

Is MCP secure? The risks and the safeguards

More reach means more that can go wrong, and the specification is candid about it: tools "represent arbitrary code execution and must be treated with appropriate caution," hosts must get explicit user consent before invoking any tool, and there "SHOULD always be a human in the loop with the ability to deny tool invocations." It also admits that MCP "cannot enforce these security principles at the protocol level." Safety depends on the app and the servers you choose. The main risks:

• Tool poisoning. The model reads a tool's full description; you usually see a short label. In April 2025 Invariant Labs showed a harmless-looking "add two numbers" tool whose hidden description told the AI to read the user's configuration file and private SSH key and slip them into an extra argument, sent to the attacker's server. They also showed rug pulls, where a server changes a tool's description after you approved it, and shadowing, where a malicious server's description changes how the AI uses a different, trusted server's tools.
• Prompt injection through content. Even an honest server returns text written by strangers: an email, a web page, an issue comment. Instructions hidden in it can steer the AI. See prompt injection, and how to stay safe.
• Over-broad access. A token that grants everything ("files:", "admin:") turns one leak into a disaster. The MCP security guidance calls for a minimal starting scope and asking for more only when a sensitive action first needs it.
• Token passthrough and confused deputies. A server must only accept tokens issued for itself and never pass a client's token on to another service. Servers in front of third-party APIs must get your consent per client, or an attacker can ride on approval you gave earlier.
• Malicious local servers. A local server is a program on your machine with your permissions. The guidance requires apps with one-click setup to show the exact command before running it and to get your explicit approval.

Remote servers that need sign-in use OAuth 2.1, the standard behind the familiar "allow this app to access your account" screens, so you grant access on the service's own page and the app gets a limited token instead of your password. OWASP keeps a separate MCP Top 10, still in beta, whose list runs from token mismanagement and scope creep to tool poisoning, supply chain attacks and "shadow" MCP servers running outside an organisation's security oversight.

Before you connect an MCP server

1. Know who made it. Prefer the vendor's own server, or one you can read the code of.
2. Grant the least access. Read-only first. Widen it when a job needs it.
3. Keep approvals on for anything that writes: sending, deleting, paying, changing records. Our guide to human-in-the-loop AI explains why.
4. Read the tool list. Unexpected tools, or descriptions full of instructions, are a red flag. Check again after updates.
5. Keep secrets out of the model's reach. Credentials belong in a vault or the server's configuration, never in a chat.
6. Keep a log of every tool called, with what inputs.

How products use MCP

For most people MCP is invisible: you click "connect" next to an app's name, sign in on that app's page, and the AI can use it. Behind the click, the product runs an MCP client that talks to the app's server.

One example is crew bot. Its crew works in your email, a browser, databases, servers and routers, the web apps you sign it in to, more than 240 apps (most connected with one click), and "any app with an MCP connector." Logins are encrypted and never shown to a model, and the crew asks before it sends an email, changes an account or runs anything that writes, unless you've told it to go ahead.

If a term here was new, the AI agent glossary has short definitions of MCP, tools, RAG and the rest.

FAQ

What does MCP stand for in AI?

Model Context Protocol: an open standard for connecting AI applications to outside tools and data, introduced by Anthropic in November 2024 and now looked after by the Agentic AI Foundation under the Linux Foundation.

Is MCP only for Claude?

No. Anthropic created it, but ChatGPT, Gemini, Microsoft Copilot, Visual Studio Code and Cursor have adopted it, and OpenAI co-founded the foundation that now looks after it.

What is an MCP server?

A program that offers tools, data or prompt templates to AI apps through the protocol, on your own computer or on the web. GitHub, Sentry and Google Cloud are among the companies running official servers for their products.

Do I need to code to use MCP?

Not to use it. In most AI apps you add a connector from a list, or paste a server's address, and sign in. Building your own MCP server is a developer job, made easier by the official SDKs in ten languages.

Is MCP safe?

As safe as the app and servers you connect. Use servers from vendors you trust, grant the least access a job needs, keep approvals on for anything that sends, pays or changes records, and watch for tool descriptions that change after you approved them.