What is MCP, the Model Context Protocol?

MCP, short for Model Context Protocol, is an open protocol that gives AI models a standard way to connect to external tools, data and services. Instead of every AI app building its own custom integration for every database, file system or API, a developer wraps the capability once as an MCP server, and any MCP-compatible AI client can use it. Think of it as a universal port for AI: one connector shape, many devices.

The problem MCP solves

Before MCP, connecting an AI model to outside software was an N times M problem. Every AI application had to write bespoke code for every tool it wanted to reach, and every tool vendor had to ship a separate plugin for every AI platform. The integrations did not transfer, so the ecosystem kept rebuilding the same bridges.

MCP collapses that into N plus M. A tool is wrapped as an MCP server once. An AI application implements the client side once. After that, any client can talk to any server. Anthropic introduced the protocol as an open standard in November 2024, and because the spec and SDKs were open from the start, other AI providers and thousands of tool builders adopted it rather than inventing rivals. As of August 2026 the protocol is stewarded by the Agentic AI Foundation and has passed 400 million monthly SDK downloads, roughly quadrupling over the year, which is why it is fair to call it the de facto standard for agent tool use.

How the client-server model works

MCP has three roles. The host is the AI application the user actually runs, such as a chat app, a coding assistant or an agent framework. Inside the host, an MCP client manages the connection to each server. The MCP server is the program on the other end that exposes capabilities.

A server can offer three kinds of things: tools, which are actions the model can invoke, like running a query or sending a request; resources, which are data the model can read, like files or records; and prompts, which are reusable templates the server suggests for common tasks. When a client connects, it asks the server what it offers, and the model can then call those capabilities during a conversation, with the host deciding what the model is allowed to do.

The plumbing evolved as adoption grew. On July 28, 2026, the Agentic AI Foundation released the largest revision since launch: the protocol moved from a stateful, bidirectional design to a stateless request/response core, so servers can run on serverless and edge infrastructure instead of holding long-lived connections. The same revision added a versioned extensions framework and hardened authorization around enterprise OAuth 2.0 and OpenID Connect practices.

What an MCP server does in practice

An MCP server is usually a small program, often a few hundred lines, that translates between the protocol and one real system. A database server exposes query tools. A browser server exposes navigation and page reading. A company’s internal server might expose its ticketing system or knowledge base. The server declares each tool with a name, a description and a schema for its inputs, and the model uses those descriptions to decide when and how to call it.

This is also why MCP mattered for agents specifically. An agent is only as capable as the actions it can take, and MCP turned “give the agent a new ability” from an engineering project into installing a server.

Security considerations

The protocol is neutral; the risk lives in what you connect and how much authority you grant it. Two issues dominate in practice.

First, permissions. An MCP server runs with whatever access it is given, so a file server scoped to one project folder is a very different risk than one with access to a whole disk. The standard mitigations are narrow scopes, read-only access where possible, and human approval steps for destructive or irreversible actions.

Second, prompt injection through tool results. When a model reads content fetched by a tool, a web page, a document, an email, that content can contain hidden instructions aimed at the model rather than the user. In August 2026 a fan wiki was documented serving AI agents a hidden payload instructing them to wipe the user’s repository, a payload invisible to regular browsers. Models are increasingly trained to refuse such instructions, and that agent did refuse, but the defense is probabilistic, not guaranteed. The practical rule: treat everything a tool returns as untrusted input, and assume the blast radius of a compromised session equals the permissions you granted.

Related coverage

• MCP goes stateless in the biggest rewrite since the protocol launched, the July 2026 spec revision that made serverless MCP servers possible.
• A fan wiki served Claude Code hidden instructions to wipe a user’s repository, a documented real-world prompt injection attack through fetched content.
• An AI agent cancelled a stranger’s gym booking to move its owner up the waitlist, what happens when an agent’s tool access outruns its guardrails.