What is MCP (Model Context Protocol)?

What is MCP? The Model Context Protocol (MCP) is an open standard that lets LLM applications connect to outside tools and data in the same way, whoever built them. Its own documentation compares it to a USB-C port for these applications: instead of every assistant needing a custom integration for every service, a service publishes one MCP server and any MCP-compatible app can use it. This explainer follows the official specification, version 2026-07-28, checked on October 6, 2026.

The problem it solves

Without a shared protocol, connecting five assistant apps to five services means building up to 25 separate integrations. With MCP, each service builds one server and each app builds one client, and they all speak the same language. The protocol's documentation lists support in assistants such as Claude and ChatGPT and in developer tools such as Visual Studio Code and Cursor.

Some examples from the official introduction:

• an assistant that reads your Google Calendar and Notion to act as a more personal assistant;
• Claude Code building a web app from a Figma design;
• a company chatbot that queries several internal databases.

For what this means for a company, including costs and risks, see agents for business. Coding tools that support MCP are compared in Claude Code vs Cursor.

How it works: hosts, clients and servers

MCP has three roles:

A server can run on your own machine or on the internet. Local servers usually talk over standard input and output (the "stdio" transport) and serve one client. Remote servers use "Streamable HTTP" and can serve many clients; the specification recommends OAuth to obtain the access tokens they need. All messages, local or remote, use the JSON-RPC 2.0 format.

What a server can offer: tools, resources and prompts

The specification defines three core building blocks ("primitives") that servers expose:

• Tools: actions the model can carry out, such as querying a database, calling an API or editing a file.
• Resources: data the model can read for context, such as a file's contents or a database schema. Like retrieval in RAG, resources put outside data in front of the model; MCP standardizes how the data source is plugged in.
• Prompts: reusable templates, such as a system prompt or worked examples for using the server's tools.

Clients discover what a server offers by asking for its lists (tools/list, for example) and then call what they need (tools/call). Because the lists are fetched at run time, a server can add or remove tools without the app changing.

Servers can also ask the user for information through the client, which the specification calls elicitation: for example, to confirm an action before it runs. An older feature, sampling, which let servers request model completions through the client, is deprecated as of protocol version 2026-07-28.

MCP and agents

MCP is one of the ways an agent gets its tools. The agent's model decides which tool to use next; MCP is the standard plug through which those tools are found and called. Many tools that do not speak MCP natively can be wrapped in a small MCP server.

Security: what the specification asks for

MCP connects models to data and to actions with real effects, so the specification sets out principles that implementers must address:

• User consent and control: users must understand and agree to what data is accessed and what actions are taken, through clear interfaces for reviewing and authorizing activity.
• Data privacy: hosts must get explicit consent before exposing user data to servers, and must not send resource data elsewhere without consent.
• Tool safety: tools "represent arbitrary code execution and must be treated with appropriate caution". Descriptions of what a tool does should be treated as untrusted unless they come from a trusted server, and hosts must get explicit consent before invoking any tool.

The specification is also clear about its limits: MCP "cannot enforce these security principles at the protocol level". Whether an app asks for your consent properly depends on the app. In practice, install servers only from sources you trust, review what each tool can do, and be careful with any server that can both read private data and send data out. Injected instructions hidden in documents or web pages ("prompt injection") are the top risk in OWASP's 2025 list for LLM applications, and connecting more tools gives an injected instruction more to work with.

How to start using MCP

• As a user: many assistants and coding tools let you add MCP servers ("connectors") from their settings. Read what a server can do before you enable it.
• As a developer: the official site has SDKs, a reference list of servers and the MCP Inspector, a tool for testing servers during development.

If you run models on your own computer, LM Studio can also act as an MCP client for local models; see Ollama vs LM Studio.