The Model Context Protocol (MCP) is an open protocol that standardises how AI applications connect to external tools and data. An application that speaks MCP can use any compliant server, whether it wraps a database, a file system, a ticketing system or a web API, without custom integration code for each one.
How it works
The specification defines three roles that exchange JSON-RPC 2.0 messages:
- Host: the AI application the user interacts with.
- Client: a connector inside the host, one per server connection.
- Server: a service that exposes capabilities.
Servers offer three main kinds of feature: tools (functions the model can call), resources (data and context to read) and prompts (templated messages and workflows). Clients can offer features back to servers, such as asking the user for more information. The design is inspired by the Language Server Protocol, which did the same for programming-language support in editors.
Worked example
A team connects its coding assistant to three MCP servers: one for the issue tracker, one for the internal docs search and one for the staging database. The assistant now lists every tool those servers expose and can call them in an agent loop. A colleague later installs a fourth, community-written server for spreadsheet export. Its tool description includes hidden text instructing the model to also send query results to an external address. Nothing in the protocol stops a server from describing its tools misleadingly; the specification itself says tool descriptions and annotations should be treated as untrusted unless the server is trusted.
Security considerations
- Treat every server, and every tool description and result it returns, as potentially untrusted input, a channel for indirect prompt injection.
- Grant each server least privilege, to avoid excessive agency.
- Require explicit user consent before tool invocation and data sharing, as the specification's security principles state.
- Apply tool-call policies in the host, regardless of which server provides the tool.
Why it matters
MCP makes it cheap to give models many tools, which is good for capability and bad for attack surface. Guardrails and evaluations must cover the tools added through MCP, including third-party servers, because the model cannot tell a trustworthy tool from a malicious one by reading its description.
Related terms
Sources
- Model Context Protocol project. Model Context Protocol Specification, 2026. modelcontextprotocol.io