What Is Model Context Protocol (MCP)? A Practical Explainer
MCP is the standard way AI assistants plug into tools and data. Here is how it works, who supports it, what changed in 2026 and how to use it safely.
Model Context Protocol (MCP) is an open standard that lets AI assistants connect to outside tools and data, such as files, databases and business apps, through a common interface. An MCP server exposes tools, resources and prompts; an AI app's MCP client uses them. It cuts custom integration work but needs strict permissions and user consent.
Photo: Unsplash
On this page
AI assistants are good at writing and reasoning, but on their own they cannot see your files, check your CRM or open a ticket. Every connection used to need a custom integration, built separately for each AI app and each tool. That does not scale.
Model Context Protocol, usually shortened to MCP, is the fix most of the industry has settled on. It is an open standard that gives AI applications one consistent way to connect to tools and data. This explainer covers what MCP is, how it works, who backs it, what changed in the 2026 version of the spec and, most important, how to use it without opening security holes.
Model Context Protocol in plain English
Think of MCP as a universal adapter between AI apps and the rest of your software. Instead of each AI vendor building a connector for each tool, a tool provider builds 1 MCP server, and any AI app that supports MCP can use it.
Anthropic introduced MCP in November 2024 as an open standard for connecting AI assistants to “the systems where data lives.” Early example servers covered Google Drive, Slack, GitHub, Git and Postgres. The official spec says MCP takes inspiration from the Language Server Protocol, which did the same job for code editors and programming languages.
The result is a classic network effect. The more AI apps support MCP, the more worthwhile it is for software vendors to publish MCP servers, and the more useful each AI app becomes.
How MCP works: hosts, clients and servers
MCP has 3 roles, defined in the specification:
- Host: the AI application the user interacts with, such as a chat app, an IDE or an agent platform.
- Client: the connector inside the host that talks to one MCP server.
- Server: a program that exposes capabilities from a tool or data source, such as a file system, database or SaaS app.
Messages travel in JSON-RPC 2.0, a simple, widely used format for remote calls. Servers can offer 3 main kinds of features:
| MCP feature | What it is | Business example |
|---|---|---|
| Tools | Functions the AI model can call | “Create a support ticket” or “Look up an order” |
| Resources | Data and context the user or model can read | A product catalog, a policy document, a database record |
| Prompts | Templated messages and workflows for users | A “weekly sales summary” prompt a user can pick |
| Elicitation (client feature) | A way for a server to ask the user for more information | Asking which account to use before running a report |
A typical flow looks like this: a user asks the assistant to summarize open high-priority tickets. The host sees that a connected ticketing server offers a “search tickets” tool, the model asks to call it, the host gets the user’s approval, the server returns results and the model writes the summary.
Transports: local and remote servers
The spec defines 2 standard ways to connect:
- stdio: the host launches the server as a local program on the same machine. Common for developer tools and desktop apps.
- Streamable HTTP: the server runs as a web service, and each message is an HTTP POST to a single MCP endpoint. Common for hosted, multi-user connectors.
For HTTP servers, MCP defines an optional authorization framework based on OAuth 2.1. Local stdio servers are expected to get credentials from their environment instead.
What changed in the 2026 MCP spec
MCP is versioned by date, and the July 28, 2026 revision (2026-07-28) is a significant update. Per the official changelog:
- MCP is now stateless. The old initialization handshake and protocol-level sessions are gone. Every request carries its protocol version and client capabilities, which makes servers easier to run behind load balancers.
- A new discovery call. Servers must implement
server/discoverso clients can learn supported versions and capabilities up front. - Server-initiated requests are replaced. A new multi round-trip pattern lets a server ask for more input by returning an “input required” result instead of sending its own request.
- Some features are deprecated. Roots, Sampling and Logging are marked deprecated but still work during a deprecation window of at least 12 months.
- Optional extensions. Features such as long-running Tasks and MCP Apps, which render interactive UI inside a conversation, are opt-in extensions.
If you use off-the-shelf MCP servers, your vendors handle this. If you build your own, plan to support both older and newer clients for a while, as the spec’s backward compatibility guidance describes.
Who supports MCP and who governs it
MCP has moved well beyond its creator. In December 2025 Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. Anthropic’s announcement cited adoption in products including ChatGPT, Cursor, Gemini and Microsoft Copilot, and more than 10,000 active public MCP servers.
OpenAI’s new plugin system for ChatGPT and Codex also uses MCP servers to expose tools, and those plugins are replacing custom GPTs. Our guide on how to build a custom GPT or AI assistant covers that shift.
For a business, neutral governance matters. It lowers the risk that the standard changes direction to favor 1 vendor, and it makes MCP a safer bet for integrations you plan to keep for years.
What businesses use MCP for
MCP is plumbing, so its value shows up in what it enables:
- Internal knowledge assistants that search approved document stores and wikis. This often pairs with retrieval-augmented generation.
- Customer support assistants that look up orders, account status and past tickets.
- Sales and CRM tasks such as summarizing an account before a call or logging meeting notes.
- Software teams connecting coding assistants to repositories, issue trackers and CI logs.
- Operations workflows where AI agents pull data from several systems, draft a report and route it for approval.
The common thread: MCP lets you add a new system to your AI setup without rebuilding everything else.
MCP security risks and how to manage them
MCP’s own spec is blunt about the stakes. It says tools represent arbitrary code execution and must be treated with caution, and that hosts must get explicit user consent before invoking any tool. MCP cannot enforce this at the protocol level; the apps and servers you choose have to.
Here are the main risks the official security guidance and spec call out, with practical defenses:
| Risk | What can go wrong | How to reduce it |
|---|---|---|
| Untrusted tool descriptions | A malicious server describes a tool misleadingly to steer the model | Use servers from trusted publishers; treat descriptions as untrusted |
| Prompt injection via data | A document or email contains hidden instructions the model follows | Require approval for actions; limit what tools can do |
| Token passthrough | A server accepts or forwards tokens not issued for it | Servers must only accept tokens issued for them |
| Confused deputy | A proxy server is tricked into granting access without consent | Per-client consent and exact redirect URI checks |
| Local server compromise | A one-click install runs a malicious command on a laptop | Show the full command, require approval, sandbox servers |
| Over-broad scopes | A stolen token grants access to everything | Start with minimal scopes and add more only when needed |
Key takeaway: MCP makes it easy to connect AI to your systems, which also makes it easy to over-connect. Treat every MCP server like a new employee with system access: vet it, give it the least access it needs, and review what it does.
These ideas map directly onto zero trust security: verify every request, grant least privilege and assume any component could be compromised.
Where to start with MCP
A sensible rollout for a business looks like this:
- Inventory. List the AI apps your teams use and check which support MCP connectors today.
- Pick 1 use case. Choose a read-only, low-risk connection first, such as searching an internal wiki.
- Prefer official servers. Use MCP servers published by the software vendor or a trusted source, and pin versions.
- Set permissions. Connect with a dedicated account or narrow OAuth scopes, never an admin login.
- Keep humans in the loop. Require approval for any tool that sends, deletes, buys or changes records.
- Log and review. Turn on logging for tool calls and review it during the pilot.
- Expand gradually. Add write actions or more systems only after the first connection proves reliable.
If you are building your own server, read the spec’s authorization and security best practices pages before writing code.
The bottom line
Model Context Protocol has become the standard way for AI assistants and agents to reach real tools and data. It reduces integration work, gives you more freedom to switch AI vendors and is now governed under the Linux Foundation. The trade-off is that every connection is a new path into your systems. Start small, use trusted servers, keep permissions tight and require human approval for anything consequential.
Sources
- Model Context Protocol specification (latest) — architecture, features, security and consent principles
- MCP specification changelog, 2026-07-28 — stateless design, server discovery and deprecations
- MCP security best practices — token passthrough, confused deputy, local server and scope risks
- Anthropic: Introducing the Model Context Protocol — November 2024 launch and early example servers
- Anthropic: Donating MCP and establishing the Agentic AI Foundation — governance move and adoption figures
- Linux Foundation: formation of the Agentic AI Foundation — foundation structure and founding members
Frequently asked questions
What is MCP in AI?
MCP, or Model Context Protocol, is an open standard that lets AI applications connect to external tools and data sources in a consistent way. A tool provider builds an MCP server once, and any MCP-compatible AI app can use it to read data or take actions. It is now governed by the Agentic AI Foundation under the Linux Foundation.
Who created the Model Context Protocol?
Anthropic created MCP and released it as an open standard in November 2024. In December 2025 Anthropic donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. MCP's maintainers continue to develop the spec with community input, and many AI vendors now support it.
Is MCP the same as an API?
No. An API is a specific interface for one service. MCP is a standard way for AI apps to discover and use many services, including their APIs. An MCP server often wraps an existing API, describing its tools and data in a format any MCP-compatible AI app understands, so the app does not need a custom integration for each service.
Is MCP secure?
MCP can be used securely, but the protocol cannot enforce security on its own. The spec requires hosts to get user consent before invoking tools and defines OAuth 2.1-based authorization for remote servers. Your risk depends on the servers you trust and the permissions you grant. Use vetted servers, minimal scopes, human approval for actions and logging.
Do I need to be a developer to use MCP?
No. Many AI apps let you add MCP connectors through settings, often with a sign-in step, and software vendors increasingly publish official servers. Building a custom MCP server for an internal system does require development skills. Either way, involve IT or security before connecting systems that hold sensitive or customer data.
What is the difference between MCP and RAG?
RAG is a technique for retrieving relevant text and adding it to a model's prompt so answers reflect your documents. MCP is a protocol for connecting AI apps to tools and data sources. They work together: an MCP server can provide the search tool or document resources that a RAG-style assistant uses to answer questions.
What changed in the latest MCP specification?
The 2026-07-28 revision made MCP stateless by removing the initialization handshake and protocol-level sessions, added a required server discovery call and replaced server-initiated requests with a multi round-trip pattern. It also deprecated the Roots, Sampling and Logging features, which keep working during a deprecation window of at least 12 months.
Was this guide useful
No reviews yet. Share your experience and help other readers.
Write a review
Manishdai
Manishdai writes about the technology that is reshaping every industry — from AI agents and cloud platforms to healthtech, fintech and the IT companies building it all across the United States.
manishdai.com