What Is MCP? Model Context Protocol Explained

Model Context Protocol (MCP) is an open standard, launched by Anthropic in November 2024, that defines how large language models (LLMs) connect to external tools, data sources, and systems. Think of it as USB-C for AI: one universal port that any model can plug into, instead of a different cable for every device. By late 2025 the protocol had grown from a niche developer spec into shared infrastructure adopted by OpenAI, Google DeepMind, and Microsoft, and in December 2025 Anthropic handed governance of the standard to the Linux Foundation's new Agentic AI Foundation, turning MCP from a company project into vendor-neutral public infrastructure.

Before MCP, every integration between an AI app and an external service — Slack, GitHub, a database, a file system — was bespoke. Each LLM vendor invented its own function-calling format. Each developer rewrote the same plumbing for every new tool and every new model. MCP fixes that fragmentation with a single wire protocol that any client and any server can speak, regardless of who built either side.

Why MCP Exists

By late 2024, three problems had become obvious to teams building AI products that needed to do more than chat.

1. The N×M integration explosion. With N LLM applications and M external tools, developers ended up writing roughly N×M custom connectors — one for every app-tool pairing. A team supporting five AI clients and twenty tools faced up to 100 separate integrations. MCP turns that math into N+M: build one MCP server per tool, one MCP client per app, and every combination works.
2. No portability. A plugin built for one chat app did not run in another. A tool wired into one coding assistant had to be rebuilt from scratch for the next one. Each vendor's tool ecosystem was a walled garden, and switching AI providers meant rewriting your entire integration layer.
3. Agentic AI needed more than chat. Coding agents, research agents, and customer-support assistants needed safe, structured, repeatable access to real systems — databases, ticketing systems, version control — not screen-scraping, brittle prompt tricks, or copy-pasted API responses stuffed into a context window.

Anthropic released MCP as an open specification with reference servers, Python and TypeScript SDKs, and an MIT license, explicitly modeling it on the Language Server Protocol that Microsoft shipped for code editors in 2016 — a protocol that let any editor talk to any programming-language tooling through one shared interface instead of custom plugins for every combination (Anthropic, "Introducing the Model Context Protocol," November 25, 2024). Within months, Zed, Replit, Codeium, and Sourcegraph adopted it as client hosts. Then the adoption curve steepened: OpenAI announced full MCP support across its Agents SDK, Responses API, and ChatGPT desktop app in March 2025, and Google DeepMind confirmed MCP support for Gemini models the following month (Wikipedia, "Model Context Protocol," accessed 2026). By early December 2025, the ecosystem had grown to more than 10,000 active public MCP servers and over 97 million combined monthly downloads of the Python and TypeScript SDKs.

By December 2025, roughly 14 months after launch, MCP had more than 10,000 active public servers and over 97 million monthly SDK downloads, and Anthropic had transferred stewardship of the spec to the Linux Foundation's Agentic AI Foundation, making it a community-governed standard rather than a single company's product.

MCP Architecture: Client, Server, and Host

MCP is a client–server protocol that speaks JSON-RPC 2.0, a lightweight remote-procedure-call format where every request and response is a small JSON object with a method name and parameters. That choice matters: JSON-RPC is old, boring, and battle-tested — it's the same format used by the Language Server Protocol MCP was modeled on — so building an MCP server does not require adopting any new networking stack.

The protocol runs over two transports. Local servers communicate over stdio, meaning the host application launches the server as a child process and exchanges JSON-RPC messages over its standard input and output streams — no network port, no firewall rules, nothing exposed to the outside world. Remote servers use Streamable HTTP, a transport introduced in the March 2025 spec revision that replaced the original HTTP-plus-Server-Sent-Events design with a single, proxy-friendly connection capable of bidirectional streaming, which simplifies cases like long-running tool calls or live chat updates (MCP release notes, Speakeasy).

Three roles make up every MCP interaction:

• MCP server — a small program that exposes capabilities (tools, resources, prompts). Example: a GitHub MCP server exposes create_issue, list_pull_requests, and similar functions as callable operations.
• MCP client — a component embedded inside an LLM application (Claude Desktop, Cursor, Claude Code, ChatGPT desktop) that launches and talks to one or more servers, translating the model's intent into JSON-RPC calls.
• Host — the LLM application itself, which decides when to invoke which tool based on user intent and manages the permissions the user has granted.

A useful mental model: the host is the car, the client is the engine that actually drives requests to a destination, and servers are the gas stations scattered along the route, each one offering a specific resource the car can stop and use without the driver needing to know how the pump works internally.

The Three Primitives

Primitive	What it is	Direction	Example
Tools	Executable functions the LLM can invoke	Model → Server	run_sql(query)
Resources	Read-only data the LLM can load	Server → Model	A file, a record, a log
Prompts	Reusable templated instructions	Server → User	A "/review-pr" template

Table: The three MCP primitives and how data flows between the model and a server.

Tools are the most-used primitive by a wide margin, because they let the model take action rather than just read. Resources let the host application present users with something to pick from, like a file browser showing "which document do you want to attach?" instead of forcing the model to guess. Prompts let server authors ship their own best-practice instructions alongside their tools, so a Git server can bundle a well-tested "/review-pr" template instead of leaving every user to write their own review prompt from scratch.

The June 2025 spec revision added a fourth capability that matters for safety: tools can now declare annotations describing their own behavior, such as whether a call is read-only, idempotent, or destructive. A client can use that metadata to ask for extra confirmation before running delete_database while letting list_files run silently — the protocol carries the risk signal instead of leaving it to guesswork.

How discovery actually works

When a host application starts, its MCP client sends an initialize request to each configured server. The server responds with its capabilities: which tools it exposes, their names, their expected parameters, and human-readable descriptions of what each one does. This exchange happens at runtime, every time the connection opens, which is why MCP is described as dynamic discovery rather than the hardcoded tool lists that characterized earlier function-calling systems. The model never needs to be retrained or reconfigured to use a new tool; the server simply advertises it, and the host presents it to the model as an available option in the next turn.

Examples of MCP Servers

Anthropic's original reference servers, published alongside the November 2024 announcement, cover the most common developer needs:

• Filesystem MCP — read and write local files, scoped to an allowlist of directories the user has approved
• GitHub MCP — issues, pull requests, repositories, commits, and code search
• Slack MCP — channels, messages, users, and workspace search
• Postgres MCP — query a database using read-only credentials, preventing accidental writes
• Puppeteer MCP — drive a headless browser to click, scroll, and extract page content
• Memory MCP — a persistent knowledge graph the agent can write to and query across sessions

Beyond that reference set, the community-built ecosystem now spans thousands of servers for products like Linear, Notion, Stripe, Sentry, Cloudflare, AWS, Figma, and Google Workspace, most of them cataloged in public registries that function like package managers for AI tools rather than software libraries. By December 2025, more than 10,000 such public servers were active, according to ecosystem tracking cited in Zuplo's "One Year of MCP" retrospective.

Who's Adopting MCP

Product	MCP support	Notes
Claude Desktop	Full (host)	First-class, launched alongside the spec
Claude Code	Full (host)	Plus its own built-in tools and skills
ChatGPT desktop / Agents SDK	Full (host, added March 2025)	OpenAI adopted the spec rather than competing with it
Gemini	Full (host, added April 2025)	Confirmed by Google DeepMind
Cursor	Full (host)	Configure servers in settings
Sourcegraph Cody	Full	Code intelligence use cases
Replit Agent	Full
Zed editor	Full	Early adopter alongside Anthropic's launch
Microsoft Copilot / Visual Studio Code	Full	Added through 2025
Windsurf	Full

Table: Major AI products with MCP client (host) support, current as of the July 2026 update.

The speed of that adoption list is the real story. A specification that only Anthropic's own products supported would just be another proprietary tool format with better branding. What made MCP different is that its two biggest potential competitors — OpenAI and Google — both chose to implement the same open spec rather than build a rival one, which is the clearest signal an interoperability standard has actually won.

MCP vs Function Calling vs Custom Integration

Aspect	Custom integration	Vendor function calling	MCP
Portability across LLMs	None	Vendor-locked	Open standard
Discovery	Hardcoded	Hardcoded	Dynamic at runtime
Auth model	Ad hoc	Per-vendor	Standardized OAuth 2.1 handshake
Tools / Resources / Prompts	Tools only	Tools only	All three
Local & remote	DIY	Cloud-only typically	Both (stdio + Streamable HTTP)
Ecosystem	None	Per-vendor walled garden	Shared, 10,000+ public servers

Table: How MCP compares to the two approaches it was designed to replace.

It helps to be precise about what "function calling" actually is, because MCP does not replace it — MCP sits on top of it. Function calling is the model-level ability an LLM has to output a structured request like {"name": "get_weather", "arguments": {"city": "Boston"}} instead of plain text. Every major model already does this natively. What function calling does not solve is where that list of available functions comes from, how it's kept up to date across dozens of tools, and how the same list can be reused across different AI applications. MCP is the plumbing that supplies, updates, and standardizes that list. A useful analogy: function calling is a car's ability to steer and brake, while MCP is the standardized road network and traffic signals that let any properly built car drive anywhere without a custom map for every neighborhood.

How is MCP different from OpenAI's function calling?

Function calling is a model capability, built into how a specific vendor's model formats its output. MCP is an external protocol layered on top of function calling that standardizes how any tool server is discovered, authenticated, and invoked, so the same server works across Claude, GPT, Gemini, or any other model without being rewritten for each one.

Building Your Own MCP Server (Python)

A minimal server takes about ten lines using Anthropic's official SDK:

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("weather")

@mcp.tool()
def get_weather(city: str) -> str:
    """Return current weather for a city."""
    return f"It's 72°F and sunny in {city}."

if __name__ == "__main__":
    mcp.run()

Add this server to Claude Desktop's claude_desktop_config.json with its command and working directory, restart the app, and the model can now call get_weather whenever a user asks about weather. The FastMCP decorator handles the JSON-RPC boilerplate, the docstring becomes the tool description the model reads, and the type hint (city: str) becomes the parameter schema — all of which is exactly what the client requests during the initialize handshake described earlier.

The same weather logic, exposed remotely instead of locally, would use Streamable HTTP and add an authentication layer, because a server anyone on the internet can reach needs stronger guarantees than one running as a local child process on the user's own machine.

How does authentication work for remote MCP servers?

The June 2025 spec revision made OAuth 2.1 the required foundation for remote server authorization. MCP servers act only as OAuth 2.1 resource servers, meaning they validate access tokens but never issue them themselves; a separate, dedicated authorization server handles login and token issuance. The spec mandates PKCE (Proof Key for Code Exchange) for every client to prevent authorization-code interception, uses RFC 9728 for clients to discover which authorization server protects a given resource, and applies RFC 8707 resource indicators so a token minted for one MCP server cannot be replayed against a different one (Descope, "Diving Into the MCP Authorization Specification"). In practice, this means a remote MCP server should never ask a user to paste in a long-lived API key directly; it should redirect through a proper OAuth login flow the way modern web apps already do.

Why MCP Matters for the AI Ecosystem

Standardization unlocks composability. The same logic that made the web work — anyone can build a server, any browser can render it — is what MCP brings to AI tools. A small team can ship one MCP server for their product and have it work in Claude, ChatGPT, Gemini, and every future MCP-compatible client without maintaining separate integrations for each.

For builders of AI agents, which combine planning, memory, and tool use to complete multi-step tasks, MCP eliminates the most repetitive part of the job: wiring up access to external systems one API at a time. Instead of hand-coding a Slack integration for one agent framework and a different Slack integration for another, a developer points both at the same MCP server. That efficiency gain compounds directly into what these systems can do day to day — see our breakdown of what AI agents can and cannot do for where tool access like this still runs into real limits around planning and judgment, not just plumbing.

MCP also changes how AI systems handle memory and retrieval. A Postgres MCP server or a vector-database MCP server gives a model live, queryable access to information instead of relying purely on what fits in its context window or what was baked in during training. That's a meaningfully different approach from retrieval-augmented generation pipelines built directly into an application; MCP externalizes the retrieval logic into a swappable, reusable server. Our guide to AI memory systems covers how context windows, RAG, and persistent memory fit together, and MCP is increasingly the transport layer connecting a model to all three.

For end users, the practical payoff is portability of preference. The AI application you like using does not have to be the same one that has the best integration with your calendar, your CRM, or your codebase, because MCP decouples "which model I prefer" from "which tools I can access."

What People Get Wrong About MCP

The most common misconception is that MCP is itself a model or an AI capability. It is neither. MCP does not reason, plan, or decide anything — it is purely a transport and discovery layer. The intelligence about when to call a tool and how to use the result still comes entirely from the LLM. A weak model connected to a hundred MCP servers will still make weak decisions about which server to call and how to interpret what it returns.

A second misconception is that MCP makes tool use automatically safe. It does not. Because tool descriptions are text that the model reads and can be persuaded by, MCP introduced a documented new attack surface: tool poisoning, where an attacker embeds hidden instructions inside a tool's description or metadata that are invisible to the human user configuring the server but fully visible to the model deciding whether to call it. Security researcher Simon Willison flagged this class of prompt-injection risk within months of MCP's release, and a 2026 academic threat-modeling analysis found that in a comparison of seven major MCP clients, most had insufficient static validation of tool metadata and inconsistent handling of parameter visibility, leaving room for malicious tool descriptions to manipulate model behavior undetected (Willison, "Model Context Protocol has prompt injection security problems," April 2025; arXiv 2603.22489, "Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning"). Separately, Invariant Labs documented live tool-poisoning attacks against real MCP deployments, where malicious instructions embedded in a tool's description caused an agent to exfiltrate data to an attacker-controlled destination without the user ever seeing the instruction that caused it. The practical takeaway is the same one security teams apply to any new integration surface: install MCP servers only from sources you trust, review what permissions a server requests before approving it, and prefer read-only or narrowly scoped credentials over broad ones whenever a task allows it.

A third misconception is that MCP is an Anthropic-only or Claude-only technology, which was arguably true for the first four months after launch but stopped being accurate once OpenAI and Google DeepMind adopted it in the first half of 2025. Treating MCP as a Claude feature today is roughly like treating HTTP as a Netscape feature — it started somewhere, but its value now comes precisely from not belonging to any one company.

A fourth misconception worth flagging: people sometimes assume more MCP servers connected to an agent automatically makes it more capable. In practice, giving a model access to dozens of overlapping or poorly described tools can degrade performance, because the model has to choose among more options with less clarity about which one actually fits the task — the same reason a toolbox with fifty vaguely labeled drawers is harder to use than one with ten clearly labeled ones.

Frequently Asked Questions

Q: Who created MCP? A: Anthropic announced MCP on November 25, 2024, as an open standard with an MIT-licensed spec, reference servers, and Python and TypeScript SDKs.

Q: Is MCP only for Claude? A: No. MCP is vendor-neutral. OpenAI added full support across its Agents SDK, Responses API, and ChatGPT desktop app in March 2025, and Google DeepMind added Gemini support in April 2025, alongside earlier adopters like Cursor, Sourcegraph, Replit, Zed, and Windsurf.

Q: What's the difference between MCP and OpenAI function calling? A: Function calling is a model-level feature that lets an LLM output a structured request instead of plain text; every major model has its own version of it. MCP is an external protocol layered on top that standardizes how any tool server is discovered, authenticated, and invoked across any model, so the same server works everywhere instead of being rebuilt per vendor.

Q: Does MCP run locally or over the network? A: Both. Local servers run over stdio, where the host launches the server as a child process on the same machine. Remote servers run over Streamable HTTP, the transport introduced in the March 2025 spec revision to replace the original HTTP-plus-SSE design. The JSON-RPC message format is identical either way.

Q: Is MCP secure? A: The spec defines a capability and consent model plus, since June 2025, an OAuth 2.1-based authorization framework for remote servers. But security still depends heavily on the host application and the servers a user chooses to install. Researchers have documented real tool-poisoning attacks where malicious instructions hidden in a tool's description manipulated an agent's behavior, so users should install servers only from trusted sources and grant the minimum permissions a task requires.

Q: Can I write an MCP server in any programming language? A: Yes. JSON-RPC 2.0 is language-agnostic. Anthropic ships official SDKs for Python and TypeScript, and community SDKs exist for Go, Rust, Java, and C#.

Q: Who governs MCP now? A: In December 2025, Anthropic transferred stewardship of the Model Context Protocol to the Agentic AI Foundation, a new body under the Linux Foundation, making it a community-governed open standard rather than a single company's product.

Q: How big is the MCP ecosystem in 2026? A: By December 2025, there were more than 10,000 active public MCP servers and over 97 million combined monthly downloads of the Python and TypeScript SDKs, according to ecosystem tracking reported by Zuplo's one-year retrospective on the protocol.

Q: What is tool poisoning in MCP? A: Tool poisoning is an attack where malicious instructions are hidden inside an MCP tool's description or metadata, invisible to the human approving the server but fully readable by the AI model deciding whether to call it. Researchers, including Invariant Labs, have documented real cases where this technique caused agents to leak data without the user seeing the instruction responsible.

Q: Does using more MCP servers make an AI agent better? A: Not automatically. Connecting an agent to many overlapping or poorly documented tools can reduce performance, because the model must choose among more options with less clarity about which fits the task. Fewer, well-described tools generally outperform a large, cluttered toolset.

The takeaway

MCP did not invent the idea of AI models calling external tools; function calling already did that inside individual vendors. What MCP did was give every vendor, every developer, and every tool builder the same wire format to speak, which is why a specification barely two years old is already running through Claude, ChatGPT, Gemini, and thousands of independent servers instead of staying a Claude-only feature. Its success is a reminder that in software, the boring, shared, well-governed standard usually beats the flashier proprietary one — but that same openness is exactly what created its newest problem, tool poisoning, which means the protocol's next chapter is as much about trust and verification as it is about connectivity.

---

Read next:

• AI Agents Explained — How Autonomous AI Systems Actually Work
• What AI Agents Can And Cannot Do
• AI Memory Systems Explained: Context, RAG, and Long-Term Memory