What Is MCP? Model Context Protocol Explained

MCP is useful when your AI app needs to work with your tools and data; you do not need it just to use AI. The answer to “what is MCP?” starts with 3 parts: the app you use, its connection component, and a server that exposes selected capabilities. Those parts make integrations reusable, while your existing software interfaces (APIs) and permissions still do the underlying work.

What Is MCP in AI?

The Model Context Protocol (MCP) is an open standard for connecting AI applications to tools and data. It gives compatible applications a shared way to discover available capabilities, request information and invoke actions. The official MCP introduction describes connections to external systems such as files, databases and tools.

For a founder, the benefit is practical: an assistant can work with information in your business systems instead of relying on what you paste into the chat. For a builder, the benefit is reuse: expose a capability through an MCP server, then connect compatible AI applications to that interface.

Imagine asking an assistant to prepare a customer account briefing. An integration could fetch the account record and recent support issues, then return them for a summary. MCP supplies the common connection format. Someone still has to implement those operations, authorize access and check that the result is useful.

MCP is infrastructure. It does not replace the AI model, the application holding your records or the person responsible for granting access.

Who Maintains MCP Now?

MCP is maintained by its open-source project maintainers under the stewardship of the Agentic AI Foundation (AAIF), part of the Linux Foundation. Anthropic created the protocol and announced its donation to the foundation on 9 December 2025. The foundation supplies a neutral institutional home; the project retains control of its technical direction. Read the project's announcement.

Verified on 13 October 2026, the MCP governance page lists David Soria Parra and Den Delimarsky as Lead Maintainers. Lead Maintainers, Core Maintainers and Maintainers form the MCP Steering Group. Membership belongs to individuals rather than reserved company seats.

That matters to a buyer evaluating dependence on a vendor: using MCP does not commit you to Anthropic's AI applications. It also does not mean the foundation maintains or endorses every third-party server using the standard. Protocol governance and the trustworthiness of a particular integration are separate questions.

How MCP Works: Host, Client and Server

The host is the application you use; a client inside it talks to a server that exposes capabilities. These are software roles, not a requirement to buy separate machines. The official architecture describes a host creating a client for each server it connects to.

The Host: Your AI Application

The host coordinates the experience: your conversation, the model and the available connections. Think of it as the office in which you are working. Its settings and policies help determine what tools are available and when an approval is requested.

What Is an MCP Client?

An MCP client is the connection component inside that host. It speaks the protocol with a particular server. You generally configure this through the app rather than installing a separate “client” product.

The distinction prevents a common diagram mistake: the client belongs inside the host. The language model is not itself the network connection.

What Is an MCP Server?

An MCP server is a program that exposes selected capabilities through MCP. “Server” describes its role, so it can be a process on your laptop or a service running elsewhere.

In the account-briefing example, it might offer a narrowly scoped customer lookup. The server implements the lookup and returns results; the host brings those results into the AI's work. It need not expose your whole customer database.

What a Server Exposes: Tools, Resources and Prompts

Servers can expose 3 kinds of capability. They need not implement every kind, and the host must support the features you intend to use. The server concepts documentation distinguishes them this way:

A tool can read information as well as change it. A search operation is still a tool even when it writes nothing. A resource is a piece of accessible context, and a prompt is a reusable way to start a task.

For a builder, the key distinction is between discovering an operation and executing it: tools/list exposes available tool definitions, while tools/call invokes one. Good descriptions and constrained inputs help the host choose the intended operation. They do not replace access checks in your application.

MCP vs an API

MCP does not replace APIs. An MCP server often wraps them. An application programming interface, or API, is the interface through which software requests another system's data or actions. MCP gives compatible AI applications a common way to discover and use capabilities built on top of those interfaces.

MCP vs API: Follow the Request

Consider a customer lookup. With a direct integration, your AI application needs a tool definition and code that calls the customer system's API. With MCP, the server can provide that definition and execute the API call. Anthropic's MCP lesson describes this wrapping pattern.

The request still ends at the customer system. Its authorization rules, usage limits and business logic still matter. You have standardized the AI-facing integration, not removed the underlying dependency.

An MCP server can also work with local files or a database directly, so an API wrapper is a common implementation rather than a requirement.

When to Use MCP vs API

Use MCP when reusable access from compatible AI applications is the goal. Use a direct API when the workflow is already fixed and the extra interface buys little.

A scheduled job that copies approved invoice records into accounting software may be clearer as ordinary application code. The inputs, destination and sequence are already known. A conversational assistant that needs to choose among account lookup, document search and task creation has a stronger case for discoverable tools.

For a product builder, ask who will consume the integration. If customers want your service inside their existing AI apps, an MCP server can be a useful distribution interface. If only your own backend consumes the operation, a direct function or API may be enough.

MCP vs RAG

Retrieval-augmented generation (RAG) supplies retrieved information to a model; MCP supplies a connection protocol. The original RAG paper describes generation informed by retrieved material.

You can expose document retrieval as an MCP tool. The search system still has to find useful passages, respect document permissions and return enough context. Adding MCP does not automatically improve retrieval quality.

What Is MCP in Agentic AI?

MCP can give an agent access to tools; it does not decide the agent's plan. An agent is software that uses a model to choose actions toward a task. MCP's architecture explicitly leaves model use and context management to the application.

For an account briefing, the agent might decide to retrieve the account before searching its support issues. The protocol carries the requests. The application remains responsible for the workflow, controls and handling of failures.

Local vs Remote MCP Servers

Local and remote describe where the server runs. They do not tell you where all your data stays. MCP's standard transports include stdio, communication between processes on the same machine, and Streamable HTTP, communication over HTTP that is commonly used for remote servers. MCP transport overview.

A local server usually starts from a command on the machine running the client. This fits a builder working with local files, but brings responsibility for the installed program and its execution permissions.

A remote server is reached at a network address. It can make a shared service easier to operate for a business, but introduces hosting, authentication and availability dependencies. HTTP can also be used locally, so “HTTP” does not by itself mean public internet.

A locally running server may call an external API, and its output may enter a cloud AI conversation. Conversely, a remotely hosted server can enforce narrow permissions. Evaluate the full path from source data to server to AI app.

What Is an MCP Connector?

“Connector” is often the product-facing name for an integration. It is not an extra architectural role alongside host, client and server. For example, Claude calls its remote MCP integrations custom connectors, while ChatGPT's current documentation packages MCP access through plugins. Follow the specific app's supported connection route.

Which Apps Support MCP Today?

Claude, ChatGPT, Cursor, Visual Studio Code and Codex all document MCP support. The following checks were made against each maker's pages on 13 October 2026. They verify documented capability, not a hands-on compatibility test of every server or a promise that every account has the same access.

Claude

Claude, Anthropic's AI assistant, supports remote MCP custom connectors and local servers through Claude Desktop extensions. Its remote connector documentation lists Free, Pro, Max, Team and Enterprise support, with 1 custom connector on Free and organization controls on business plans.

The consequential limit is network reachability: remote connector requests originate from Anthropic's cloud, including when you use the desktop app. A server reachable only from your laptop is not automatically reachable by that connector. The separate local desktop extension route starts in Settings > Extensions.

ChatGPT

ChatGPT, OpenAI's AI application, supports MCP-backed tools through plugins. OpenAI's current quickstart connects a custom server from ChatGPT Plugins, installs the resulting plugin and invokes it in ChatGPT Work on the web. A custom visual interface is optional.

Use that documented product route for setup. A local command copied from another app's configuration is not equivalent to adding a hosted server URL, and protocol support alone does not establish your workspace's permissions.

Cursor

Cursor, the AI code editor, supports local stdio servers and remote connections through Streamable HTTP or Server-Sent Events (SSE). Its MCP documentation also lists tools, resources and prompts, with configuration available in .cursor/mcp.json for a project or ~/.cursor/mcp.json globally.

Cursor asks for approval before MCP tool use by default. Keep the enabled set relevant to the project: making a capability discoverable is useful only when its descriptions, permissions and outputs fit the task.

VS Code

Microsoft Visual Studio Code (VS Code), the code editor, supports MCP tools in its AI agent experience, along with resources, prompts and interactive apps. Microsoft's setup documentation provides MCP: Add Server and recommends portable configuration destinations for new servers.

Review a repository's MCP configuration before trusting the workspace. Microsoft's current documentation says workspace MCP servers inherit Workspace Trust and can start without a separate server-trust prompt. That is a meaningful installation boundary for local executable code.

Codex

Codex, OpenAI's coding agent, supports local STDIO and Streamable HTTP servers in its command-line interface and code editor extension. The maker's MCP documentation describes shared configuration in ~/.codex/config.toml, with bearer-token and OAuth authentication for HTTP servers. OAuth lets you grant access through an authorization flow rather than hand an integration your account password.

Codex also documents tool allow and deny lists. Use those controls to expose the operations a workflow needs; a successful connection is only the beginning of deciding what it should be allowed to do.

What MCP Costs and Where It Pays Back

There is no single MCP monthly subscription price. Budget for the AI app or model, the server's hosting or managed-service fee, the upstream software, and maintenance. An open protocol does not make those dependencies free.

For one concrete billing boundary, OpenAI says its Responses API charges for tokens used when importing MCP definitions or making calls, with no additional fee per MCP tool call. That statement applies to that API; it does not waive a server provider's charges. OpenAI MCP billing explanation.

The Integration Math, With Its Assumptions

Suppose 3 AI apps must each connect to 4 business systems. Writing a separate adapter for every pairing creates 3 × 4 = 12 interfaces. Under an idealized shared-standard design, 3 host implementations + 4 server implementations = 7 interfaces.

That is 5 fewer interface implementations, not a measured saving in engineering hours. The example assumes every pairing is needed and the required features interoperate. Authentication, permissions, testing and service-specific logic remain. If the AI apps already support MCP, the host side may already be built; your work concentrates on the servers and deployment.

For one app calling one service, a direct integration may be simpler. Reuse is what makes the additional layer attractive.

MCP Security: Check the Server Before You Connect

An MCP connection gives another program a place in your AI workflow. Treat its publisher, permissions and returned content as separate trust decisions. The standard alone cannot certify them.

Prompt injection is an instruction hidden in content the model is supposed to treat as data. For example, a retrieved support issue could contain text telling the assistant to ignore its task and send an account export elsewhere. The danger appears when the assistant treats that tool output as authority and uses another available capability to act on it.

OpenAI's MCP security guidance explicitly warns about hidden instructions in malicious server content, sensitive data exposure and changing server behavior. Even a trusted server can retrieve an untrusted document. The document's instructions should not acquire the authority of the user who asked for a summary.

Before installing or authorizing a server, check:

• Publisher and destination. Follow the service maker's own documentation to the package or server address. Confirm who operates any third-party intermediary and what data it retains.
• Local execution. Read the command, arguments and requested filesystem access. Installing a local server can execute code with the permissions of its process; “local” is not a sandbox guarantee.
• Account scope. Start with a restricted account and the smallest useful data scope. A prompt saying “only use this customer's records” is weaker than a backend permission that enforces that boundary.
• Available actions. Prefer read-only operations for the pilot. Require review before consequential writes or exports, and inspect the actual destination and arguments.
• Updates and revocation. Identify the owner, review changes, and confirm how to disable the server and revoke its credentials. A working uninstall button is not evidence that an upstream token has been revoked.

For builders, enforce authorization in the server and underlying system. MCP's security best practices reject token passthrough: accepting a token meant for another service and forwarding it unchanged is not a sound authorization design.

For operators, start with a harmless document collection and verify the returned evidence before connecting sensitive systems. Read-only reduces the ability to modify the source system; it does not prevent sensitive material from being retrieved or shared elsewhere. Keep unrelated powerful tools out of the same pilot.

What Is Overhyped About MCP?

A shared protocol reduces integration variation. It does not make every integration reliable, safe or interchangeable. “Supports MCP” leaves several questions unanswered: which transport, which features, whose credentials, what execution environment and what approvals?

Likewise, installing more servers is not an adoption strategy. A poorly described tool can be selected incorrectly. A broad credential can expose too much. An unavailable upstream service can still stop the workflow.

The useful claim is narrower: compatible hosts and servers can reuse an interface. You still need a defined task, a responsible owner and a way to recognize a bad result. Measure completed, checked work rather than the size of the tool catalog.

Who Should Act, Wait or Leave Things Alone?

Founders should act when repeated copying or fragmented access blocks a valuable workflow. Pick that workflow before choosing infrastructure. If an existing approved integration already does the job, adding another layer has no automatic payoff.

Operators should pilot when the information source and permission boundary are clear. Wait on broad deployment when nobody owns credentials, revocation or review of consequential actions. These are operating decisions the protocol cannot make for you.

Builders should add MCP when multiple compatible hosts need the same capability, or customers explicitly want access from their AI apps. Leave a reliable fixed API automation alone unless you can name the reuse or product benefit.

For the next implementation decision, use the best MCP servers list to find an existing integration, the Python MCP server guide when you need to expose your own capability, or the MCP gateway guide when shared access controls become an operating requirement.

Your Monday Move

Pilot one bounded read operation in the AI app you already use. For example, retrieve an approved account profile and verify its contents against the source.

1. 1

   Define the task and boundary

   Write down the question, permitted data and expected result. Choose a read-only operation and a restricted identity. Assign an owner who can disable the connection.

2. 2

   Connect through the maker's documented route

   Confirm local command versus remote URL, authenticate, and inspect the available capabilities. Enable only what the task needs.

3. 3

   Check success, denial and failure

   Ask for permitted information, then information outside the account's scope. Confirm the latter is denied. Disconnect the server and check that the assistant reports missing access instead of presenting an unsupported answer.

4. 4

   Keep it only if the work improves

   Record time spent retrieving, checking and correcting the result. Revoke the pilot credential and verify access stops. Expand only when the benefit and control boundary are both clear.

Frequently Asked Questions

How is MCP configured?

Configure it in the AI host: supply a startup command for a supported local server or a URL for a remote server, complete authentication and enable the needed tools. File names and settings differ by app; use its current maker documentation.

What is MCP an acronym for?

In AI software, MCP stands for Model Context Protocol. It is the open standard for connecting AI applications to external tools and data described here.

What is an MCP for dummies?

Think of a shared service counter: an AI app can discover what another program offers, request something in an agreed format and receive the result. The permissions behind the counter still apply.

Why is MCP needed

It can reduce repeated integration work and let compatible AI apps reuse tools. It is optional: a direct API or an existing approved integration can be the better choice for a fixed workflow.

What is mcp used for

MCP is used to bring external context and permitted actions into AI applications, such as looking up records, retrieving documents or creating a task through an exposed tool.

For practical decisions about AI tools and business workflows, subscribe to the newsletter.