Model Context Protocol (MCP)

MCP (Model Context Protocol) is an open standard for connecting AI assistants to other software. The maker of an accounting package or a webshop platform builds one MCP server, a connector that opens its product to AI. Every AI application that supports MCP can then use it, for example to look up an invoice or create a task, without a separate integration for each assistant.

Where does it come from?

Anthropic released MCP on 25 November 2024 as an open standard, with a specification, SDKs and ready-made servers for Google Drive, Slack, GitHub and other systems. The problem it named: every new data source "requires its own custom implementation". The official documentation compares MCP to a USB-C port for AI applications.

In December 2025 Anthropic donated MCP to the Agentic AI Foundation, a fund under the Linux Foundation that it co-founded with Block and OpenAI. By then, according to Anthropic, ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code had adopted MCP, and more than 10,000 public MCP servers were active. On 10 February 2026 Chrome opened an early preview of WebMCP, a browser API proposed by engineers at Microsoft and Google with which a web page offers its own tools to AI agents, much like an MCP server inside the page.

How does it work?

The architecture overview names three roles:

• The host is the AI application, such as Claude Desktop or Visual Studio Code.
• The host creates one client per server, and each client keeps one connection.
• The server offers tools and data, on the same machine over standard input and output (stdio) or remotely over Streamable HTTP, with OAuth recommended for signing in.

Messages use JSON-RPC 2.0. Servers offer tools (functions the model can call, such as a database query), resources (read-only data such as files, selected by the application) and prompts (templates the user picks). The client fetches the tool list with tools/list and runs a tool with tools/call.

The model itself does not speak MCP. In the client tutorial the client passes the server's tools to the model as ordinary tool definitions and runs the model's tool calls through the server: an MCP tool reaches the model through function calling.

The revision of 28 July 2026, the current one in September 2026, dropped the opening handshake. Every request now carries its protocol version and capabilities, and a client can ask what a server supports with server/discover.

Where does it go wrong?

• Untrusted servers. Tools can run arbitrary code, and a tool description can hide instructions that the model reads and the user never sees. Invariant Labs called this tool poisoning in April 2025, a form of prompt injection. The specification says hosts must ask the user's consent before any tool runs and should distrust tool descriptions from untrusted servers. The protocol cannot enforce this; the application has to.
• A full context window. Most clients load every tool definition into the context window up front, and every intermediate result passes through the model. Anthropic wrote in November 2025 that agents with thousands of tools then process hundreds of thousands of tokens before they read a request. Its remedy is to let the model call the tools from code, as in programmatic tool calling.
• Data spread over servers. A question that spans two systems makes the agent fetch from both servers and combine the results in its context window. Dinobase, an open-source tool, puts such data behind one SQL query layer instead. In its own benchmark from April 2026 that approach came out ahead of per-source tools, which Dinobase had simulated itself (more on that benchmark).

Example

Suppose a webshop platform offers an MCP server with two tools, get_order_status and create_return. An employee adds the server in Claude Desktop. Asked "has order 1042 shipped?", the model calls get_order_status through the server and answers with the real status. Before create_return runs, the application asks the employee for permission, as the specification expects. The same server works unchanged in another MCP application, such as Cursor.