MCP (Model Context Protocol) explained simply

MCP, short for Model Context Protocol, is an open standard that lets an AI plug into your tools and data the same way everywhere, much as a USB-C port connects any compatible device. Understanding its three roles and three building blocks helps you choose the right connectors and weigh the risks before you hand control to an agent.

The problem MCP solves

On its own, a language model only knows what it learned in training and what you type. To become a useful AI agent, it has to read your calendar, search your documents, query a database or open a ticket. Each of those actions goes through a different API.

Before MCP, every AI application had to write its own integration for every service. With ten applications and a hundred services, that means a thousand connectors to maintain, often of uneven quality. The Model Context Protocol replaces that headache with a single interface: a service publishes an MCP server once, and every compatible application can use it.

The three roles: host, client, server

The specification describes an architecture with three participants that exchange messages in the JSON-RPC 2.0 format.

• The host is the AI application you use: a desktop assistant, a code editor, an in-house agent. It opens the connections and stays in control.
• The client is a connector inside the host. The host creates one client per server, which keeps each connection isolated.
• The server is the program that exposes capabilities: access to files, an inbox, an error-tracking tool or a database.

The designers drew on the Language Server Protocol, which standardised how code editors talk to the analysis tools for each programming language. MCP applies the same idea to AI applications.

Local or remote: two transports

A server can run on your machine or on the internet. The architecture documentation defines two transports:

• stdio for local servers, launched by the host on your computer, for example a server that gives access to a folder;
• Streamable HTTP for remote servers, using HTTP POST requests and, optionally, an event stream. OAuth authentication is recommended.

The documentation uses the example of Sentry’s remote server, an error-tracking tool, and a local file-system server.

The three building blocks a server can offer

An MCP server exposes its capabilities in three forms, which the host discovers through list requests and then uses on demand.

Building block	What it is	Who triggers it	Example
Resources	Data and context to read	The application	A database schema
Prompts	Ready-made messages and workflows	The user	A query template with examples
Tools	Functions the model can run	The model	Run an SQL query, create an event

The documentation illustrates this with a database server that might offer tools to query the data, a resource holding the schema and a prompt with a few example queries. Tools are the block agents use most: they are the standardised extension of the tool calling that models can already do.

On the client side, the current version of the specification highlights elicitation: the server can ask the host to put a question to the user, for instance to confirm a choice or supply missing information.

Check yourself An MCP server offers a create_invoice function that the AI can call on its own. Which building block is it?

A tool. Tools are executable functions that the model decides to call during the conversation. A resource only provides data to read, and a prompt is a message template that the user chooses to use.

An MCP exchange, step by step

Take an assistant connected to an error-tracking server, and your request: “Which errors showed up on my app overnight?” Here is a simplified view of what happens:

1. Discovery: when it connects, the host asks the server which capabilities it offers.
2. Inventory: the client requests the list of available tools, with their names, descriptions and expected parameters.
3. Choice: the model reads those descriptions and decides to call the tool that lists recent errors.
4. Approval: the host may ask you to authorise the call before running it.
5. Execution: the client sends the tool call to the server, which queries the service and returns the result.
6. Answer: the model weaves that result into its natural-language reply.

If the server adds or removes a tool along the way, it can signal this with a notification, and the host updates its list without restarting.

What changed with the 2026-07-28 specification

MCP is versioned by date. On the official page checked on 22 October 2026, the current version is the 2026-07-28 specification. Several changes matter directly to developers:

• the base protocol works with self-contained, stateless requests, each negotiating its own capabilities;
• a discovery request lets the host find out what the server can do;
• the client features for sampling and logging are marked as deprecated;
• optional extensions appear: Tasks for long-running operations, Skills over MCP, and MCP Apps for showing an interactive interface inside the conversation.

If you rely on an older server, check that it remains compatible with the version your application supports.

What MCP makes possible in practice

The official documentation gives telling examples: an assistant that reaches your Google Calendar and Notion to act as a personal assistant, Claude Code generating a web app from a Figma design, enterprise chatbots querying several databases, or an AI creating 3D designs in Blender.

MCP is also making its way into browsers: Opera Neon’s free tier includes an MCP connector, as we note in our guide to AI browser agents. And in a multi-agent system, MCP equips each agent with its tools, while the A2A protocol handles the conversation between agents.

Frameworks that support MCP

To build an agent that consumes MCP servers, you do not have to start from scratch. In our framework database, the vast majority support MCP. Anthropic’s Claude Agent SDK, the OpenAI Agents SDK, LangGraph, Google ADK and Mastra all offer it, and the open-source agent goose is extended entirely through MCP extensions. A few tools are exceptions: Aider does not support it, and some publishers do not state their position.

Tool	Type	License	MCP	Multi-agent	Level
Claude Agent SDK	Code	proprietary	Yes	Yes	Intermediate
OpenAI Agents SDK	Code	MIT	Yes	Yes	Intermediate
LangGraph	Code	MIT	Yes	Yes	Advanced
Google Agent Development Kit (ADK)	Code	Apache-2.0	Yes	Yes	Intermediate
Mastra	Code	Apache-2.0	Yes	Yes	Intermediate
goose	Low-code	Apache-2.0	Yes	Yes	Beginner

Our framework comparison tool lets you filter directly on MCP support.

Security: the part you must not overlook

Connecting an MCP server means giving your AI a pair of hands. The specification is blunt about it: tools represent arbitrary code execution and must be treated with caution.

In practice, three risks stand out:

1. A malicious or compromised server: a server installed from a dubious source can steal data or run commands.
2. Prompt injection: a document or email read through MCP can contain hidden instructions that the agent may follow.
3. Overly broad permissions: a server with access to your whole disk or your whole inbox multiplies the possible damage if something goes wrong.

Good habits: only install servers from official or well-known sources, give each one the minimum access it needs, keep manual confirmation for sensitive actions and review the list of connected servers from time to time.