What is MCP?

What is MCP?

As agents gained the ability to use tools, a problem emerged: every application that wanted to connect an AI model to external tools and data had to build its own one-off integration. A tool built for one AI app couldn't be reused by another. MCP (Model Context Protocol) is Anthropic's answer: an open protocol, introduced in November 2024, for connecting AI applications to the tools, data, and systems they need to be useful.

Hosts, Clients, and Servers

MCP defines three roles:

Host: the AI application the user interacts with — a chat app, an IDE, a desktop assistant. The host embeds one or more MCP clients.

Client: lives inside the host and maintains a connection to a single MCP server, handling the protocol-level back-and-forth.

Server: a lightweight program that exposes a specific capability — a database, a filesystem, a SaaS product, a set of APIs — using the same protocol regardless of what it wraps.

A host can connect to many servers at once, giving a single AI application access to dozens of systems through one consistent interface.

What Servers Expose

An MCP server can expose three kinds of capability:

Tools: functions the model can call to take action — send a message, run a query, create a file. This is the same "function calling" concept from earlier in this module, standardised behind a common protocol.

Resources: data the host can read and feed into context — a file's contents, a database record, a page of documentation. Resources are more like a GET request than a function call: data in, not actions taken.

Prompts: reusable, parameterised prompt templates the server defines, so a host doesn't need to know the best way to phrase a request to that particular system — the server tells it.

Together, these let a server package up everything an AI application needs to work well with a given system, instead of every host reinventing that integration.

Adoption and the Linux Foundation

MCP spread quickly after Anthropic introduced it. OpenAI, Google, and Microsoft all added MCP support to their own agent platforms and SDKs within about a year — turning what started as an Anthropic-specific protocol into something closer to a shared standard, the way HTTP or SQL aren't owned by any single company.

In December 2025, Anthropic donated MCP to the newly formed Agentic AI Foundation under the Linux Foundation, moving governance of the spec to a neutral, vendor-independent body. That's a common path for successful open protocols: one company proves the idea works, then hands control to an independent foundation so competitors can invest in it without depending on a single vendor's roadmap.

Security: What Can Go Wrong

Connecting an AI model to arbitrary external servers introduces real risk, because an MCP server runs with whatever permissions you grant it.

Only install servers you trust. An MCP server is code running on your machine (or with access to your accounts) — treat adding one with the same caution as installing a browser extension or an npm package.

Tool poisoning: a malicious or compromised server can describe its tools misleadingly, or change its tool descriptions after you've approved them, tricking the model into taking actions you didn't intend.

Prompt injection via resources: if a server's resources (a file, a web page, a ticket) contain hidden instructions, the model may read and follow them as if they came from the user — the same risk covered earlier in this module, but now arriving through a trusted-looking data source.

Treat every MCP server as part of your security surface, not just a convenience plug-in.