Model Context Protocol
How MCP standardizes tool and context access for AI models.
Last updated: July 2026
Model Context Protocol (MCP) is an open standard, introduced by Anthropic in November 2024, that gives AI models (like LLMs) one consistent way to connect to outside data sources, tools, and services. Think of it as a USB-C port for AI. Instead of building a custom cable (integration) for every device (data source), MCP gives you one standard connector that works everywhere.
“Before MCP, every AI application needed its own custom, one-off integrations to reach databases, APIs, or file systems. MCP sets a shared way for AI models to find and use outside context, so those integrations become reusable, secure, and easy to combine.”
| Component | What it does | Example |
|---|---|---|
Host | The AI application or agent environment that the user interacts with | Claude Desktop is a host. It spawns MCP clients to talk to your local filesystem or a GitHub server. |
MCP Client | Lives inside the host and keeps a 1:1 connection with one MCP server | A client inside VS Code Copilot that speaks to a Jira MCP server to pull ticket context. |
MCP Server | A lightweight program that offers capabilities (tools, resources, and prompts) to any connected client | A Postgres MCP server that exposes database tables as resources and SQL execution as a tool. |
Resources | Read-only data the model can reference (files, DB rows, API responses) | A Notion page, a CSV file, a Git commit |
Tools | Functions the model can call to take actions | create_issue() in GitHub, send_email() in Gmail |
Prompts | Ready-made, reusable prompt templates the server offers | A 'summarize this PR' template with pre-filled context |
Transport Layer | stdio for local servers; HTTP+SSE for remote servers | Local filesystem server uses stdio; SaaS CRM server uses HTTP+SSE |
Full assembled example
Role: Customer support assistant. Goal: Resolve the billing issue. Tools: issue_refund(account_id, amount). Context: Account tier: Pro, Renewal: 2026-05-20. Retrieved policy: Section 4.2 - refundable within 7 days of renewal. Output: JSON with decision, reason, action_taken, missing_info.
Core Principles
- 1Separation of concerns - Switching from MySQL to Postgres means updating one MCP server, not every AI tool that queries it.
- 2Least privilege / capability negotiation - A read-only analytics MCP server never exposes a delete_record() tool, so the AI cannot delete data even if asked.
- 3Stateful sessions - An AI agent can check out a Git branch, run tests, and commit a fix, all in one connected session without signing in again.
- 4Human-in-the-loop by design - A file-deletion tool asks the user first before it runs, even if the AI model confidently requests it.
- 5Model agnosticism - The same GitHub MCP server works with Claude Desktop today and with an open-source Llama agent tomorrow, with no changes needed.
Local MCP Servers (stdio)
The server runs as a subprocess on the same machine and talks over stdin/stdout
Prompt
A developer runs Claude Desktop locally with a filesystem MCP server that reads their ~/projects directory.
Output
Zero-latency local access to files and processes.
Remote MCP Servers (HTTP+SSE)
The server runs as a remote web service reachable over HTTP, with SSE for streaming
Prompt
A SaaS company exposes their CRM data via a hosted MCP server. Any enterprise customer can connect their AI assistant to live customer records.
Output
Any MCP-compatible AI client connects automatically.
Tool-Focused Servers
Servers built mainly around action tools, the functions the model calls to create, update, or delete data
Prompt
User: 'Create a GitHub issue titled Fix login bug and assign it to @alice' → Model calls: create_issue() → MCP server calls GitHub API → returns issue URL
Output
Workflow automation executed via structured tool calls.
Resource-Focused Servers
Servers built mainly around read-only resources the model can pull in as context
Prompt
User: 'Summarize the Q3 sales report' → Model reads resource: sales_reports/q3_2025.pdf via MCP resource URI
Output
Model summarizes without the file embedded in the prompt.
Composite / Orchestrated MCP
A host connects to several MCP servers at once, and the AI reasons across all of them
Prompt
An AI coding agent connects to: GitHub MCP (read PR), Jira MCP (get ticket), Slack MCP (notify team), Filesystem MCP (write code).
Output
End-to-end multi-system task completed autonomously.
Best Practices
- 1Scope your server's capabilities tightly - A customer support MCP server offers get_ticket() and update_ticket_status(), but NOT delete_ticket() or export_all_customers().
- 2Validate all tool inputs server-side - A send_email tool checks that the recipient is a valid email format and is on an allowlist before calling the SMTP server.
- 3Use descriptive names and docstrings for every tool and resource - Instead of run_query(), use execute_readonly_sql_query(sql: string), which runs a SELECT query against the analytics database and never changes data.
- 4Implement proper error handling and return structured errors - Return { 'error': 'rate_limit_exceeded', 'retry_after_seconds': 30 } so the model can tell the user to wait.
- 5Authenticate and authorize at the MCP server layer - A multi-tenant MCP server reads a session token from the headers and scopes every database query to that tenant's data.
- 6Log all tool invocations for auditability - A healthcare MCP server logs every get_patient_record() call to an immutable audit trail, meeting HIPAA requirements.
Common Mistakes
| Mistake | Real-world scenario | Fix |
|---|---|---|
| Overly broad tool permissions | A customer service bot's MCP server exposes admin_delete_all_records(), and the model calls it when confused | Expose only the tools that are actually needed; move admin tools into a privileged server with human approval gates |
| Trusting model-generated inputs blindly | The model generates sql = 'DROP TABLE users' and the MCP server runs it without checking | Always validate and sanitize inputs server-side; use parameterized queries; enforce read-only where it makes sense |
| Vague tool descriptions | A tool named do_thing() with the description 'does a thing', so the model calls it at random | Write precise descriptions covering what the tool does, what it doesn't do, and the expected input formats |
| No error feedback to the model | The server crashes and returns HTTP 500; the model has no idea what happened and makes up a result | Return structured JSON error objects the model can read and pass along to the user |
| Exposing secrets in resource URIs | A resource URI includes postgres://admin:password@db.internal/prod, which is visible in logs and model context | Use opaque resource identifiers; keep credentials only in server environment variables |
| No rate limiting on tools | An AI agent loops and calls search_web() 500 times in a minute, burning through API quota | Add per-session rate limits on expensive tool calls at the server layer |
Use Cases
| Use Case | Real-world example | Best approach |
|---|---|---|
| Software development | An AI coding assistant reads the codebase, fetches a Jira ticket, writes a fix, and opens a PR | Composite MCP: Filesystem + GitHub + Jira servers |
| Customer support | A support AI pulls a live CRM ticket, order history, and product docs to answer tricky questions | Resource-focused MCP server per data domain |
| Data analysis | An analyst asks the AI to query Snowflake, generate a chart, and email the results | Tool-focused MCP with SQL execution + email tool |
| DevOps / SRE | An on-call AI reads Datadog alerts (resource), runs diagnostic queries (tool), and pages PagerDuty (tool) | Composite MCP with monitoring + alerting servers |
| Healthcare | A clinical AI retrieves patient records, checks a drug interaction database, and drafts a care summary | Tightly scoped, HIPAA-audited resource MCP with approval gates on write tools |
| E-commerce | A shopping AI checks live inventory, applies discounts, and places an order on behalf of the user | Tool-focused MCP with inventory + order management tools |
Developer asks AI to create a GitHub issue
Prompt
Tool registered: create_github_issue(repo, title, labels, assignee)
User: 'Create a GitHub issue in acme/backend titled Fix null pointer exception in AuthService with label bug and assign it to @dev-alice.'
MCP tool call: { method: 'tools/call', params: { name: 'create_github_issue', arguments: { repo: 'acme/backend', title: 'Fix null pointer exception in AuthService', labels: ['bug'], assignee: 'dev-alice' } } }
Server response: { content: [{ type: 'text', text: 'Issue #342 created: https://github.com/acme/backend/issues/342' }] }Output
Done! I've created issue #342 - 'Fix null pointer exception in AuthService' - in acme/backend, labeled as a bug and assigned to @dev-alice.
AI reads a local file and answers a question
Prompt
User: 'What are the main API endpoints documented in my openapi.yaml file?'
MCP resource read: { method: 'resources/read', params: { uri: 'file:///home/user/projects/myapp/openapi.yaml' } }
Server returns the YAML file content
Model reads it and summarizesOutput
Your openapi.yaml documents three main endpoint groups: 1. /users - user account management (GET, POST, PUT, DELETE) 2. /orders - order creation and tracking (GET, POST) 3. /products - product catalog (GET, POST, PATCH)
MCP server capability handshake
Prompt
Client sends initialize request with protocolVersion: '2025-03-26'
Server responds with capabilities: { tools: {}, resources: { subscribe: false } }
Client lists available tools:
{ tools: [{ name: 'execute_sql', description: 'Execute a read-only SELECT query against the analytics database.', inputSchema: { type: 'object', properties: { sql: { type: 'string' } }, required: ['sql'] } }] }Output
The postgres MCP server exposes one tool: execute_sql - a read-only SQL query interface. The model can now query the analytics database safely.
Tools & Platforms
| Tool / Platform | Best for | Link |
|---|---|---|
| MCP Official SDK (Python) | Building Python MCP servers and clients | https://github.com/modelcontextprotocol/python-sdk |
| MCP Official SDK (TypeScript) | Building Node.js/TypeScript MCP servers | https://github.com/modelcontextprotocol/typescript-sdk |
| Claude Desktop | First-party MCP host; test and use local MCP servers | https://claude.ai/download |
| MCP Inspector | Debug and test MCP servers interactively | https://github.com/modelcontextprotocol/inspector |
| Smithery | Registry and marketplace of community MCP servers | https://smithery.ai/ |
| Cloudflare Workers | Host remote MCP servers at the edge with built-in auth | https://developers.cloudflare.com/cloudflare-for-ai/mcp/ |
Frequently asked questions
What is the Model Context Protocol (MCP)?
The Model Context Protocol (MCP) is an open standard introduced by Anthropic in November 2024. It provides AI models with a unified way to connect to external data sources, tools, and services, similar to a USB-C port for AI. This standardization replaces the need for custom integrations for every data source, making connections reusable, secure, and easy to manage.
How does the Model Context Protocol work?
The Model Context Protocol operates through a system of hosts, clients, and servers. The host is the AI application environment, while the MCP client maintains a connection to an MCP server, which offers tools and resources. This setup allows AI models to access data and perform tasks consistently across different platforms, enhancing efficiency and flexibility.
What are the core principles of MCP?
The core principles of MCP include separation of concerns, least privilege, stateful sessions, human-in-the-loop design, and model agnosticism. These principles ensure that MCP systems are secure, adaptable, and maintainable, allowing seamless integration and operation across various AI models and environments without compromising security or functionality.
What are the use cases for MCP?
MCP is used in various domains like software development, customer support, data analysis, DevOps, healthcare, and e-commerce. For instance, in software development, an AI assistant can interact with multiple MCP servers to manage codebases, tickets, and notifications, streamlining the development process and improving productivity.
What are common mistakes to avoid with MCP?
Common mistakes with MCP include granting overly broad tool permissions, blindly trusting model-generated inputs, and not providing error feedback to AI models. To avoid these, it is crucial to restrict tool permissions, validate inputs server-side, and ensure structured error handling, which enhances security and reliability.