MCP, explained without the jargon.

The Model Context Protocol (MCP) is an open standard that lets AI applications connect to outside tools and data in one consistent way. Instead of every AI app building its own integration for GitHub, Slack or your database, a service ships one MCP server, and any app that speaks MCP can use it. The official docs compare it to a USB-C port for AI applications.

Anthropic released MCP in November 2024, and it now belongs to a neutral foundation under the Linux Foundation. Claude, ChatGPT, Cursor, VS Code and many other apps support it. As of September 2026, the current version of the spec is dated 2026-07-28.

01What is the Model Context Protocol?

The USB-C comparison is apt. Before a common port, every device needed its own cable. Before MCP, every AI app needed a custom integration for every tool, so ten apps and ten tools meant a hundred pieces of glue code. With a shared standard, each side builds once.

Under the hood, MCP messages use JSON-RPC 2.0, a simple format for requests and replies. The design borrows from the Language Server Protocol, which did the same job for programming languages in code editors. MCP is one of the main ways a chatbot becomes an AI agent that can act on real systems.

That look, decide, act pattern is the same loop at the heart of any AI agent. To see a tool call from the inside, build a small agent yourself in about 100 lines of Python.

MCP connects an agent to tools and data. A related standard, A2A, lets agents hand off work to each other instead, and our guide explains how the two differ.

02How MCP works: hosts, clients and servers

The spec names three roles:

• Host. The AI application you use, such as Claude Desktop, Cursor or VS Code.

• Client. The connector inside the host. It keeps one connection to one server.

• Server. The program that exposes a tool or data source, such as GitHub, a database or your file system.

Here is what happens when you ask an agent a question that needs an outside tool:

1. 01

   The app asks what the server offers

   When the app starts, the client asks the server for its list of tools. Each tool has a name, a plain-language description and the inputs it accepts.

2. 02

   The model picks a tool

   You ask, “Which bugs are assigned to me?” The model reads the tool descriptions and decides to call one, such as list_issues, with the right inputs.

3. 03

   You approve the call

   Most apps show you the call and ask for permission, at least the first time. The spec says hosts must get your consent before invoking any tool.

4. 04

   The server does the work

   The server calls the issue tracker’s API and sends the results back through the client.

5. 05

   The model answers

   The results land in the model’s context, and it replies in plain words, or picks another tool if the job is not done.

03The building blocks: tools, resources and prompts

An MCP server can offer three kinds of things.

Tools do most of the work in practice. The protocol also lets a server ask you for missing information mid-task, and optional extensions add more. MCP Apps, the first official extension, lets a tool show an interactive form, chart or dashboard right in the chat.

04Local vs remote MCP servers

Servers come in two shapes, and the difference matters for setup and for safety.

The trend is toward remote servers run by the service itself. You paste a URL, log in once, and nobody’s code runs on your machine.

05How to add an MCP server: a config you can copy

Here is the setup from the official MCP docs for Claude Desktop, one of the most popular hosts. It adds the reference Filesystem server so Claude can read and organize files in two folders.

1. 01

   Check that Node.js is installed

   Many servers run with Node.js. In a terminal, run node --version. If nothing prints, install the LTS version from nodejs.org.

2. 02

   Open the config file

   In Claude Desktop, open the Claude menu, choose Settings, then Developer, then Edit Config. On macOS the file is ~/Library/Application Support/Claude/claude_desktop_config.json. On Windows it is %APPDATA%\Claude\claude_desktop_config.json.

3. 03

   Paste the server settings

   Replace the contents with the JSON below. Change username to your own, and list only the folders you want Claude to reach.

4. 04

   Restart and check

   Quit Claude Desktop completely and open it again. The server appears in the connectors list, and Claude asks before each file action.

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/username/Desktop",
        "/Users/username/Downloads"
      ]
    }
  }
}

Adding a remote server is usually a single line. In Claude Code, for example, this connects Notion’s official server, and running /mcp inside a session walks you through the login:

claude mcp add --transport http notion https://mcp.notion.com/mcp

Once you have added someone else’s server, building your own is the natural next step. Our tutorial on building an MCP server walks through a working one in about 30 minutes with the TypeScript SDK.

06Who supports MCP in 2026, and who runs it?

Support is now widespread. The official site names Claude, ChatGPT, VS Code, Cursor and MCPJam. By December 2025, Anthropic said ChatGPT, Cursor, Gemini, Microsoft Copilot and VS Code had all adopted it.

MCP no longer belongs to Anthropic. In December 2025, Anthropic donated it to the Agentic AI Foundation, a fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. Day-to-day technical decisions stay with MCP’s maintainers, led as of September 2026 by David Soria Parra and Den Delimarsky. Seats belong to individuals, not companies, and changes go through public proposals.

1. November 2024Anthropic releases MCP as an open standard, with servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer
2. December 2025Anthropic donates MCP to the Agentic AI Foundation under the Linux Foundation
3. January 2026MCP Apps, the first official extension, lets tools show interactive UI inside the chat
4. July 2026Spec 2026-07-28 makes the protocol stateless, so remote servers are easier to scale

What does “stateless” mean? Earlier versions opened each connection with a handshake that the server had to remember. Now every request carries what the server needs, so any copy of a server behind an ordinary load balancer can answer it. Old and new versions can run side by side, and deprecated features keep working for at least twelve months.

07MCP security basics before you install a server

The spec is direct about the risk: tools “represent arbitrary code execution.” A local server runs with your permissions, and every tool description goes straight into the model’s context. Three ways this goes wrong are already documented.

• Tool poisoning. In April 2025, Invariant Labs hid instructions inside a tool’s description, invisible to the user but read by the model. In their demo, Cursor’s agent read SSH keys and sent them out.

• Rug pulls. A server can change its tool descriptions after you approved it, so yesterday’s review does not cover today’s version.

• Impostor packages. In September 2025, Snyk reported an npm package called postmark-mcp, not published by Postmark, that quietly copied every email it sent to an outside address.

There is also the quieter risk of prompt injection: any server that reads web pages, issues or emails can carry hidden instructions written by someone else.

A listing in the official MCP Registry proves who published a server, not that its code is safe: the registry verifies namespaces but leaves code scanning to others. For a starting list of official servers, see the MCP servers worth installing first.

08FAQ

Next, pick your first servers from our shortlist by job, or learn how agent skills teach an agent to use them well.