Model Context Protocol (MCP): How it works and why it matters

Model Context Protocol (MCP) in brief

The Model Context Protocol (MCP) is an open standard for connecting AI applications to external tools and data, including files, databases, business software and APIs. Anthropic introduced MCP in November 2024. It now sits within the Agentic AI Foundation under the Linux Foundation, with support from OpenAI, Google, Microsoft and AWS.

• A tool exposed through an MCP server works across AI applications that support MCP, removing the need for individual integrations.
• The current specification, dated 2026-07-28, made the protocol stateless, simplifying server scaling.
• MCP standardizes connections. You still decide which servers to trust.

What is the Model Context Protocol?

MCP provides a standard way for AI applications to discover and use external tools and data. The official documentation describes it as a USB-C port for AI applications: wrap a tool in an MCP server once, and any application that speaks the protocol can use it.

David Soria Parra and Justin Spahr-Summers created MCP at Anthropic, which released it as open source on 25 November 2024. In December 2025, Anthropic donated MCP to the Agentic AI Foundation. It co-founded the foundation with Block and OpenAI, supported by Google, Microsoft, AWS, Cloudflare and Bloomberg.

The name can be confusing. Hopsworks’ MLOps glossary uses “model context protocol” for a concept that records a model’s context, including references to training data, hyperparameters and environment, to make results reproducible. Anthropic’s MCP serves a different purpose: it connects systems and does not store datasets or training settings.

Key benefits of the Model Context Protocol

Putting one protocol between many AI applications and tools brings several benefits.

• Standardisation: ten applications and twenty tools require thirty MCP implementations, one for each, rather than two hundred custom integrations.
• Interoperability: Claude, ChatGPT, Microsoft Copilot Studio, the Gemini API, VS Code and Cursor support MCP. An integration can therefore be reused when switching applications or models.
• Composability: a task can draw on several servers, such as reading a Jira ticket, checking GitHub code and posting a summary in Slack.
• Current context: models can use live source-system data instead of relying solely on training data, a core aspect of context engineering.

MCP architecture: how it works

MCP follows a client-host-server architecture, allowing one AI application to connect to multiple servers. The specification defines three roles.

Tools are functions a model can call. Resources are data an application can read, while prompts are templates users can select. Messages use JSON-RPC 2.0, carried over stdio for local servers or Streamable HTTP for remote ones. Remote servers requiring authorization use OAuth 2.1.

The 2026-07-28 revision made MCP stateless. It removed the initialization handshake and protocol-level sessions; each request now includes its own protocol version and capabilities. Any server instance behind a load balancer can consequently handle any request.

The host uses one client per server. Each server wraps an existing system and exposes it as tools, resources and prompts.

Comparing data integration approaches

MCP usually wraps existing APIs rather than replacing them. The distinction is who builds the integration and how often it needs building.

An MCP workflow: scheduling a meeting

An AI assistant scheduling a meeting through a calendar MCP server follows this sequence:

1. The client requests the calendar server’s tools, receiving functions such as find_free_slots and create_event.
2. You request a one-hour meeting with three colleagues next week. The model calls find_free_slots.
3. The server queries the calendar API and returns available slots.
4. The model suggests a time. The host asks you to confirm before running create_event.

The server creates the invitation, and the assistant reports the outcome.

This pattern applies across MCP servers: the model selects a tool, the host controls its execution, and the server communicates with the underlying system.

Is MCP secure?

MCP can support secure integrations, but using the protocol does not make an integration safe by itself. The specification sets out security principles, including explicit user consent before hosts invoke tools. It also states that “MCP itself cannot enforce these security principles at the protocol level”.

Two incidents illustrate the risks. In May 2025, researchers found that a malicious GitHub issue could hijack an agent using the GitHub MCP server and leak private repository data. In September 2025, Postmark warned that a fake postmark-mcp package had secretly sent copies of emails to an outside server.

Reduce exposure by connecting only trusted servers, limiting each server’s permissions, requiring approval for tools that change data and logging every tool call. Our article on AI guardrails explores broader safeguards for AI applications.

MCP’s role in AI evolution

In under two years, MCP has moved from an Anthropic project to shared infrastructure. Token cost remains its main practical drawback.

• Adoption: OpenAI built its Apps SDK for ChatGPT on MCP. Microsoft supports it in Copilot Studio and VS Code. Google Cloud lists more than 50 Google-managed MCP servers, either generally available or in preview, while AWS’s own MCP server became generally available in May 2026. In July 2026, MCP maintainers reported “close to half-a-billion downloads a month” across the official Tier 1 SDKs.
• Token cost: each connected server adds tool descriptions to the model’s context, consuming tokens. Anthropic demonstrated that asking a model to write code to call MCP tools reduced one example workflow from 150,000 to 2,000 tokens.

Practical applications

MCP connects AI applications with existing systems in several settings.

• Software development: assistants including Claude Code, GitHub Copilot and Cursor use MCP servers to read issues, query databases and find documentation. They often combine these with skills explaining how to use the tools.
• Business assistants: ChatGPT apps, Copilot Studio agents and Claude connectors access CRM, email, calendars and documents through MCP.
• Internal systems: organizations build MCP servers for their ERP or CRM, making one integration available to every MCP-compatible AI application they use. GDPR applies whenever these systems contain personal data, just as with any integration.

Conclusion

The Model Context Protocol has become a shared standard for linking AI applications to tools and data. It cannot decide which servers you should trust. Give every MCP integration an owner, minimal permissions and logging, as you would any other integration.

Wondering which systems to connect to AI first and how to connect them safely? Our AI consultancy helps you choose and build the right integrations.

Frequently asked questions (FAQ)

What does MCP stand for in AI?

MCP means Model Context Protocol. Introduced by Anthropic in November 2024, this open standard defines how AI applications including Claude, ChatGPT and Microsoft Copilot Studio connect to external tools and data through MCP servers.

Who developed the Model Context Protocol?

David Soria Parra and Justin Spahr-Summers created MCP at Anthropic. It was released as open source on 25 November 2024 and has belonged to the Agentic AI Foundation under the Linux Foundation since December 2025.

What is an MCP server?

An MCP server exposes a tool or data source to AI applications through tools, resources and prompts, usually built on an existing API. It can run locally or remotely over HTTP.

What is the difference between MCP and an API?

MCP builds on APIs. An MCP server typically wraps an existing API and describes its functions in a standard format, allowing any MCP-compatible AI application to use it without a custom integration.

How does MCP relate to A2A and ACP?

MCP connects agents to tools and data. The Agent2Agent protocol (A2A) supports collaboration between agents in multi-agent systems. IBM’s Agent Communication Protocol (ACP) merged into A2A in August 2025. ACP may also mean Stripe and OpenAI’s Agentic Commerce Protocol or Zed’s Agent Client Protocol.

Originally published by Jorick van Weelie at DataNorth.