Learn how the Model Context Protocol connects LLMs to external tools and data, with architecture, transports, security and server setup.
The Model Context Protocol (MCP) is an open standard that lets AI applications such as Claude, ChatGPT and GitHub Copilot connect to external tools and data through one shared protocol, instead of a custom integration for every system. The Linux Foundation’s September 2026 newsletter reported that MCP tool calls from ChatGPT users had reached 98 times their January level by August. For security reviewers and IT admins asked to approve an MCP connection, the protocol’s mechanics determine what that approval grants.
What is the Model Context Protocol (MCP)
MCP is an open-source protocol for connecting AI applications to the content repositories, business tools and development environments where data lives. David Soria Parra and Justin Spahr-Summers created it at Anthropic, and Anthropic open-sourced it on November 25, 2024, with a specification, SDKs, local server support in Claude Desktop and pre-built servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer.
The official MCP introduction compares it to a USB-C port: one connector shape that any compliant application and any compliant server can plug into. The integration problem it addresses is the one Anthropic named at launch: every new data source required its own custom implementation.
Anthropic no longer controls MCP alone. On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. The maintainers still make technical decisions through Specification Enhancement Proposals (SEPs).
As of the October 1, 2026 maintainer file, the lead maintainers are David Soria Parra and Den Delimarsky, and the core maintainers include engineers from AWS, Microsoft and OpenAI. The current specification revision is 2026-07-28, released on July 28, 2026.
The problem MCP solves
MCP replaces a grid of one-off connectors with one protocol on each side. Before MCP, each AI application wrote its own integration for each external system, and LeadDev described the result: every new tool required a separate integration, and when an API changed, developers updated that integration by hand. Forrester wrote that enterprise builders are exhausted by hard-coding every tool and data source, which produces fragile systems.
The arithmetic shows the scale. As an illustration only, a company with 5 AI applications and 20 internal systems needs up to 100 bespoke connectors (5 times 20). With MCP, each system ships one server and each application ships one client, so the count drops to 25 implementations (5 plus 20). The authors of an arXiv paper on MCP server architecture put it in practical terms: a single MCP server works with Claude, GPT-4, Gemini or any other compliant client without modification.
MCP standardizes the connection, not the meaning of the tools. The authors of an arXiv technical report on web agent interfaces found that each shop in their MCP setup defined its own function names, parameter names and result formats. The authors of a separate empirical study found that most official MCP servers are thin wrappers over REST APIs that typically expose around one-fifth of the documented operations; teams still need to check what a given server exposes before they rely on it.
How MCP works
MCP has two layers: a data layer of JSON-RPC 2.0 messages, and a transport layer that carries those messages between processes or over HTTP.
Hosts, clients and servers
MCP uses a client-host-server architecture, and each piece has a fixed job in the 2026-07-28 specification:
- Host: The host is the AI application the user works in, such as Claude Desktop or VS Code. It creates and manages client instances, enforces security policies and consent requirements, handles user authorization decisions, coordinates the language model and controls every cross-server interaction.
- Client: The host creates one client per server, and each client communicates with exactly one server. The client attaches the protocol version and its capabilities to every request and keeps security boundaries between servers.
- Server: A server exposes tools, resources and prompts. It can run as a local process or a remote service, and it operates independently with a focused job.
The 1:1 client-to-server rule is what keeps servers isolated from each other. A host connected to GitHub, Postgres and Slack runs three clients, and only the host sees across all three. Local servers on the stdio transport typically serve a single client, while remote Streamable HTTP servers typically serve many.
The 2026-07-28 revision changed how the two sides agree on features. Earlier revisions opened every session with an initialize handshake that negotiated the protocol version and capabilities once. The current revision removes that handshake and the Mcp-Session-Id header.
Every request now carries its protocol version, client identity and client capabilities in _meta, and servers must implement a server/discover method that returns their supported versions and capabilities. Clients may call server/discover first, or negotiate inline: a server that does not support the requested version returns an UnsupportedProtocolVersionError listing the versions it does support. The MCP roadmap post states that removing protocol-level sessions lets a server scale horizontally without holding state.
JSON-RPC messages and transports
Every MCP exchange is a JSON-RPC 2.0 request and response. A client starts by asking a server which tools it offers. This tools/list request comes from the 2026-07-28 schema reference:
The server answers with an array of tool definitions. Each definition has a name, an optional human-facing title, a description the model reads to decide when to call the tool, and an inputSchema in JSON Schema. This definition comes from the specification’s Tools page (revision 2025-06-18):
When the model picks a tool, the client sends tools/call with the tool name and arguments. The specification’s example targets a tool named get_weather:
The server returns a result with a content array. In 2026-07-28, servers must also include resultType, which clients treat as "complete" when an older server omits it. This response comes from the current schema reference:
A tool can also declare an outputSchema and return machine-readable data in structuredContent, which in 2026-07-28 can be any JSON value. Errors split two ways. A failure inside the tool goes in the result with isError set to true, so the model can see it and adjust. A failure to find the tool, or another exceptional condition, goes back as a JSON-RPC protocol error.
Over HTTP, the current revision also requires the MCP-Protocol-Version, Mcp-Method and Mcp-Name headers on each POST, and the version header must match the _meta value or the server rejects the request.
The specification defines two transports and keeps a third as deprecated:
Transport | How it carries messages | When to use it |
|---|---|---|
stdio | The client launches the server as a subprocess; newline-delimited JSON-RPC flows over stdin and stdout, and logs go to stderr | Local servers on the user’s machine, typically one client per server |
Streamable HTTP | Each message is an HTTP POST to a single MCP endpoint; replies come back as a JSON object or a request-scoped SSE stream | Remote servers that serve many clients and need OAuth |
HTTP+SSE (2024-11-05) | The original remote transport, deprecated since protocol version 2025-03-26 | No new builds; the 2026-07-28 revision gives existing users a year-long offramp to Streamable HTTP |
The December 2025 MCP transport post states the rule plainly: stdio for local deployments, Streamable HTTP for remote ones. A stdio server must never write anything to stdout that is not a valid MCP message.
Tools, resources, prompts and sampling
MCP servers offer three primitives, and each one has a different party in control. Client-side features let a server ask the host for something back. The table below uses examples from the official MCP documentation:
Primitive | Who controls it | Methods | Example |
|---|---|---|---|
Tools | The model decides when to call them | tools/list, tools/call | A travel server’s searchFlights and createCalendarEvent |
Resources | The host application decides what context to attach | resources/list, resources/read | A database server exposing the database schema |
Prompts | The user picks them, often as slash commands | prompts/list, prompts/get | A “Plan a vacation” template taking destination, duration, budget and interests |
Sampling (deprecated in 2026-07-28) | The server asks the client’s model for a completion | sampling/createMessage | A travel server sending a flight list to the model and asking it to pick the best flight |
Elicitation | The server asks the user for input | elicitation/create | A form request: “Please provide your GitHub username” |
Roots (deprecated in 2026-07-28) | The host tells the server which folders to work in | roots/list | file:///home/user/projects/myproject, named “My Project” |
Sampling, roots and logging were deprecated under SEP-2577. They still work and stay in the specification for at least twelve months, but new implementations should not adopt them. The Go SDK maintainers advise developers whose servers need completions to call a model provider’s API directly. In 2026-07-28, servers send elicitation and other server-to-client requests through the Multi Round-Trip Requests pattern: the server returns an InputRequiredResult, and the client retries the original request with the answers attached.
Key features and capabilities
MCP gives each party in an AI integration something concrete. The protocol-level features behind these benefits include runtime discovery through /list methods, list_changed notifications when a server’s tools change, and typed output through outputSchema.
The 2026-07-28 revision adds full JSON Schema 2020-12 for tool schemas, a stateless core that scales behind a load balancer, and a formal deprecation policy with a minimum twelve-month window.
- For developers: One server built on an official SDK works across every compliant client. The 80% of participants in an arXiv enterprise adoption study who compared approaches said MCP architectures are slightly more complex than function calling alone but need less long-term development effort and are easier to maintain.
- For AI applications and the agents they run: Clients discover tools at runtime instead of loading hardcoded definitions at startup. The
2026-07-28client best practices page also describes progressive discovery and programmatic tool calling for hosts that connect to hundreds or thousands of tools, since loading every definition up front wastes tokens and degrades model performance. - For end users: People add a connector from the app they already use, such as the Plugins menu in ChatGPT or Settings in Claude Desktop, without writing code. The specification requires hosts to obtain explicit consent before invoking any tool, and the MCP Apps extension lets servers return interactive UI inside clients such as ChatGPT, VS Code and Microsoft 365 Copilot.
How MCP fits in: APIs, function calling and RAG
MCP does not replace REST APIs, function calling or retrieval-augmented generation (RAG). It standardizes the layer between them. The comparison below draws on the MCP specification, a systematization-of-knowledge preprint on MCP security, and arXiv studies of function calling and RAG:
Dimension | MCP | Direct REST API | Native function calling | RAG |
|---|---|---|---|---|
What it does | Connects an AI host to tools, data and prompts through one protocol | Exposes an application’s operations to any HTTP client | Lets a model emit a structured call to a function the developer defined | Retrieves documents and adds them to the model’s context |
Discovery | Runtime, through tools/list, resources/list and prompts/list | Static schema, read by a developer | Static; the developer supplies schemas with each request | None for actions; retrieval runs against a prepared index |
Standardization | One protocol across vendors, governed under the Linux Foundation | Per API | Developers maintain provider-specific code for OpenAI, Anthropic and Google because their similar JSON schemas differ | Per pipeline |
State | Stateless protocol core as of 2026-07-28; servers return explicit handles for ongoing work | Stateless request and response | Not specified in provider documentation | Each query treated independently |
Best fit | Many AI apps reaching many systems, including write actions | Deterministic integrations written by developers | One application, one model provider, a few functions | Answering from a fixed document set |
The categories overlap in practice: most official MCP servers wrap a REST API, so MCP sits on top of the API rather than replacing it, and the authors of an arXiv paper on MCP servers describe them as function-call extensions similar to OpenAI’s function-calling API, with greater community extensibility. RAG and MCP also combine: the RAG-MCP approach uses retrieval to pick the most relevant MCP server for a query, which cuts the prompt bloat of loading every tool. The TURA preprint’s authors identify the limit of RAG on its own: a static index cannot act on transactional APIs, and MCP tools can call live APIs and take actions, so they are one way to cover that limit.
MCP security and authentication
MCP authorization is optional, but any HTTP-based implementation should follow the specification’s OAuth model, and stdio servers should take credentials from the environment instead. The 2026-07-28 authorization specification sets these requirements for remote servers:
- OAuth 2.1 with PKCE: Authorization servers must implement OAuth 2.1, and clients must use PKCE with the S256 challenge method and confirm PKCE support from authorization server metadata before starting the flow.
- Protected resource metadata: MCP servers must implement RFC 9728. An unauthenticated request gets a 401 response whose
WWW-Authenticateheader points to the metadata document, which lists at least one authorization server. - Resource indicators and audience: Clients must send the RFC 8707
resourceparameter in authorization and token requests, set to the server’s canonical URI. Servers must reject tokens not issued for them as the audience. - No token passthrough: A server must not forward the client’s token to downstream APIs. If it calls an upstream service, it obtains a separate token from that service’s authorization server.
- Client registration: Clients should use pre-registered credentials first, then Client ID Metadata Documents. The
2026-07-28revision deprecates Dynamic Client Registration, which remains only for backwards compatibility. - Transport and tokens: Authorization endpoints must use HTTPS, redirect URIs must be
localhostor HTTPS, access tokens should be short-lived, and refresh tokens for public clients must rotate.
OAuth protects the connection, but researchers have documented attacks that pass through a properly authenticated server:
Tool poisoning (Invariant Labs, April 1, 2025): Hidden instructions in a tool description, invisible to users but read by the model, can exfiltrate data and override instructions from trusted servers. The mitigation is to treat tool descriptions as untrusted unless the server is trusted, as the specification does.
Rug pulls and shadowing: A server changes a tool description after the user approved it, or one server’s description redefines how a trusted server’s tool behaves.
Line jumping (Trail of Bits, April 21, 2025): A prompt-injection payload in a tool description or server instructions manipulates the model before any tool is called, bypassing human-in-the-loop checks.
Toxic flows: Invariant’s GitHub disclosure showed an attack through fully trusted tools: an agent connected to GitHub was exposed to untrusted information while it held access to private repositories.
Sampling abuse (Palo Alto Networks Unit 42, December 5, 2025): Malicious servers can use sampling to drain compute quotas, hijack conversations and trigger hidden tool calls. The mitigation is not to adopt sampling: it is deprecated in 2026-07-28, and new implementations should not use it.
Real vulnerabilities have followed. CVE-2025-49596 in Anthropic’s MCP Inspector (CVSS 9.4, reported by Oligo Security) allowed remote code execution and was fixed in version 0.14.1.
CVE-2025-6514 in mcp-remote (CVSS 9.6, found by JFrog) allowed command execution when connecting to an untrusted remote server and was fixed in 0.1.16.
Check Point’s “MCPoison” finding, CVE-2025-54136, let a swapped MCP configuration run code in Cursor after approval and was patched in Cursor 1.3.
Koi Security found postmark-mcp, which Dark Reading called the first publicly documented malicious MCP server: one line of code BCC’d every email to the attacker, and the npm package drew 1,643 downloads before its removal.
Gartner’s April 9, 2026 press release summarized the design trade-off: “MCP was built for interoperability, ease of use and flexibility first, so security mistakes can manifest without continuous oversight for agentic AI.”
The defenses that hold up are permissions and boundaries enforced outside the model. The specification treats tool descriptions and annotations as untrusted unless the server is trusted, and the MCP blog warns that a server claiming readOnlyHint: true can still delete files, so preventing exfiltration requires network controls or sandboxing.
Hosts should show which tools are exposed and require confirmation before calls. MCP-Scan pins tool descriptions by hash to catch rug pulls.
OpenAI’s Responses API defaults require_approval to "always", and VS Code gives admins allowlist and denylist policies for MCP servers. GitHub warns that Copilot cloud agent calls configured MCP tools without asking for approval, and recommends allowlisting specific read-only tools.
Viktor, the AI employee who lives in Slack and Microsoft Teams and connects to 9,800+ tools, applies the same principles to his own connections. A gateway adds API keys and tokens at run time, so the model never reads them. Sensitive actions wait for an approval card with Approve and Reject buttons, a rejected action never runs, and admins can set any tool to “needs approval” or “forbidden”. Security reviewers can check certification status and data handling in Viktor’s security details.
Who supports MCP
Anthropic, OpenAI, Microsoft, GitHub and Google each ship MCP support in at least one product, though primitive and transport coverage varies. The table lists clients and servers named in vendor documentation:
Product | MCP role | What the documentation states |
|---|---|---|
Viktor (viktor.com) | Client and server | Connects any tool with an MCP server as a custom integration; exposes an MCP server at api.viktor.com/mcp with scoped API keys |
Claude Desktop, Claude web, Claude Code | Client | Local servers over stdio in Claude Desktop and Claude Code; custom remote connectors on Free, Pro, Max, Team and Enterprise plans, with Free limited to one; Claude Code supports tools, resources and prompts |
ChatGPT | Client | Custom MCP servers added from Plugins; Apps SDK built on MCP; Responses API remote MCP tool |
GitHub Copilot | Client | VS Code, Visual Studio, JetBrains IDEs, Eclipse and Xcode; Copilot cloud agent and code review support tools only |
Microsoft Copilot Studio and Microsoft 365 Copilot | Client | Copilot Studio supports Streamable HTTP only and dropped SSE after August 2025; Microsoft 365 Copilot connects to MCP servers through plugins, generally available since December 15, 2025 |
Cursor | Client | Tools, prompts, resources, roots, elicitation and MCP Apps; stdio, SSE and Streamable HTTP; OAuth with PKCE |
Windsurf, Zed, Gemini CLI, JetBrains AI Assistant | Client | Windsurf and Gemini CLI support tools, resources and prompts; Zed supports tools and prompts; JetBrains AI Assistant 2026.2 supports stdio and Streamable HTTP |
-
ChatGPT uses MCP in four places. Business and Enterprise/Edu customers get full MCP on ChatGPT web, including write actions, while Pro users can connect custom servers with read and fetch permissions. ChatGPT reaches only remote servers, and private servers connect through Secure MCP Tunnel.
The Apps SDK is built on MCP, the Responses API has supported remote MCP servers since May 20, 2025, and OpenAI’s Agents SDK supports hosted, Streamable HTTP and stdio servers. -
Copilot is an MCP client on several surfaces. MCP support in VS Code has reached general availability, and for Copilot Business and Enterprise users an admin must turn on the “MCP servers in Copilot” policy, which is disabled by default. Copilot cloud agent does not yet support remote servers that use OAuth when configured in repository settings.
Windows also documents an on-device registry for MCP servers, listed as public preview in November 2025.
The best-known pre-built servers have moved. The original GitHub, Slack and PostgreSQL reference servers sit in the modelcontextprotocol/servers-archived repository, archived on May 29, 2025, which states that no security updates or bug fixes will be provided.
GitHub maintains its own server at github/github-mcp-server, and its installation guide says the old @modelcontextprotocol/server-github npm package is no longer supported as of April 2025. Slack made its own MCP server generally available on February 17, 2026, while the archived Slack reference server is listed as “Now maintained by Zencoder”.
No official MCP page names a successor for the PostgreSQL server; vendor options include the Azure MCP Server for Azure Database for PostgreSQL and the Neon MCP server. The active reference servers are Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking and Time, and the official MCP Registry, still in preview, lists published servers.
Getting started: SDKs and your first MCP server
Building a first server takes an official SDK, the official tutorial and the MCP Inspector. The MCP project lists ten official SDKs:
Language | Tier | Maintained in collaboration with |
|---|---|---|
TypeScript | 1 | None named |
Python | 1 | None named |
C# | 1 | Microsoft |
Go | 1 | |
Rust | 1 | None named |
Ruby | 1 | None named |
Java | 2 | Spring AI |
Swift | 3 | Apple |
PHP | 3 | The PHP Foundation (with the Symfony project) |
Kotlin | 3 | JetBrains |
TypeScript and Python shipped their v2 lines with the current specification: the TypeScript packages @modelcontextprotocol/server and @modelcontextprotocol/client on 2026-07-27, and Python 2.0.0 on 2026-07-28, so pip install mcp now installs 2.x. Not every SDK has caught up; the Swift SDK README still targets the 2025-11-25 revision.
A first build follows these steps:
- Pick the SDK for the language the team already deploys, and check that it supports the
2026-07-28revision. - Work through the official “Build an MCP server” tutorial, which builds a weather server with tools in Python, TypeScript, Java, Kotlin, C#, Ruby, Rust or Go.
- Test with the MCP Inspector (
@modelcontextprotocol/inspector, version 2.13.0 as of late October 2026), which connects to stdio or Streamable HTTP servers, invokes tools, prompts and resources, and shows the notification stream. The tutorial notes that the Inspector defaults to thelegacyera. - Connect the server to a real client, such as Claude Desktop, using the official “Connect to local MCP servers” guide.
- Publish the server to the MCP Registry with the registry quickstart, which needs Node.js, an npm account and a GitHub account.
Viktor works on both sides of this setup: any tool with an API or an MCP server can be connected to him as a custom integration, and he can usually build a missing connection himself. His MCP server at api.viktor.com/mcp, listed in the table above, lets clients such as Claude Code or Cursor hand him a whole job instead of a single function call: he plans it, does the work on his own cloud computer and returns the finished deliverable, which is the practical difference between a tool and what an AI employee is. Scoped keys, the public API and the OpenAI-compatible API are documented in the Viktor developer docs.
Connect one MCP-backed tool and hand him the first recurring job. Try Viktor free with up to $100 in credits, no credit card →
FAQ
MCP provides a shared connection protocol; each host and server still determines which operations users can access and approve.
What is the difference between MCP and an API?
An API exposes one application’s operations, while MCP is a shared protocol that lets any compliant AI host discover and call those operations at runtime. Most official MCP servers wrap an existing REST API, adding tool descriptions, schemas, discovery and OAuth rules that every client understands.
Who invented MCP?
David Soria Parra and Justin Spahr-Summers created MCP at Anthropic, which open-sourced it on November 25, 2024. Anthropic donated MCP to the Linux Foundation’s Agentic AI Foundation on December 9, 2025, and the project’s maintainers, including engineers from AWS, Microsoft and OpenAI, now steer the specification.
Does ChatGPT use MCP?
Yes, ChatGPT connects to remote MCP servers added from Plugins, with full read and write MCP for Business and Enterprise/Edu workspaces and read/fetch access for Pro. OpenAI’s Apps SDK is built on MCP, and the Responses API and Agents SDK both connect to MCP servers.
Is Microsoft Copilot an MCP client?
Yes, GitHub Copilot is an MCP client in VS Code, Visual Studio, JetBrains IDEs, Eclipse, Xcode and the cloud agent, and Copilot Studio and Microsoft 365 Copilot connect to MCP servers too. Copilot cloud agent supports tools only, and Copilot Studio supports Streamable HTTP only.
What are the main security risks of MCP?
The documented risks, each with one mitigation, are tool poisoning, met with explicit consent before tool calls; rug pulls, with pinned tool descriptions; line jumping, with sandboxing; prompt injection through tool output, with read-only tool allowlists; token passthrough, with OAuth 2.1 and audience-bound tokens; and malicious packages such as postmark-mcp, with sandboxing.
Is MCP better than RAG?
No, the two solve different problems: RAG retrieves documents from a prepared index, and MCP connects a model to live tools that can also take actions. Many systems use both, for example retrieving the most relevant MCP server for a query before calling its tools.
How do I build an MCP server?
Pick one of the ten official SDKs, follow the official “Build an MCP server” tutorial, and test with the MCP Inspector before connecting a client such as Claude Desktop. Use stdio for a local server and Streamable HTTP for a remote one.
Hand Viktor the recurring job your team rebuilds by hand every week, from the Monday ad spend recap to the Friday pipeline update. Start free with up to $100 in credits, no credit card →
Ask ChatGPT
Ask Claude