What is the Model Context Protocol?
The open standard that lets AI apps plug into tools and data through one connector — "a USB-C port for AI." Learn the what, the architecture, and how to use it safely, right here on the page.
01The problem MCP solves
Remember when every phone and gadget came with its own incompatible charger? Connecting AI to outside software used to be just as messy: every AI model needed its own hand-written "glue code" for every tool or data source it wanted to use. Engineers call this the N×M problem — N models times M tools — and ten of each meant up to a hundred one-off integrations to build and maintain. The Model Context Protocol (MCP) is the shared standard that fixes it. MCP — an open standard Anthropic introduced in late 2024, with major vendors including OpenAI and Google since announcing support — collapses that to N+M: each model and each tool implements the protocol once, and they all interoperate. That's why it's described as "a USB-C port for AI."
Without a standard, 3 models × 3 tools = 9 separate, non-reusable integrations.
- MCP is an open standard, not a product — any MCP-aware app can talk to any MCP server.
- Under the hood it speaks
JSON-RPC 2.0— a simple, standard way for one program to send a request to another and get a reply. - Goal: let AI move past frozen training knowledge to use live data and real actions.
02The architecture: host, client, server
MCP is a client–server model with three roles. Tap each to see what it does — notice the host is the consent gatekeeper, and each client keeps a 1:1 connection to a single server so permissions never bleed between tools.
MCP Host
Where the LLM lives and the user interacts — Claude Desktop, Cursor, VS Code, an agent framework. It manages every client, enforces security policy, and is the ultimate arbiter of user consent: it decides what the model may invoke and what data is shared.
03How a session actually runs
Every MCP connection follows a strict lifecycle so both sides agree on capabilities before any data moves. Step through a real handshake — from version negotiation to a tool call and back.
04What a server exposes: the three primitives
A server advertises its capabilities as primitives. The easy mental model: tools are verbs, resources are nouns, prompts are templates.
Tools — executable actions
Functions the model can invoke to do something in the outside world (subject to user approval). Each has a name, a natural-language description, and a JSON Schema for its inputs. Highest security risk — they can run code.
Resources — read-only context
Data sources the model can read to ground its reasoning — identified by a URI, serving text or binary. They give situational awareness without changing anything.
Prompts — reusable templates
Pre-built workflows with placeholders the host fills at runtime. They encode best practices so users don't hand-craft a complex prompt every time.
05The big picture
Here's the whole framework on one map — how the architecture, the primitives, the security practices, and the threats they defend against all fit together. Expand any branch to drill in.
06Wizard: is your MCP setup safe to ship?
Power comes with risk — research on public MCP servers found a large share carried command-injection flaws. Answer five questions about your setup and get an instant risk read with the specific controls to fix any gaps.