Model Context Protocol (MCP)
MCP
In short
The Model Context Protocol is an open standard that defines how an AI application discovers and calls external tools, resources and prompts. A server implements it once and any compatible client can use it, replacing per-product custom connectors.
MCP standardises the contract between an AI application and the outside world. A server advertises three kinds of capability:
- Tools — functions the model may call, with a name, description and argument schema.
- Resources — data the application can read into context, such as files or records.
- Prompts — reusable templates the user can invoke.
The client — a desktop assistant, an IDE, an agent framework — discovers what a server offers and presents it to the model. Because the interface is standard, a server written for one product works with the others.
Two points are worth keeping straight. First, MCP is plumbing, not permission. It describes how a tool is exposed; deciding who may invoke it, and whether an action needs human approval, stays with the host application. Treating a protocol as an authorisation model is a category error with real consequences.
Second, every MCP server is an expansion of the attack surface. A server that reads external content can carry prompt injection straight into the model's context. Install servers the way you would install software with the same access — deliberately, from sources you trust, with the narrowest scope that does the job.
Frequently asked questions
- What problem does MCP solve?
- Before it, every AI application needed its own connector for every system. MCP standardises the interface so one server implementation serves many clients.
- Is MCP a security boundary?
- No. It describes how tools are exposed, not who may use them. Authentication, authorisation and approval gates remain the host application's responsibility.