AI assistants are good at writing and answering questions, but on their own they cannot see your calendar, your files or your company's database. Every app that wanted to give an assistant that kind of access used to need its own custom connection. The Model Context Protocol, or MCP, is an attempt to replace all those one-off connections with one shared standard.
MCP started at Anthropic, the company behind Claude, and is now used well beyond Claude. This guide explains what MCP is, how it works without the code, what it lets AI apps do, and what to watch for when you connect an AI app to your data.
The short version
- MCP is an open-source standard for connecting AI applications to outside systems: files, databases, tools and workflows.
- The official site compares it to "a USB-C port for AI applications": one standard plug instead of many different cables.
- It has three roles. The AI app is the host, each connection inside it is a client, and the program that offers data or tools is a server.
- Servers can offer three main things: tools (actions), resources (information) and prompts (ready-made templates).
- MCP was created at Anthropic and later donated to a foundation under the Linux Foundation.
- Connecting an AI app to your data gives it real access. Install servers only from sources you trust, and grant only what a task needs.
What MCP is
The official MCP introduction defines it in one line: MCP "is an open-source standard for connecting AI applications to external systems." Using MCP, it says, "AI applications like Claude or ChatGPT can connect to data sources (e.g. local files, databases), tools (e.g. search engines, calculators) and workflows (e.g. specialized prompts)."
The same page offers the comparison most people remember: "Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect electronic devices, MCP provides a standardized way to connect AI applications to external systems."
The word "context" in the name is the key idea. In AI terms, context is the information a model has in front of it when it answers. MCP is a standard way to hand the model more context, and to let it take actions, from systems outside the chat window.
The problem it solves
When Anthropic introduced MCP, it described the problem plainly. Even "the most sophisticated models are constrained by their isolation from data," it wrote, "trapped behind information silos and legacy systems." It added: "Every new data source requires its own custom implementation, making truly connected systems difficult to scale."
MCP's answer is to build once and reuse. Anthropic's announcement says MCP provides "a universal, open standard for connecting AI systems with data sources, replacing fragmented integrations with a single protocol." Instead of "maintaining separate connectors for each data source, developers can now build against a standard protocol."
For you as a user, that means an app that supports MCP can, in principle, plug into any MCP server, and a company that builds one MCP server can reach many AI apps at once. The introduction puts it as "build once and integrate everywhere."
How MCP works, without the code
MCP uses a client-server design. The MCP architecture overview names three participants:
- MCP host: "The AI application that coordinates and manages one or multiple MCP clients." The overview gives Claude Code and Claude Desktop as examples.
- MCP client: "A component that maintains a connection to an MCP server and obtains context from an MCP server for the MCP host to use."
- MCP server: "A program that provides context to MCP clients."
The host creates one client for each server it connects to. The architecture page uses Visual Studio Code as an example: when it connects to one server, it creates one client to hold that connection; when it connects to a second server, it creates another client.
Local and remote servers
A server can run on your own computer or somewhere online. The architecture overview says that when Claude Desktop launches a filesystem server, "the server runs locally on the same machine." This "is commonly referred to as a 'local' MCP server." A server that runs on a company's platform, such as the official Sentry server in the overview's example, is "commonly referred to as a 'remote' MCP server."
The overview says local servers usually serve "a single MCP client," while remote servers "will typically serve many MCP clients." For remote connections, it says "MCP recommends using OAuth to obtain authentication tokens." OAuth is the familiar "sign in and approve access" flow you see when one app asks to use your account on another.
What a server can offer
The architecture overview calls the building blocks "primitives" and says they "are the most important concept within MCP." Servers can expose three core ones:
- Tools: "Executable functions that AI applications can invoke to perform actions." Examples in the overview include file operations, API calls and database queries.
- Resources: "Data sources that provide contextual information to AI applications," such as file contents or database records.
- Prompts: "Reusable templates that help structure interactions with language models."
A simple way to remember it: tools let the AI do things, resources let it read things, and prompts give it ready-made instructions.
Servers can also ask you for input. The overview describes a feature called elicitation, which lets a server "request additional information from users," for example to "ask for confirmation of an action."
What MCP lets AI apps do
The MCP introduction lists examples of what the standard enables:
- "Agents can access your Google Calendar and Notion, acting as a more personalized AI assistant."
- "Claude Code can generate an entire web app using a Figma design."
- "Enterprise chatbots can connect to multiple databases across an organization, empowering users to analyze data using chat."
- "AI models can create 3D designs on Blender and print them out using a 3D printer."
The page also explains who benefits. For developers, MCP "reduces development time and complexity." For end users, it "results in more capable AI applications or agents that can access user data and take actions on the user's behalf when necessary."
Who uses MCP
The introduction says MCP is "supported across a wide range of clients and servers," and names "AI assistants like Claude and ChatGPT" and "development tools like Visual Studio Code, Cursor, MCPJam, and many others."
Anthropic's post on donating MCP to the Agentic AI Foundation adds that MCP "has been adopted by ChatGPT, Cursor, Gemini, Microsoft Copilot, Visual Studio Code, and other popular AI products." In Claude itself, the same post says Claude's directory of connectors is "powered by MCP."
Who runs MCP
Anthropic's original announcement says "MCP was created at Anthropic by David Soria Parra and Justin Spahr-Summers." Anthropic released it as an open-source project with a specification, software development kits (SDKs) and a repository of example servers.
Anthropic later handed it over. The donation post says Anthropic donated MCP to the Agentic AI Foundation (AAIF), "a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, Amazon Web Services (AWS), Cloudflare, and Bloomberg." The post says MCP's "governance model will remain unchanged" and that its maintainers "will continue to prioritize community input and transparent decision-making." The stated aim is for MCP to stay "neutral, open, and community-driven."
The post calls the donation a sign of Anthropic's "commitment to ensuring MCP remains a neutral, open standard."
What to watch for
Connecting an AI app to your accounts gives it real access to your data, and sometimes the ability to act on it. The MCP project's own security best practices page is written mainly for developers, but some points matter to everyone.
Local servers run code on your computer. The page says local MCP servers "are binaries that are downloaded and executed on the same machine as the MCP client" and "may have direct access to the user's system." Without "proper sandboxing and consent requirements," it lists risks including "arbitrary code execution," "data exfiltration" and "data loss."
Apps should ask before they run anything. The page says that if an app supports one-click setup of a local server, it "MUST implement proper consent mechanisms prior to executing commands." That includes showing "the exact command that will be executed" and requiring "explicit user approval before proceeding." It also says apps should "warn that MCP servers run with the same privileges as the client."
Grant narrow access. The page warns that "poor scope design increases token compromise impact." In plain terms, if you approve broad access up front and that approval leaks, an attacker gets broad access too.
Practical habits that follow from this:
- Install servers only from sources you trust.
- Read the approval screen before you accept it.
- Connect only the accounts a task needs, and disconnect ones you no longer use.
For a broader look at how AI agents get into your accounts, including OAuth, see our explainer on screen scraping, open banking, OAuth and MCP. For a real example of how a planted file can steer an AI agent, see our report on a planted AGENTS.md file that hijacked Codex.
Why it matters
MCP is a shared way to let an AI assistant work with your real tools and data. Because it is an open standard, an AI app and a data source that both support it can work together without either company building a custom bridge. For developers who want the technical layer, including the message format and transports, our MCP architecture deep dive goes further. Teams that run MCP servers at work can read our guide to MCP in production, which covers security, sandboxing and tool routing.
Sources
- What is the Model Context Protocol (MCP)? (modelcontextprotocol.io)
- Architecture overview (modelcontextprotocol.io)
- Security best practices (modelcontextprotocol.io)
- Introducing the Model Context Protocol (Anthropic)
- Donating the Model Context Protocol and establishing the Agentic AI Foundation (Anthropic)
