The Model Context Protocol (MCP)

Every agent needs connections to the outside world: files, databases, calendars, issue trackers. Without a standard, each application has to build its own connection to each system. The Model Context Protocol (MCP) is an open standard that defines one way for AI applications to connect to external tools and data.

MCP was introduced by Anthropic in November 2024 as an open protocol, and has since been adopted by other AI companies and tool makers. Its documentation compares it to a USB-C port for AI applications: one standard connector in place of many custom ones.

The problem it solves

With five AI applications and ten systems to connect, custom integrations would mean fifty separate pieces of work. With a shared protocol, each system needs one server and each application needs one client.

Architecture

Participant	Role	Example
Host	The AI application the user works with	A chat application, a code editor
Client	A component inside the host that maintains the connection to one server	Created by the host
Server	A program that exposes tools and data	A server for a database, a file system or an issue tracker

A host can connect to many servers at once, with one client for each.

What a server offers

MCP defines three main kinds of capability.

Primitive	What it is	Controlled by
Tools	Functions the model can call to act or fetch information	The model
Resources	Data that can be read into the context, such as files or records	The application
Prompts	Reusable prompt templates	The user

Tools are the most widely used. They are the same idea as the function calling you learned earlier, described in a standard format so that any MCP client can discover and call them.

How a connection works

The host starts and connects to its configured servers.
Client and server exchange an initialisation message and agree on what each supports.
The client asks the server to list its tools.
The host makes those tools available to the model.
When the model asks to use a tool, the client sends the call to the server.
The server runs it and returns the result, which goes back to the model.

Messages are written in JSON-RPC 2.0. A request to list tools looks like this:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}

and a call to a tool like this:

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "get_order_status",
    "arguments": { "order_id": "A-10432" }
  }
}

Transports

A transport is how the messages travel.

stdio. The host starts the server as a local program and communicates through standard input and output. This suits tools that run on your own computer.
Streamable HTTP. The server runs as a web service and the client connects over HTTP. This suits remote and shared servers.

Writing a server

Official software development kits exist for several languages. With the Python kit, a server is a few lines. Run this on your own computer.

# pip install "mcp[cli]"
from mcp.server.fastmcp import FastMCP

mcp = FastMCP("orders")

ORDERS = {"A-10432": {"status": "in transit", "expected": "2026-10-14"}}

@mcp.tool()
def get_order_status(order_id: str) -> dict:
    """Look up the current status and expected delivery date of an order.

    Args:
        order_id: The order number, for example A-10432.
    """
    return ORDERS.get(order_id, {"error": f"no order found with id {order_id}"})

if __name__ == "__main__":
    mcp.run()

The function’s name, type hints and documentation string become the tool definition that the model sees. Everything you learned about writing clear tool descriptions applies.

Using existing servers

Many servers are already available for common systems such as file systems, databases, version control and business applications. To use one, you add it to the host’s configuration, and its tools become available to the model.

Security

An MCP server runs code and reaches your data, so connecting one is a decision about trust.

Install servers only from sources you trust, as you would any software.
Grant the least access needed. Give a database server a read-only account if it only needs to read.
Remember that tool descriptions and results are text the model reads. A malicious server, or malicious content returned by an honest one, can attempt prompt injection.
Keep approval for consequential actions. Hosts usually ask the user before running a tool. Do not switch that off for tools that change or delete things.
Use proper authentication for remote servers.

When to use MCP

You want a tool to work in more than one AI application.
You want to use integrations that others have already built.
You are building a host and want users to be able to add their own tools.

For a single application with a few private tools, defining them directly through function calling is simpler, and nothing is lost.

Practice

List three systems you use at work. For each, describe one tool, one resource and one prompt that an MCP server for it could offer.