What Is Model Context Protocol (MCP)? A Plain-English Definition

Model Context Protocol (MCP) is an open protocol that defines how AI applications connect to external tools and data sources. Anthropic open-sourced it on 25 November 2024 to replace one-off integrations with a single shared protocol. Since 9 December 2025 it has been governed by the Agentic AI Foundation, a directed fund under the Linux Foundation. The current specification is version 2026-07-28 (as of October 2026).

How does MCP work?

MCP has three roles. The host is the AI application a person uses, such as a chat app or a code editor. Inside it, clients act as the connectors to servers. A server exposes what a business system can do, for example a helpdesk or a document store. According to the specification, all messages use JSON-RPC 2.0.

A server can offer three kinds of capability:

• Tools: functions the model may call, such as "create ticket" or "check stock level".
• Resources: data and context, such as a file or a database record.
• Prompts: reusable templates and workflows that users pick deliberately.

The specification defines two standard transports: stdio for servers started locally, and Streamable HTTP for servers reached over a network. The practical gain: you wrap a system once as an MCP server, and every MCP-capable application can use it. Anthropic names ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code as adopters.

MCP vs. APIs and function calling

MCP does not replace APIs or function calling; it sits between them. An API is the interface of a business system. Function calling is how a language model asks for a function to be run. MCP standardises how an application learns which functions and data exist and how it invokes them.

Take a support desk. Without MCP, every AI tool describes the helpdesk API in its own way, and each integration is maintained separately. With MCP, one server describes "search tickets" and "add comment" once. The model picks one through function calling, the client forwards the request to the server, and the server calls the real API. The page on AI agents for technical service shows what such agents do in practice.

What to watch out for

MCP gives access, not safety. The specification requires explicit user consent before data is shared with servers or tools are invoked, treats tools as arbitrary code execution, and states that the protocol itself cannot enforce these principles.

In practice that means:

• Least privilege: expose only the functions an agent needs, under a dedicated service account.
• Trust the source: the specification says tool descriptions from untrusted servers should be treated as untrusted.
• Human approval for writes: actions such as posting, ordering or sending should need a person to confirm.
• Audit logs: record every tool call so you can trace what happened.

You may not need MCP at all if a single agent talks to a single system and nobody plans to reuse the integration; a direct API call is often enough. For a broader view of agents in business, see AI agents, and browse more terms in the glossary.