What is MCP?

The Model Context Protocol is an open standard, created by Anthropic, for how AI agents talk to external tools and APIs. One integration on the tool's side, and every MCP-speaking client can use it: the same server works in Claude Code, Cursor and Zed without any of them knowing about the others.

Before it, every agent needed its own integration for every API. Wanting Claude to search Slack, read GitHub issues and query a database meant three integrations, three authentication flows and three data formats.

Tools

An MCP server exposes tools: functions an agent calls with structured input and gets structured output back. The agent does not need the implementation. It needs to know that search_slack takes a query and returns messages.

JSON

{
  "name": "search_slack",
  "description": "Search Slack messages across all channels",
  "inputSchema": {
    "type": "object",
    "properties": {
      "query": { "type": "string", "description": "Search query" },
      "limit": { "type": "number", "default": 10 }
    },
    "required": ["query"]
  }
}

The three parts

Part	What it is
Client	The agent that wants tools. Claude, Cursor, VS Code Copilot, or anything implementing the client spec.
Server	A service wrapping an API and exposing it as tools. One per API: a Stripe server, a GitHub server, a Slack server.
Transport	How they talk. stdio for local tools, HTTP with Server-Sent Events for remote ones.

What the protocol does not say

MCP describes how a tool is declared and called. It is silent on everything that decides whether calling it is a good idea:

who is allowed to call which tools
where the API credential lives, and how it is rotated
what happens when a tool response carries a secret back out
how you find out afterwards which agent called what, and when
how a tool definition carrying a prompt injection gets caught

None of these are oversights. A protocol that also specified authorization would be a much harder protocol to adopt. They are simply left to whoever runs the servers, which in practice means they are left undone.

Warning

An MCP server holds a real credential for whatever it talks to. Installed from a repository or an npm package with no review, it is code with your keys running on a developer's machine.