What is MCP? The Model Context Protocol explained

Servers advertise their capabilities in response to server/discover, which a client may call before any other request. Calling it is optional.

A deprecated feature stays in the specification for at least twelve months. The earliest removal is the first revision released on or after 2027-07-28.

1. 1

   1. The client asks which tools exist

   {"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {"cursor": "optional-cursor-value"}}

2. 2

   2. The server lists its tools

   {"jsonrpc": "2.0", "id": 1, "result": {"resultType": "complete", "tools": [{"name": "get_weather", "title": "Weather Information Provider", "description": "Get current weather information for a location", "inputSchema": {"type": "object", "properties": {"location": {"type": "string", "description": "City name or zip code"}}, "required": ["location"]}}]}}

3. 3

   3. The client calls one tool

   {"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "get_weather", "arguments": {"location": "New York"}, "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28", "io.modelcontextprotocol/clientInfo": {"name": "ExampleClient", "version": "1.0.0"}, "io.modelcontextprotocol/clientCapabilities": {}}}}

4. 4

   4. The server returns the result

   {"jsonrpc": "2.0", "id": 2, "result": {"resultType": "complete", "content": [{"type": "text", "text": "Current weather in New York:\nTemperature: 72°F\nConditions: Partly cloudy"}], "isError": false}}

5. 5

   5. A tool can fail without breaking the protocol

   A tool execution error comes back as a normal result with isError set to true and text the model can use to correct itself. A protocol error, such as an unknown tool, uses a JSON-RPC error with code -32602. The specification suggests clients pass tool execution errors to the model.

• Not a security boundary. The specification says MCP cannot enforce its security principles at the protocol level, and it tells implementors to build consent flows and access controls themselves. A tool server is code that runs with real privileges.
• Not an agent framework. The specification defines messages between hosts, clients and servers. It has no section on planning, memory or orchestrating several agents. The host application and its framework do that.
• Not a replacement for APIs. Many servers call an API underneath. See MCP vs API for the layering.
• Not agent-to-agent communication. MCP connects an agent to its tools. The A2A project describes itself as the layer for agents talking to each other: see What is the A2A protocol.
• Not a vetting scheme. The official registry says consumers should assume minimal-to-no moderation. See MCP servers for how to check a server yourself.

• Treat tool descriptions and annotations as untrusted unless the server is trusted. The specification says so, and descriptions reach the model, which makes them a route for prompt injection. The checklist is in MCP security best practices.
• Keep a human able to deny tool calls. The specification says there should always be a human in the loop with the ability to deny tool invocations, and that hosts must obtain explicit consent before invoking any tool.
• Run local servers with least privilege. A local server runs with the same privileges as the client. The specification recommends showing the exact command before a one-click install and using a sandbox.
• Never let a server accept tokens issued for another service. The specification forbids token passthrough.
• Log tool use. The specification says clients should log tool usage for audit, and that servers must validate inputs, apply access controls, rate limit calls and sanitise outputs.
• Go deeper in MCP and tool security for the control model, and How to secure MCP servers for the hardening steps.

• MCP specification overview (latest). Base protocol, features, key security principles.
• MCP specification versioning. Current revision 2026-07-28 and the version negotiation rules.
• MCP architecture. Host, client and server roles; design principles; capability negotiation.
• MCP tools. tools/list and tools/call message shapes, error handling, security considerations.
• MCP transports. Standard and custom transports.
• MCP Streamable HTTP transport. Endpoint, Origin validation, localhost binding, request headers, _meta example.
• MCP stdio transport. Subprocess launch and framing.
• MCP authorization. OAuth-based flow, resource indicators, token rules, client registration.
• MCP deprecated features. Roots, sampling, logging, Dynamic Client Registration and HTTP+SSE status.
• MCP governance and stewardship. LF Projects, LLC, maintainer roles, licences.
• What is MCP (official introduction). The project's own definition and USB-C comparison.
• MCP security best practices. Local server compromise, token passthrough, scope minimisation.
• Anthropic: donating MCP to the Agentic AI Foundation. Creator, donation date and governance statement.
• Linux Foundation: formation of the Agentic AI Foundation. Founding projects and the November 2024 open-source date.

• MCP servers

  Where to find MCP servers and how to vet one.

• MCP vs API

  How MCP and direct API calls fit together.

• What is the A2A protocol

  The Agent2Agent protocol from its own site.

• MCP security best practices

  A practical checklist for MCP deployments.

• MCP and tool security

  Securing tool servers and what agents may call.

• How to secure MCP servers

  Hardening tool servers.

• RAG vs MCP

  Retrieval and tool access compared.

• Swfte Cortex

  The governed AI desktop that answers from your own files.