What Is MCP? Model Context Protocol Explained (2026)

Quick answer: The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to external systems. An AI app (the host) runs an MCP client for each MCP server it connects to. Each server exposes tools, resources and prompts over JSON-RPC, locally via stdio or remotely via Streamable HTTP, so one integration works across many AI apps.

That’s the short version. Below: the moving parts, what actually goes over the wire, what changed in the 2026-07-28 spec, and where to go next depending on whether you want to use MCP servers or build one. Every fact here was checked against modelcontextprotocol.io in October 2026.

MCP in one picture

The official docs compare MCP to a USB-C port for AI applications. Before USB-C, every device had its own cable. Before MCP, every AI app needed its own custom integration for GitHub, Slack, your database and so on. With MCP, a service ships one server, and any MCP-capable app can plug into it.

Concretely, MCP lets:

• Claude Code read a Figma design and generate the app from it.
• An assistant read your calendar and Notion pages.
• A company chatbot query several internal databases.

Hosts, clients and servers

MCP has three participants. People mix these up constantly, so here they are side by side:

Participant	What it is	Examples
MCP host	The AI application the user works in. It coordinates one or more clients.	Claude Desktop, Claude Code, VS Code, Cursor
MCP client	A connector inside the host. The host creates one client per server, each with a dedicated connection.	The object VS Code spins up when it connects to the Sentry server
MCP server	A program that provides context and capabilities to clients.	GitHub, Sentry, filesystem, Playwright servers

“MCP server” describes the role, not the location. A server can run on your laptop or on a vendor’s cloud.

• Local servers use the stdio transport and are launched as a process by the host, usually with npx, uvx, Docker or a binary. They typically serve one client. The filesystem MCP server is the classic example.
• Remote servers use Streamable HTTP and typically serve many clients. Most SaaS vendors now host one, for example the Sentry MCP server or the GitHub MCP server.

What an MCP server exposes

MCP defines three core server primitives:

Primitive	Purpose	Who decides to use it	Example
Tools	Executable functions the AI can invoke	The model	create_issue, run a SQL query, click a button in a browser
Resources	Data that gives the AI context	The app or user	File contents, a database schema, API responses
Prompts	Reusable templates for interactions	The user	A “review this PR” template with few-shot examples

Each primitive has list and get methods (tools/list, resources/read, prompts/get), and tools add tools/call. Because clients discover primitives at runtime, a server can add or change tools without the host shipping an update.

Clients can expose features back to servers too. The main one today is elicitation: a server asks the user for extra input or confirmation through the host’s UI. Sampling (a server asking the host’s model for a completion) and logging are deprecated as of protocol version 2026-07-28; the docs now tell servers to call an LLM API directly and to log to stderr or OpenTelemetry.

On top of the core, MCP has opt-in extensions. Notable ones listed in the spec include Tasks (durable handles for long-running operations), MCP Apps (interactive UI such as charts and forms rendered inside the conversation) and Skills over MCP.

How it works on the wire

MCP has two layers:

• Data layer: a JSON-RPC 2.0 protocol covering discovery, the primitives above, and notifications.
• Transport layer: how those messages travel, plus connection setup and authorization.

There are two standard transports:

Transport	Used for	How it works	Auth
stdio	Local servers	Standard input/output between processes on the same machine. No network overhead.	Inherits your local user’s access
Streamable HTTP	Remote servers	HTTP POST for client-to-server messages, with optional Server-Sent Events for streaming	Bearer tokens, API keys or custom headers; MCP recommends OAuth

The older standalone SSE transport is legacy. Clients such as Claude Code fall back to it automatically when a server only speaks SSE.

Here is what a tool listing looks like on the wire, trimmed from the official architecture docs:

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "resultType": "complete",
    "tools": [
      {
        "name": "weather_current",
        "title": "Weather Information",
        "description": "Get current weather information for any location worldwide",
        "inputSchema": {
          "type": "object",
          "properties": { "location": { "type": "string" } },
          "required": ["location"]
        }
      }
    ]
  }
}

The host merges tool lists from every connected server into one registry the model can see. When the model decides to call weather_current, the host routes the tools/call request to the right server and feeds the result back into the conversation.

What changed in the 2026-07-28 spec

The current specification is version 2026-07-28 (the previous one was 2025-11-25). The headline changes for anyone who read an older MCP explainer:

• Stateless protocol. Every request carries the protocol version, client capabilities and client identity in its _meta field, so the server can process each request on its own. There are no protocol-level sessions.
• server/discover. Every server must implement this request, which returns supported versions, capabilities and server identity. Clients may call it first, or skip it and send requests directly, handling a version error if one comes back.
• Opt-in notifications. A client opens a subscriptions/listen stream naming the notifications it wants, such as tool list changes.
• Deprecations. Sampling and logging are deprecated, as covered above.

If you use an official SDK, most of this is handled for you. Our TypeScript MCP server tutorial shows what that looks like in practice.

Who supports MCP

MCP started at Anthropic and is now a cross-industry standard. In December 2025 Anthropic donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. MCP’s own maintainers still steer its technical direction.

On the client side, the official docs list Claude, ChatGPT, Visual Studio Code and Cursor among supporting apps. Within Claude’s own products:

Claude surface	How you add MCP servers	Our guide
Claude Code (terminal, IDE)	claude mcp add command or a project .mcp.json file	MCP servers for Claude
Claude Desktop	Connectors, one-click desktop extensions, or claude_desktop_config.json	Claude Desktop MCP setup
Claude apps (web, mobile)	Remote connectors added in settings	What is Claude?
Claude API	The MCP connector on the Messages API	Claude API tutorial

Adding a remote server to Claude Code is one line:

claude mcp add --transport http notion https://mcp.notion.com/mcp

Prefer not to hand-write JSON? Our MCP config generator builds the config block for Claude Code, Claude Desktop and other clients.

MCP vs plain APIs, plugins and skills

MCP is not the only way to extend an AI app, and it’s not always the right one.

Approach	Best when	Trade-off
MCP server	You want one integration that works across many AI apps, with discovery and auth built in	Another process or service to run and trust
Direct API tool use	You’re building your own app on the Claude API and control the code	Integration is tied to your app
Skills	You need repeatable procedures and instructions, not live data	No live connection to external systems
Browser automation	The system has no API or MCP server	Slower and more brittle than a real integration

In Claude Code, these combine. A skill can tell Claude how to triage a bug, while the Sentry and Linear servers give it the data. Our skills vs subagents vs hooks guide covers where each piece fits.

Security: what to watch

The spec is blunt: tools represent arbitrary code execution and must be treated with caution, and tool descriptions should be considered untrusted unless they come from a trusted server. Hosts must get explicit user consent before invoking tools. In practice:

• Install servers from their owners. Prefer the vendor’s official server, or a well-maintained open-source one, over a random fork.
• Read local server commands before running them. The official security guide’s own examples show a malicious “startup” command exfiltrating SSH keys. A local stdio server runs with your user’s privileges.
• Use least-privilege credentials. Read-only database users, fine-grained tokens, narrow OAuth scopes.
• Watch for prompt injection. Servers that fetch web pages, issues or emails can carry instructions written by someone else into the model’s context.
• Server authors: never accept tokens that weren’t issued for your server (token passthrough is explicitly forbidden), and validate redirect URIs and OAuth state.

Where to go next

• Use MCP with Claude: start with MCP servers for Claude, then pick from our 10 best MCP servers, including Playwright MCP, Context7 and the reference servers. For the full list with setup commands, browse our MCP server directory.
• Build a server: follow Build an MCP server in TypeScript, test it with MCP Inspector, or let the mcp-builder skill guide Claude through it.
• Non-developers: the Claude Desktop MCP setup guide needs no code.

MCP is one layer of a good setup. See what a Claude kit is for how servers, skills, subagents and hooks fit together.