What is MCP (Model Context Protocol)? How it works and its use cases

MCP, the Model Context Protocol, connects AI applications such as Claude, ChatGPT and AI agents to tools and data. This guide covers how MCP works, its architecture, how it differs from an API, its use cases and its limits.

By Rahmatullah Musawi · 7 October 2026 · updated 8 November 2026 · 8 min read · sources checked 5 October 2026

Key points

MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems such as data sources and tools.[1]
The AI application, called the host, creates one MCP client for each MCP server; a server offers tools, resources and prompts.[2]
A REST API is designed for software clients and an MCP server for LLMs; a server can wrap an API's functions as tools.[3]
Since version 2026-07-28 MCP is stateless: every request carries its protocol version and the client's capabilities.[4]
Tools can run code, so verify that you trust a server before connecting it, and keep a person able to deny tool calls.[5] [6] [7]

Anthropic released MCP as open source on 25 November 2024.⁸ The example in this article comes from the MCP documentation: the code editor Visual Studio Code, connected to one MCP server for local files and one for the Sentry service.²

What is MCP?

MCP is an open-source standard for connecting AI applications to external systems: data sources such as local files and databases, tools such as search engines, and workflows such as specialized prompts.¹ The documentation compares it to a USB-C port, which is a standardized way to connect devices.¹

MCP answers an integration problem: before it, every new data source needed its own custom implementation, and with it developers build against one protocol.⁸

MCP was created at Anthropic⁸, which donated it in December 2025 to the Agentic AI Foundation, a fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI.⁹ Claude, ChatGPT, Visual Studio Code and Cursor are among the applications that support it.¹

MCP architecture: host, client, server

MCP has three participants: a host, its clients and the servers.²

TopicWhat is an agent harness? How it works, its parts and use cases describes the harness, the program that runs an AI agent and runs the tools the model asks for.

Example: Visual Studio Code as an MCP host with two servers

The host is opened up to show its clients. A line is the connection between a client and its server, labelled with the transport the server uses.

MCP hostThe AI application. It creates one MCP client for each MCP server.²
MCP clientIt keeps a dedicated connection to its server and obtains context from it for the host.²
MCP serverA program that provides context to MCP clients.²

A server is local or remote. The filesystem server is local: it runs on the same machine as the application that launches it and uses the stdio transport, standard input and output. The Sentry server is remote: it runs on the Sentry platform and uses Streamable HTTP. Both transports carry the same JSON-RPC 2.0 messages.²

Authorization is optional. Over HTTP it is based on OAuth 2.1; over stdio, credentials come from the environment instead.¹⁰

Tools, resources and prompts

A server offers three kinds of things. They differ in who controls each one:¹¹

Feature	What it is	Who controls it	Examples
Tools	Functions the model can call to act: write to a database, call an API, change a file	The model	Search flights, send messages, create calendar events
Resources	Read-only data for context: file contents, database schemas, API documentation	The application	Retrieve documents, read calendars
Prompts	Ready-made instruction templates that tell the model to work with specific tools and resources	The user	Plan a vacation, summarize my meetings

In the other direction, a server can ask the user for more information or for a confirmation, called elicitation.² The sampling, roots and logging features are deprecated since version 2026-07-28.¹²

How an MCP tool call works

A tool call takes two requests from the client: tools/list to learn which tools a server has, and tools/call to run one of them.²

A tool call, from the tool list to the result

Read from top to bottom. The dashed line is the model's decision; the solid lines are fixed steps. The numbers match the notes.

The client lists the toolsIt sends tools/list, and the server answers with the tool definitions: each tool's name, description and input schema.²
The model sees the toolsThe host combines the tools of all connected servers into one registry that the model can access.²
The model calls a toolThe host intercepts the call and routes it to the right server as tools/call.²
The result comes backThe server returns content, such as text, and the host returns the result to the model.²

Show the code: a tool call and its result

Requestfrom the client

{  "jsonrpc": "2.0",  "id": 3,  "method": "tools/call",  "params": {    "name": "weather_current",1    "arguments": {2      "location": "San Francisco",      "units": "imperial"    },    "_meta": {3      "io.modelcontextprotocol/protocolVersion": "2026-07-28",      "io.modelcontextprotocol/clientInfo": {        "name": "example-client",        "version": "1.0.0"      },      "io.modelcontextprotocol/clientCapabilities": {        "elicitation": {}      }    }  }}

nameIt must match the tool's name in the tool list exactly.²
argumentsThe input, as the tool's input schema defines it.²
_metaThe protocol version and the client's capabilities, which every request carries, plus the client's identity.²

Responsefrom the server

{  "jsonrpc": "2.0",  "id": 3,  "result": {    "resultType": "complete",    "content": [4      {        "type": "text",        "text": "Current weather in San Francisco: 68°F, partly cloudy with light winds from the west at 8 mph. Humidity: 65%"      }    ]  }}

contentAn array of content objects; this one is text.²

The code is the example of the MCP documentation.²

Since version 2026-07-28, MCP is stateless: the opening handshake and the session are gone, and every request carries its protocol version and the client's capabilities.⁴ A server that has to keep something between calls, such as a shopping cart, returns a handle that later calls pass back as an argument.⁷

MCP and APIs: the differences

An API and an MCP server are built for different users: REST APIs are designed for traditional software clients, MCP servers for large language models (LLMs).³

The two are used together. Turning a REST API into an MCP server means wrapping its functions as tools that an LLM can call.³ Google, for example, enhanced its existing API infrastructure to support MCP.¹³

	REST API	MCP server
Designed for	Traditional software clients³	LLMs³
How its functions are found	Developers must know that the endpoints exist and integrate them manually¹⁴	The client asks the server for its tools while it runs, with `tools/list`²
Who decides what is called	Logic written in advance: "If X happens, call endpoint Y"¹⁴	The AI chooses which tools to use, based on the task¹⁴
What it exposes	Endpoints over HTTP³	Tools, each with a name, a description and a JSON Schema for its input⁷

A server does not have to mirror the API behind it: Cloudflare advises against treating an MCP server as a wrapper around the full API schema.¹⁵

MCP use cases

The MCP documentation names four examples of what the protocol enables:¹

Agents access a person's Google Calendar and Notion and act as a more personalized assistant.
Claude Code generates an entire web app from a Figma design.
Enterprise chatbots connect to the databases of an organization, so that users analyze data by chat.
AI models create 3D designs in Blender and print them on a 3D printer.

The table shows how six products document their use of MCP:

Product	Connecting MCP servers	Worth knowing
Claude Code	In one of three scopes: local, project (`.mcp.json`) or user⁶	Tool search loads a tool's definition only when it is needed⁶
ChatGPT, developer mode	Supports servers over SSE and streaming HTTP¹⁶	Write actions require confirmation by default¹⁶
Visual Studio Code	`.vscode/mcp.json` in a workspace, or `mcp.json` in the user profile¹⁷	A dialog appears when a server first starts or its configuration changes¹⁷
Gemini CLI	`mcpServers` in `settings.json`¹⁸	A `trust` option, off by default, bypasses all tool call confirmations¹⁸
Hermes Agent	`mcp_servers` in `~/.hermes/config.yaml`¹⁹	Can also be an MCP server itself: `hermes mcp serve`¹⁹
OpenClaw	`mcp.servers` in its configuration²⁰	`openclaw mcp serve` runs OpenClaw as an MCP server²¹

Hermes Agent uses MCP to reach tools that live outside Hermes itself, and passes a local stdio server only the environment variables configured for it plus a safe baseline.¹⁹

TopicWhat is Hermes Agent? How it works, its structure and use cases describes the agent's other tools and connections.

Limits and security

The first limit is context, the text a model can take in at one time: loading every tool definition into it upfront wastes tokens.²² The figure shows an example published by Anthropic.²³

Example: tokens used by the tool definitions of five MCP servers

A setup of five servers published by Anthropic.²³ The bar is the part of the model's context that the tool definitions fill; each piece is one server.

Tokens used before the conversation startsabout 55K

GitHubSlack

GitHub35 tools~26K

Slack11 tools~21K

Sentry5 tools~3K

Grafana5 tools~3K

Splunk2 tools~2K

All five servers58 toolsabout 55K

For hosts with many tools, the MCP documentation recommends progressive discovery: the host puts a tool's full definition into the model's context only when it is needed.²²

The second limit is trust. The specification states that tools represent arbitrary code execution and that MCP cannot enforce its security principles at the protocol level.⁵ It asks that a person can always deny a tool call.⁷

The attack to know is prompt injection: an attacker places text where the model will read it and tricks the model into acting on it.²⁴ In May 2025, researchers at Invariant Labs showed that a GitHub issue containing a prompt injection could make an agent that used the GitHub MCP server leak data from private repositories.²⁵

Simon Willison calls the dangerous combination the lethal trifecta: access to private data, exposure to untrusted content, and the ability to communicate externally.²⁴ So verify that you trust each server before connecting it, as the Claude Code documentation advises.⁶

The bottom line

MCP is a standard way for an AI application to use the tools and data that servers offer. The host runs one client per server, lists the server's tools and calls one when the model asks. An MCP server is made for LLMs and can wrap an API; connect only servers you trust, and keep a person able to deny tool calls.

Sources

What is the Model Context Protocol (MCP)? MCP docs
Architecture overview MCP docs
From REST API to MCP Server Stainless
Key Changes MCP specification 2026-07-28
Specification MCP specification 2026-07-28
Connect Claude Code to tools via MCP Claude Code docs
Tools MCP specification 2026-07-28
Introducing the Model Context Protocol Anthropic
Donating the Model Context Protocol and establishing the Agentic AI Foundation Anthropic
Authorization MCP specification 2026-07-28
Understanding MCP servers MCP docs
Deprecated Features MCP specification 2026-07-28
Announcing Model Context Protocol (MCP) support for Google services Google Cloud blog
What is an MCP Server? Postman blog
Model Context Protocol (MCP) Cloudflare Agents docs
ChatGPT Developer mode OpenAI docs
Add and manage MCP servers in VS Code Visual Studio Code docs
MCP servers with Gemini CLI Gemini CLI docs
MCP (Model Context Protocol) Hermes Agent docs
Connect MCP servers OpenClaw docs
MCP OpenClaw docs
Client Best Practices MCP docs
Introducing advanced tool use on the Claude Developer Platform Anthropic
The lethal trifecta for AI agents: private data, untrusted content, and external communication Simon Willison
GitHub MCP Exploited: Accessing private repositories via MCP Invariant Labs

Written by Rahmatullah Musawi with the help of an AI assistant.