What Is MCP? A Clear Explanation - AI Encyclopedia Knowledge

The Model Context Protocol (MCP) is an open protocol launched by the artificial intelligence company Anthropic in November 2024 that standardizes communication between large language models (LLMs) and external data sources and tools. MCP has been compared to the USB-C interface for AI applications; by providing a unified interface, it enables LLMs to flexibly access and interact with various data and services, promoting the broad application and ecosystem development of AI. The launch of the protocol addresses the complexity and security risks of traditional integration methods, improves development efficiency and data security, and has been adopted by companies such as Microsoft, OpenAI, and Google. The emergence of MCP marks an important advance in how AI models interact with the external world, provides a solid foundation for building more powerful and more intelligent AI applications, and is expected to drive the standardization process of the entire AI industry. By simplifying the integration process, MCP lowers the development threshold, enabling more developers to leverage the powerful capabilities of LLMs and create more valuable applications.

What Is MCP

The Model Context Protocol (MCP) is an open protocol launched by Anthropic that standardizes communication between large language models (LLMs) and external data sources and tools. By providing a unified interface, it enables LLMs to flexibly access and interact with various data and services.

Background

As large language models (LLMs) have made breakthrough progress in the field of artificial intelligence, they have demonstrated powerful capabilities in various complex tasks, such as natural language understanding, text generation, code writing, and answering complex questions. However, the knowledge of LLMs mainly comes from their training data, which is static and ends at a specific point in time. This means that LLMs themselves lack awareness of real-time events and cannot directly access and operate external private data sources or tools. To overcome these limitations and enable LLMs to better serve practical application scenarios, developers need to integrate LLMs with various external data sources (such as databases, APIs, and file systems) and tools (such as calculators, code execution environments, and specialized software). Traditional integration methods require customized interface development for each specific data source or tool, a process that is not only cumbersome and time-consuming but also costly.

For example, if an application needs an LLM to simultaneously access a database, call an external API, and read local files, developers may need to write three different sets of interface code to handle different authentication and authorization mechanisms, data formats, and communication protocols. This "point-to-point" integration model leads to the so-called "M×N problem", meaning that M models need to integrate with N tools, theoretically requiring M×N connectors, making the system complex and difficult to maintain.

This customized integration approach also brings security risks, such as data leakage, unauthorized access, and malicious code execution, because each new integration may introduce new attack surfaces. Therefore, the industry urgently needs a standardized, unified protocol to simplify the connection between LLMs and the external world, reduce the complexity and cost of integration, and improve the security and maintainability of systems.

Origin

Anthropic designed MCP as an open standard, actively promoting it to become an industry norm and encouraging community participation and contributions, rather than limiting it to a single vendor's technology stack. From its initial release, MCP provided detailed specification documents, software development kits (SDKs), and a series of reference implementations to help developers get started quickly and participate in building the MCP ecosystem. This move by Anthropic received a positive response from the industry, with companies including Block (formerly Square) and Apollo integrating it into their own systems early in its release, while developer tool providers such as Zed, Replit, Codeium, and Sourcegraph also began working with MCP to enhance the functionality of their platforms. The launch of MCP marked a new stage in LLM application development. By providing a common "language" and "interface," it greatly simplified the interaction between AI models and the external environment, laying a solid foundation for building more powerful, more intelligent, and easier-to-integrate AI applications.

MCP's Core Goals

Reduce Integration Complexity

Through a unified protocol specification, reduce the amount of customized code developers need to write and simplify the integration process.

Improve Development Efficiency

Developers can reuse existing MCP server implementations or quickly develop new MCP servers based on the standard, accelerating the development cycle of AI applications.

Enhance Security, the MCP specification includes security-related considerations, such as an authorization mechanism based on OAuth 2.1, which helps build more secure AI applications.

Promote Ecosystem Development

Through open standards and community collaboration, encourage more developers and organizations to participate in building the MCP ecosystem, develop more feature-rich and diverse MCP servers, enrich the capability boundaries of AI models, and drive the widespread application and innovation of AI technology.

MCP's Metaphor—"The USB-C Interface for AI Applications"

Model Context Protocol (MCP) is widely metaphorized by its creator Anthropic and the industry as "the USB-C interface for AI applications". This vividly reveals MCP's core role and value in the AI ecosystem. Just as the USB-C interface, through its standardized, reversible, and multifunctional characteristics, greatly simplified the connection and data transmission between various electronic devices (such as laptops, smartphones, tablets, peripherals, etc.), replacing the previously diverse and mutually incompatible interfaces (such as USB-A, Micro-USB, HDMI, VGA, etc.)

Before MCP appeared, the connections between AI models (especially large language models) and the external world were often fragmented and customized. Each new integration required developing specific adapters and interfaces, just as before USB-C became widespread, users had to prepare different cables and converters for different devices.

The emergence of MCP is like introducing the USB-C standard to the AI world, allowing AI models to access various MCP servers (which encapsulate access capabilities to specific data or tools) in a "plug-and-play" manner through a common protocol. Just as the USB-C interface can support multiple functions such as data transmission, video output, and power delivery, MCP also supports multiple core functions such as resource access, tool invocation, prompt management, and heuristic interaction, and can adapt to diverse AI application scenarios. It profoundly demonstrates MCP's potential in promoting the popularization of AI technology and application innovation, and it is expected to become a key bridge connecting AI models with the real world.

MCP's Core Components

Host

The Host is the interface or application through which users interact with the AI model. It is responsible for receiving user input (such as questions, instructions) and passing this input to the AI model for processing. The Host is also responsible for displaying the responses generated by the AI model or the results of executed operations to the user. In the MCP interaction flow, the Host plays the role of coordinator, understanding user intent and deciding when and how to invoke the MCP Client to obtain external data or perform tool operations.

A typical example of a Host is the Claude Desktop application, in which users can directly converse with the Claude model and access the local file system or network resources through MCP. The Host needs to be able to manage the lifecycle of the MCP Client and handle logic related to user interaction, such as permission requests, error notifications, etc.

Client

The MCP Client is the bridge between the Host and the MCP Server. It is responsible for establishing connections with one or more MCP Servers, encapsulating AI model requests (for example, obtaining specific resources, invoking a certain tool) into request messages that conform to the MCP specification and sending them to the corresponding Server. The Client is also responsible for receiving response messages from the Server and returning the results to the Host or passing them directly to the AI model. The MCP Client needs to implement the MCP protocol specification, including message encoding and decoding, handling of transport protocols (such as HTTP, WebSockets, gRPC, or stdio), and necessary security mechanisms (such as OAuth 2.1 authentication). In some implementations, the MCP Client may be built into the Host application, or may be invoked by the Host as a separate library.

Server

The MCP Server is the component that actually provides data or performs tool operations. Each MCP Server encapsulates access capabilities to a specific data source (such as a database, file system, API) or tool (such as a code interpreter, calculator, professional software). When the MCP Server receives a request from the Client, it performs the corresponding operation based on the request type and parameters (for example, querying a database, reading a file, calling an external API), encapsulates the result into a response message that conforms to the MCP specification, and returns it to the Client. The MCP Server also needs to implement the MCP protocol specification and expose externally the capabilities it supports (Capabilities), such as which resources, which tools, and which prompt templates it provides. Developers can develop custom MCP Servers according to the MCP specification to extend the capabilities of the AI model.

This three-component architecture clearly separates user interaction, protocol communication, and specific function implementation, giving the MCP system good modularity and extensibility. The Host focuses on the user interface and experience, the Client handles communication at the protocol level, and the Server provides specific business logic and data access capabilities.

Example of the MCP interaction flow

To better understand how the three components Host, Client, and Server work together in the MCP architecture, we can illustrate this through a specific interaction example.

Suppose the user is in Claude Desktop(Host) and asks a question: "What documents are on my desktop?". The following is a typical MCP interaction flow for handling this request:

• User Input: The user enters the question "What documents are on my desktop?" in the Claude Desktop interface and sends it. The Host (Claude Desktop) receives this user request.
• Host Processing: The Host passes the user's original question to its internal AI model (for example, the Claude model) for analysis and understanding. The AI model needs to determine whether this question requires access to external resources or tools to obtain the answer.
• Model Analysis: After the AI model analyzes the problem, it identifies that the user's intent is to obtain local file system information. The model determines that it needs to call an external tool capable of accessing the file system. Under the MCP framework, this means the model will generate a request indicating that a specific MCP Tool needs to be called (for example, a tool provided by an MCP Server that encapsulates file system browsing capabilities).
• Client Request: The MCP Client inside the Host receives the instruction issued by the AI model to call an external tool. Based on the instruction, the MCP Client looks up the preconfigured MCP Server that can provide file system access services. Then, the Client, in accordance with the MCP protocol specification, encapsulates the model's request (for example, a request to list the files on the user's desktop) into a standard MCP request message and sends it to the target MCP Server through the specified transport method (for example, HTTP, WebSockets, or stdio).
• Server Execution: The target MCP Server (for example, an MCP Server dedicated to the file system) receives the request from the Client. The Server parses the request, verifies permissions (if needed), and then performs the corresponding operation—in this example, scanning the user-specified desktop directory to obtain the file list. After execution is complete, the MCP Server encapsulates the obtained document list (for example, a JSON object containing information such as file names and paths) into a standard MCP response message and returns it to the MCP Client through the same transport method.
• Model Response: The MCP Client receives the response from the MCP Server, extracts the result data (that is, the list of desktop documents), and passes it to the AI model. After receiving this contextual information, the AI model combines it with the original question and generates a natural language reply, for example, "You have the following documents on your desktop: report.docx, budget.xlsx, image.png."
• Host Display: The Host (Claude Desktop) receives the final reply generated by the AI model and displays it to the user in the user interface.

Core Features of MCP

Resource

The Resource feature allows an MCP Server to provide read-only contextual information or data to the AI model. These resources can be static data or dynamically generated data. For example, an MCP Server can provide access to a company's internal knowledge base or provide real-time stock market data. The AI model can request these resources through the MCP Client to obtain the information needed to complete the task.

The design of Resource emphasizes read-only behavior, ensuring the security of data sources and preventing the AI model from accidentally modifying the original data. The MCP specification defines mechanisms such as resource discovery, subscription, and notification, enabling the model to effectively obtain and use this external information.

Prompt

The Prompt feature allows an MCP Server to provide preset prompt templates. Templates can help the AI model generate output in a specific format or with specific content, or guide the model to perform tasks in a specific way. For example, an MCP Server can provide prompt templates for generating specific types of emails or templates for code generation.

By using standardized prompt templates, the quality and consistency of model output can be improved, reducing the need to hard-code prompts in applications. MCP allows servers to declare the prompt templates they provide, and clients can query and use these templates.

Tool

The Tool feature is one of the core characteristics of MCP, allowing AI models to call external APIs or tools to perform specific operations. Tools can perform various tasks, such as performing calculations, querying databases, sending emails, controlling external devices, etc. An MCP Server can declare the tools it provides, including the tool's name, description, parameter list, and expected output format. After analyzing the user's request, if the AI model determines that a tool needs to be called, it can send a tool call request to the corresponding Server through the MCP Client. The Server executes the tool and returns the result, and the model then generates a reply based on the result. The Tool feature greatly expands the capability boundaries of AI models, no longer limited to text generation, and enables deeper interaction with the real world.

Elicitation

Elicitation allows an MCP Server to proactively request more information from the user or clarify ambiguous input during an interaction. In traditional interaction modes, if the model or tool needs additional information to continue executing a task, it can only return an error or prompt the user to ask again.

Elicitation provides a more structured way to handle this situation. When the Server side (through LLM analysis) finds that the current request lacks necessary parameters or has an unclear intent, it can return a elicitationRequest, which contains a description or form of the information that needs to be provided by the user. After receiving this request, the Host can display the corresponding interface to the user (for example, a form containing input fields), collect the user's input, and then send the information back to the Server through an continueElicitation request. This makes interaction more flexible and intelligent, and can handle more complex tasks that require multiple rounds of dialogue to complete, such as interactive form filling, clarification of user intent, etc.

Structured Output

The Structured Output feature requires an MCP Server to return the results of tool calls in a structured format (for example, JSON). Compared with returning unstructured text, structured output is easier for AI models to parse and understand. The MCP specification supports defining a JSON Schema for a tool's output, so that the model can anticipate the structure and types of the returned data and perform subsequent processing more accurately.

For example, a tool for querying weather might return a JSON object containing fields such as temperature, humidity, and wind speed, rather than a natural language text describing the weather.

This structured output improves the efficiency of the model in processing results and enhances the reliability and maintainability of the system.

The latest MCP specification (such as the 2025-06-18 version) further strengthens support for structured content and output schemas, introducing typed, validated results as well as a flexible Schema philosophy and MIME type clarity.

Features of MCP

Flexibility

MCP supportsmultiple transport protocols and communication methods. Although the MCP specification itself is independent of the transport layer, it explicitly supports multiple communication mechanisms including Streamable HTTP、WebSockets、gRPC as well as stdio(standard input/output, commonly used for local inter-process communication). This diversity allows MCP to adapt to different deployment environments and performance requirements.

For example, for scenarios requiring low latency and bidirectional real-time communication, WebSockets or gRPC may be better choices; for simple local tool calls, stdio is more lightweight and convenient. Streamable HTTP allows data to be transmitted in a streaming manner, making it suitable for scenarios involving large amounts of data or requiring gradual display of results.

Scalability

The protocol itself defines a set of core message types and interaction patterns, but it also allows new functionality or features to be introduced through Extensions. MCP uses a mechanism based on Capability Negotiation, where the client and server declare the capabilities they each support when initializing a connection. If both parties support a certain extension feature, then that feature can be used in the session. This mechanism ensures the protocol's forward compatibility and backward compatibility, allowing new features to be introduced gradually without breaking existing implementations.

Modular design

An MCP Server is a lightweight program, and each Server is only responsible for exposing specific functionality or data sources. This allows developers to develop and deploy MCP Servers on demand, building a distributed, composable network of AI capabilities.

For example, a company can develop an MCP Server specifically for accessing its internal CRM system, and another team can develop an MCP Server that connects to a specific database.

An AI application (Host) can dynamically discover and use the functionality provided by these Servers through an MCP Client, combining them like building blocks to create complex applications.

Openness and community-driven

As an open protocol, MCP encourages community participation and contribution, which means more developers will develop new MCP Servers, Client libraries, tools, and documentation for it. This enables faster response to market demands and gives rise to more innovative application scenarios.

MCP's security mechanisms

Security mechanisms based on OAuth 2.1

The Model Context Protocol (MCP) adopts a security approach based on the OAuth 2.1 authorization framework. OAuth 2.1 is an evolved version of OAuth 2.0, incorporating OAuth 2.0 best practices and security recommendations, and providing a stronger and easier-to-use authorization solution. In MCP's interaction flow, when an MCP Client needs to access a protected MCP Server (that is, a Server that provides sensitive data or performs sensitive operations), OAuth 2.1 authentication and authorization are required. This means the Client needs to first obtain an Access Token from an Authorization Server, and then carry that token when making requests to the MCP Server. The MCP Server verifies the validity of the token (for example, by verifying the signature and expiration via an introspection endpoint or JWKS endpoint) and checks whether the token contains the permissions (scopes) required to perform the requested operation.

The MCP specification particularly emphasizes some key security features in OAuth 2.1, such as PKCE (Proof Key for Code Exchange) for preventing authorization code interception attacks, and Token Audience Binding (RFC 8707) for ensuring that an access token can only be used by the intended MCP Server. This effectively prevents cross-server token abuse and improves the overall security of the system.

Security best practices

The Model Context Protocol (MCP) ecosystem emphasizes a series of security best practices to ensure data security, privacy, and system integrity are maintained in increasingly complex AI application scenarios.

• MCP server security hardening and deployment practices: When deploying MCP servers, the principle of least privilege should be followed, exposing only necessary services and ports. The operating system should be hardened, and consideration should be given to using security enhancement tools. All incoming input (such as user prompts and tool parameters) must be strictly validated and sanitized to prevent common web attacks, such as prompt injection and parameter pollution. For locally running MCP servers, it is recommended to run them in containers (such as Docker, running as a non-root user) or virtual machines to achieve isolation from the host system. Network access control should also be strictly configured, avoiding directly exposing MCP servers to the public internet, and prioritizing binding to localhost or private subnets.
• Security of interaction between MCP clients and tools: MCP clients should authenticate using short-lived, scope-limited tokens based on MCP's support for OAuth 2.1. All interactions should be authenticated. In terms of tool design, clear metadata should be provided for each Tool, including its functional description, input parameters, expected output, and possible side effects. For tools that may modify data or have significant impact, annotations such as readOnlyHint and destructiveHint should be used to clearly mark them, helping the runtime environment take appropriate security measures.
• Credential and key management:is a basic requirement, and hardcoding credentials or API keys in configuration files should be absolutely avoided. Environment variables or dedicated key management services should be used to store and access sensitive information, and keys should be rotated regularly.
• Enable detailed logging and monitoring:is crucial for post-incident auditing, anomalous behavior detection, and security incident investigation. MCP servers and clients should be configured to record all operation logs, including requests, responses, errors, and user interactions. In particular, recording all prompts sent to AI models helps detect and prevent prompt injection attacks.
• Establish a governance process for MCP Servers: Organizations should establish a formal approval process for adding new MCP Servers to the environment, including security review and source code verification. Maintain a list of approved MCP Servers, and consider establishing an internally reviewed MCP Server repository to reduce the risk of introducing malicious or vulnerable Servers.

Industry adoption of MCP

Since its launch, the Model Context Protocol (MCP) has quickly gained widespread industry attention and active adoption.Anthropic As the initiator of MCP, it was among the first to integrate and support MCP in its product line, for example in its Claude Desktop application and Claude models.

OpenAI announced in early 2025 that it supports MCP in its Agents SDK, ChatGPT desktop application, and Responses API,

Microsoft is actively participating in the MCP ecosystem, launching the Playwright-MCP server, enabling AI agents to browse the web and interact with websites like humans.

Google adopted MCP in its products.

Docker launched MCP Toolkit, simplifying the deployment and management of MCP servers by providing features such as one-click deployment and a catalog containing more than 100 secure MCP servers.

MCP application cases

Applications in the fintech field

• Robo-advisory: MCP can enable AI investment advisory systems to obtain the latest stock prices, financial news, company earnings reports, and other information in real time (through the Resource function), analyze customers' risk preferences and investment goals (possibly interacting with users through the Elicitation function), and then call trade execution tools (the Tool function) to provide customers with personalized investment advice and execute trades.
• Fraud analysis:By connecting to various data sources (such as transaction records, user behavior logs, and blacklist databases), LLMs can assist in identifying suspicious transaction patterns.
• Customer service: MCP can enable chatbots to answer common questions, query users' account information (after obtaining authorization), handle simple business requests (such as transfers and bill inquiries), and provide personalized financial advice. Through MCP's standardized interfaces, financial institutions can more safely and conveniently leverage the powerful capabilities of LLMs, ensuring data security and compliance.

Applications in the Healthcare Field

• Clinical decision support: Doctors can describe a patient's symptoms and medical history to an AI assistant. Through MCP, the AI assistant can query relevant medical knowledge bases (Resource) and the latest clinical guidelines (Resource), call diagnostic assistance tools (Tool), and provide doctors with diagnostic suggestions and treatment plan references. MCP's Elicitation function can be used to ask doctors for more details during the diagnostic process or to confirm key information.
• Personalized medicine:MCP can help integrate patients' genomic data, lifestyle data, and more to provide patients with customized health management advice and disease prevention plans.
• Medical research: MCP can accelerate the literature review process, helping researchers quickly extract key information from massive amounts of literature, or assist in analyzing clinical trial data.
• Patient monitoring systems: By connecting wearable devices and sensor data, patients' health conditions can be analyzed in real time, with timely alerts when abnormalities occur. MCP's security mechanisms, especially authorization based on OAuth 2.1, are crucial for handling sensitive medical data, ensuring that only authorized users and applications can access patient information.

Applications in the Technology Industry

• Software development: Integrated development environments (IDEs) can use MCP to seamlessly integrate the powerful coding capabilities of LLMs with local development environments, version control systems (such as Git MCP Server), debugging tools, API documentation, and more. Developers can use natural language instructions to have AI assistants write code, explain code, generate test cases, find and fix bugs, and deploy applications. For example, a developer can ask: "Run the tests on my current branch and summarize the reasons for the failures." The AI assistant can use MCP to call Git tools to obtain the code, call testing tools to execute the tests, and then analyze the logs and generate a report.
• IT operations and support:An AI operations assistant can connect to monitoring systems, log servers, configuration management databases (CMDB), etc., and through natural language interaction help operations personnel diagnose problems, perform maintenance tasks, and automate troubleshooting processes. For example, based on alert information, an AI assistant can automatically query the logs of the relevant servers (through the log query tool provided by the MCP Server), analyze the cause of the error, and suggest a repair plan.
• Technical documentation assistant:Help users quickly find the technical information they need, or generate code snippets and configuration examples according to user requirements. Technology companies can use MCP to encapsulate their internal knowledge bases, API services, etc. into MCP Servers, so that internal employees or external developers can conveniently access and use them through LLMs, improving work efficiency and innovation capability.

Latest MCP protocol changelog

• Remove JSON-RPC batching support for JSON-RPC: To simplify the specification and avoid ambiguity, especially when implementing Streamable HTTP transport, no actual need for batching was found, and the JSON-RPC notification/response model is difficult to satisfy real-time and concurrent invocation requirements, so this feature is removed.
• Enhance tool invocation results with structured output: Introduced outputSchema and structuredContent fields. This improvement is intended, without breaking the existing content structure, to provide a lightweight, verifiable formatting channel for simple JSON output scenarios. It is especially important for improving data security and reliability when interacting with untrusted servers, enabling clients to more precisely parse and validate responses from tools. For example, a network device status retrieval tool can define an output schema containing fields such as device ID, status, and uptime, ensuring the returned data is structured and verifiable.
• Classify MCP servers as OAuth resource servers: and add protected resource metadata (following RFC 9728) to enable discovery of the corresponding authorization server. This helps clients automatically discover the authorization server, avoids misuse of access tokens, and improves overall security and deployment consistency.
• Require MCP client implementations to follow RFC 8707 Resource Indicators: to prevent malicious servers from obtaining access tokens. By including the resource parameter in authorization requests and token requests, clients can explicitly specify the target MCP server for which the token is intended, enhancing the security of OAuth 2.0 authorization.
• Support "Elicitation" feature: Allows servers to dynamically request additional information from users during interaction. MCP previously lacked a standardized way to support this kind of runtime interaction, and developers often had to rely on multi-step tool invocations or custom protocols. The introduction of the Elicitation mechanism provides a structured input mechanism for scenarios such as confirmation, clarification, and login redirection in workflows, completing the bidirectional interaction loop among the model, the user, and the server. For example, before executing a delete operation, the server can request user confirmation through elicitation; or when specific user information is needed (such as time zone or organization name), it can dynamically initiate a request to the client.
• Add Resource Links type to tool invocation results: To support tools returning references to external or large resources rather than directly embedding their content, a new ResourceLink type was introduced. This solves scenario requirements where directly embedding content in the interaction flow is infeasible or inefficient, such as lazy loading, handling large files, or temporary resources.
• Clarify security considerations and best practices: Added relevant explanations to the authorization specification and added a "Security Best Practices" page to guide developers in building more secure MCP applications.

The Development Prospects of MCP

As an open protocol for standardizing the interaction between AI models and external systems and data sources, the future development of the Model Context Protocol (MCP) will focus on promoting broader industry standardization, continuously enhancing core functionality and security, and continuously expanding its ecosystem and improving interoperability. With the rapid development of artificial intelligence technology and the continuous deepening of application scenarios, MCP is committed to addressing the challenges currently faced by AI integration, such as fragmentation, complexity, and security risks, and to providing a solid foundation for building more powerful, more reliable, and easier-to-integrate AI applications. The community and developers are actively promoting the evolution of MCP to adapt to growing demands and the constantly changing technological landscape.