An MCP server is a small program that exposes tools, data or templates to an AI assistant through the Model Context Protocol, so the assistant can read your files, query your database or call your API without anyone writing a bespoke integration for each pairing. If you have ever wired the same service into three different AI products three different ways, that is the problem it was built to remove.
Updated September 2026. This area is moving quickly, so check the linked sources for the current position.
What the Model Context Protocol is
MCP is an open protocol that uses JSON-RPC 2.0 messages between three roles: hosts, which are the AI applications that start connections; clients, which are the connectors inside them; and servers, which supply the capabilities. The specification says it takes inspiration from the Language Server Protocol, which did the same job for programming language support in editors.
Versions are dated rather than numbered. The current specification is 2026-07-28, which replaced 2025-11-25. That release made a significant architectural change: it removed the connection-level initialize handshake and session header, so client details and capabilities now travel with each request. The practical effect is that a remote server can sit behind an ordinary load balancer without sticky sessions.
Governance changed too. Anthropic donated the protocol to the Agentic AI Foundation, a directed fund of the Linux Foundation, on 9 December 2025, alongside Block’s goose and OpenAI’s AGENTS.md. The project blog put adoption at more than 97 million monthly SDK downloads and over 10,000 active servers at that point. Maintainers and the proposal process were left as they were.
What an MCP server can expose
- Tools. Functions the model can call, such as “create an issue” or “run this query”. These are the reason most servers exist.
- Resources. File-like data a client can read, such as documents, records or API responses.
- Prompts. Templated messages and workflows offered to the user rather than triggered by the model.
- Elicitation, which runs the other way: a server can ask the client to collect more information from the person.
Beyond the core, the specification defines opt-in extensions that both sides must agree to during setup. Tasks handles long-running work with durable handles and polling. MCP Apps renders interactive elements such as charts and forms inside a conversation. A feature lifecycle policy now guarantees at least twelve months between a feature being deprecated and removed, which matters if you are shipping something you expect to maintain.
How a server actually connects
Two transports are standard. The stdio transport runs the server as a subprocess on the same machine and exchanges newline-delimited messages over its standard streams, which is what local editor integrations use. Streamable HTTP posts each message to a single endpoint and returns either a JSON object or a stream, which is what remote and hosted servers use. Protocol meaning is identical on both.
Building one is not a research project. Official SDKs exist for several languages, and the quickstart in the documentation walks through a server that exposes two tools and then registers it with a host through a short configuration entry. A useful first version is an afternoon of work. The effort arrives afterwards: authentication, error handling, rate limits, versioning, and writing tool descriptions clear enough that a model picks the right one.
For discovery there is an official registry at registry.modelcontextprotocol.io, backed by Anthropic, GitHub, Microsoft and PulseMCP. It is still in preview, it stores metadata rather than code, and it verifies namespaces through DNS or GitHub ownership. It explicitly delegates security scanning to package registries and downstream marketplaces, so a listing is not a safety review.
The risks of connecting an MCP server
The specification is candid that the protocol enables arbitrary data access and code execution, and that tool descriptions should be treated as untrusted unless they come from a trusted server. That is not a theoretical caveat. In a research note published on 1 July 2026, the Cloud Security Alliance reported that the MCPTox benchmark found tool poisoning attempts succeeded 36.5 percent of the time on average and up to 72.8 percent against some models, and that several command-line coding tools auto-execute project-defined servers with the developer’s own privileges once a folder is trusted. Tracked issues include CVE-2025-54135 and CVE-2025-54136 in Cursor.
The pattern should feel familiar. A tool description is text the model reads and acts on, which makes it a delivery route for prompt injection, and a server you install from a registry is a dependency, which makes a poisoned update a supply chain attack. Neither problem is new; the connection is what makes them reachable.
6 safety checks before you connect
- Read the tool descriptions, not just the README. Hidden instructions live in the text the model sees, which is rarely the text you see.
- Pin the version and review updates. A server that changes its tool definitions silently can change what your assistant does.
- Check the namespace, not the display name. Registry entries are tied to a verified domain or GitHub account; look-alike names are not.
- Give it its own credentials, scoped to one job and short lived. Never hand a server a token that also reaches production.
- Keep approval on destructive tools. Anything that writes, deletes, sends or spends should prompt you every time.
- Update the host application. Several of the worst issues were in the clients and editors that launch servers, not in the servers themselves.
Should you build one?
Build one when several AI products need the same access to a system you control, or when the alternative is pasting data into a chat window by hand. Skip it when a single script would do, or when the data is sensitive enough that you would not want a model choosing when to read it. For the wider picture of what all this plugs into, see our explainers on agentic AI and what an AI agent is.
Common questions
What is an MCP server in simple terms? It is a small program that offers tools, data or templates to an AI application through a shared protocol, so any compatible assistant can use the same integration instead of each product needing its own.
Is MCP controlled by Anthropic? Not any more. Anthropic created it and donated it to the Agentic AI Foundation under the Linux Foundation on 9 December 2025. Maintainers and the proposal process continued unchanged.
What is the current MCP specification version? Versions are dated. The current specification is 2026-07-28, which succeeded 2025-11-25 and removed the connection-level handshake in favour of stateless requests.
Are MCP servers safe to install? Treat them like any other dependency that runs with your privileges. Research in 2026 found high success rates for poisoned tool descriptions, and the official registry does not scan server code.
What is the difference between MCP and A2A? MCP connects a model to tools and data. A2A connects separate agents to each other. Both are now Linux Foundation projects and are often used together.
Sources and further reading
Where the figures and rules above come from, so you can check them:
- Specification 2026-07-28, overview and security principles: Model Context Protocol
- Transports: stdio and Streamable HTTP: Model Context Protocol
- The 2026-07-28 release candidate, stateless protocol and lifecycle policy: MCP project blog
- MCP joins the Agentic AI Foundation (9 December 2025): MCP project blog
- The MCP Registry: preview status, namespaces and security scanning: Model Context Protocol
- Research note on MCP tool poisoning and IDE auto-execution (1 July 2026): Cloud Security Alliance
- Build an MCP server quickstart: Model Context Protocol
Photo credits: Home server equipment by Alan Levine, CC BY 2.0, via Wikimedia Commons. AMS-IX optical patch panel by Fabienne Serriere, CC BY-SA 3.0, via Wikimedia Commons.
Join the discussion