MCP, short for Model Context Protocol, is an open standard that lets AI applications connect to outside tools and data, such as files, calendars, databases, and business software, through one common method. Anthropic introduced it in November 2024, and since December 2025 it has been part of the Agentic AI Foundation, a fund under the Linux Foundation.
The project describes MCP as a USB-C port for AI applications: one standard plug instead of a custom cable for every device. You do not need to be a programmer to understand it, and this guide explains it without the jargon, checked against the official MCP documentation and Anthropic's own announcements.
If the word "agent" is still fuzzy, start with our plain-English guide to what an AI agent is. MCP is one of the main ways agents get connected to the real world.
What Does MCP Stand For?
MCP stands for Model Context Protocol. Each word does work:
- • Model refers to the AI model, usually a large language model, inside an application like Claude or ChatGPT.
- • Context is the information and capabilities the model needs to do a job: your files, your records, the actions it is allowed to take.
- • Protocol means an agreed set of rules for how two pieces of software talk to each other, the same way web browsers and websites follow shared rules.
Put together, MCP is a shared set of rules for giving AI models the context and tools they need, in a way that works across many different apps.
Why Was MCP Created?
A language model on its own only knows what it learned in training and what you type into the chat. It cannot see today's appointments, look up a customer record, or open a spreadsheet unless someone connects it to those things. Before MCP, each of those connections was a custom job, built one way for one AI app and rebuilt another way for the next.
MCP replaces that patchwork with a common language. In Anthropic's announcement, MCP was described as "a new standard for connecting AI assistants to the systems where data lives, including content repositories, business tools, and development environments." Build an MCP connection to a service once, and any AI application that supports MCP can use it.
How Does MCP Work?
MCP has three roles. The names sound technical, but the idea is simple.
- • The host. The AI application you actually use, such as Claude Desktop, ChatGPT, or a code editor with an AI assistant. The host is in charge and decides what gets connected.
- • The client. Inside the host, a connector called a client maintains the link to one outside service. If the host connects to three services, it runs three clients.
- • The server. An MCP server is a program that offers something useful to the AI: access to company files, a database, a project tracker. A server can run on your own computer or on the internet.
Servers can offer three kinds of things, which the specification calls features:
- • Tools. Actions the AI can take, such as searching records, creating a calendar event, or running a query. This is MCP's version of tool use.
- • Resources. Information the AI or the user can read for context, such as file contents or database records.
- • Prompts. Reusable templates that structure a common task, like a saved set of instructions.
Clients can also offer a feature back to servers called elicitation, which lets a server ask the user for more information it needs to finish a request.
Under the hood, both sides exchange messages in a standard format called JSON-RPC 2.0. Servers on your own machine usually talk over a local channel called stdio. Remote servers use a method called Streamable HTTP, and the specification defines an authorization process built on OAuth, the same "sign in and approve access" flow you see when you connect one app to another.
What Changed in the Current MCP Specification?
MCP's rules are published as dated versions. The current version at the time of writing is dated July 28, 2026, and it follows the November 25, 2025 version. The changes that matter most, in plain terms:
- • MCP is now stateless. The opening handshake and protocol-level sessions were removed. Each request now carries the version and capabilities it needs, which makes remote servers simpler to run and scale.
- • Some older features are being retired. Roots, Sampling, and Logging are deprecated, which means they still work for now but new implementations should not adopt them. The project's new policy gives deprecated features at least twelve months before removal.
- • Extensions are opt-in. Extra capabilities, such as Tasks for long-running jobs and MCP Apps for interactive elements like charts and forms inside a conversation, are optional extensions that both sides must agree to use.
- • Authorization was tightened. The update adds several security requirements for how clients handle sign-in and credentials.
None of this changes what MCP is for. If you use an MCP-connected assistant, you will mostly notice it as better reliability. If you build servers, read the specification changelog.
Who Maintains MCP Now?
Anthropic created MCP, but it no longer belongs to one company. On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, Amazon Web Services, Cloudflare, and Bloomberg.
Day-to-day technical decisions follow MCP's published governance model. Lead maintainers hold final decision authority, core maintainers steer the specification, and maintainers run areas like SDKs and working groups. Membership is held by individuals, not companies, and changes to the specification go through public proposals called Specification Enhancement Proposals, or SEPs. New code and specification contributions are licensed under Apache 2.0.
Which Apps Support MCP?
The official MCP site lists Claude, ChatGPT, Visual Studio Code, and Cursor among the applications that support it, and Anthropic's foundation announcement adds Gemini and Microsoft Copilot. In Claude, custom connectors built on remote MCP servers are available on Free, Pro, Max, Team, and Enterprise plans, with Free users limited to one connector, according to Anthropic's help center.
On the server side, many software vendors now publish official MCP servers for their products, and automation platforms such as Zapier offer MCP access to the apps they connect. Our step-by-step tutorial on using MCP walks through connecting your first server.
How Is MCP Different From an API?
An API is a door into one specific piece of software. Your CRM has an API, your calendar has an API, and each works differently. A developer has to learn each door and write code to go through it.
MCP does not replace those APIs. It usually sits on top of them. An MCP server often calls a normal API behind the scenes, then presents it to the AI in the standard MCP format. The specification says it took inspiration from the Language Server Protocol, which did the same job for programming languages across code editors.
A simple way to put it: an API is how software talks to software. MCP is how AI applications discover what a piece of software can do and use it in a consistent way.
How Does MCP Relate to AI Skills and AI Agents?
- • An AI agent is the worker: software that pursues a goal and decides what steps to take.
- • An AI skill is the know-how: a purpose-built capability for doing a specific job well. Our guide on what AI skills are goes deeper.
- • MCP is the plumbing: the standard connection that lets the agent reach the systems where the work happens.
An agent with skills but no connections can only talk. An agent with connections but no skills can reach everything but does not know what to do with it. MCP handles the reaching part without locking you to one vendor.
Is MCP Safe to Use?
MCP is a connection standard, and it is only as safe as what you connect and what you allow. The specification is direct about this: tools "represent arbitrary code execution and must be treated with appropriate caution," hosts must get explicit user consent before invoking any tool, and descriptions of what a tool does should be treated as untrusted unless they come from a trusted server.
Anthropic's guidance for connecting MCP servers to Claude applies to any MCP-connected assistant:
- • Only connect servers you trust. Use servers built and hosted by organizations you already trust with your data.
- • Watch for prompt injection. Anthropic warns that malicious MCP servers may include hidden instructions that try to make the AI do things you did not intend.
- • Grant the smallest permissions that work. Review what a server asks for and limit the scope where you can.
- • Review actions before approving them, especially anything that sends, deletes, pays, or changes records.
The MCP project's security best practices add points worth knowing even if you never build a server:
- • Local servers run with your permissions. A server installed on your computer can reach what you can reach, so installing one from an unknown source is as risky as installing any unknown program. The guidance says clients offering one-click setup must show the exact command and get your approval first.
- • Broad access widens the damage. Granting a server every permission up front means a leaked credential exposes everything. Start narrow and add access only when a task needs it.
- • Credentials should not be passed through. Servers must not accept access tokens that were issued for some other service, a practice the guidance calls token passthrough.
Clear guardrails on what an agent may do with its connections matter as much as the connections themselves.
Does My Business Need MCP?
Most small businesses will never set up MCP directly, and that is fine. You benefit from it when the AI tools you already use connect to your calendar, inbox, files, or CRM through it.
It deserves your attention in three situations: when you want an AI assistant to work inside your own systems rather than only answer questions, when you are choosing AI tools and want to avoid lock-in, and when you are having custom agents built, since asking whether they use MCP is a quick test of whether the work will be portable.
The practical starting point is small. Pick one system you wish your assistant could see, check whether the vendor offers an official MCP server or connector, connect it with read-only access first, and widen permissions only after it has earned your trust.
Sources
- • Model Context Protocol: Specification (version 2026-07-28)
- • Model Context Protocol: Key changes in 2026-07-28
- • Model Context Protocol: Governance and stewardship
- • Model Context Protocol: Security best practices
- • Anthropic: Introducing the Model Context Protocol
- • Anthropic: Donating MCP and establishing the Agentic AI Foundation
- • Claude Help Center: Custom connectors using remote MCP
Tell us what is costing you the most time. We will map out exactly what your business needs. Free, no obligation.
Build An Agent