What the Model Context Protocol is
The Model Context Protocol, or MCP, defines how an AI application talks to external systems. Without a standard, every pairing of an AI application and a system needs its own integration. With MCP, each system is wrapped once in a server, and any application that speaks the protocol can use it.
Anthropic open-sourced MCP on 25 November 2024. On 9 December 2025 it donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation that Anthropic co-founded with Block and OpenAI, with Google, Microsoft, AWS, Cloudflare and Bloomberg as supporters. At that point Anthropic counted more than 10,000 active public MCP servers.
The specification is published at modelcontextprotocol.io and versioned by date. The current version is dated 28 July 2026.
How an MCP server works
MCP has three roles. The host is the AI application a person uses, such as Claude or an IDE. Inside it, an MCP client holds the connection to one server. The MCP server is the program that exposes a system. A host can connect to many servers at once, one client for each.
Servers run in one of two ways. A local server runs on the same computer as the host and talks over stdio. A remote server runs as a web service and talks over Streamable HTTP, which replaced the older transport based on server-sent events in the March 2025 version of the specification.
| What a server offers | What it is | Who controls it | Example |
|---|---|---|---|
| Tools | Functions the model can call to fetch data or take an action | The model, with a person able to deny each call | Create a ticket, run a database query |
| Resources | Data the application can read and pass to the model | The application | A file, a customer record, a database schema |
| Prompts | Reusable templates for common tasks | The user | Summarise this account, review this contract |
Every tool comes with a name, a description and a schema for its inputs. The model reads these descriptions to decide which tool to use, which is why a few clear, narrow tools work better than one tool that does everything.
Examples of MCP servers in companies
A company usually ends up with one MCP server for each system it wants AI to work with. Typical ones:
- CRM: look up an account, read recent activity, log a call note.
- Documents: search contracts, policies and proposals, and read the passages that answer a question.
- Ticketing: open, update and route tickets in the service desk.
- Databases: run read-only queries for reports, with the schema exposed as a resource.
- Internal services: prices, stock, order status or approvals, behind the company’s own APIs.
Many vendors publish their own servers. In Claude, ready-made connectors cover tools such as Google Drive, Gmail, Google Calendar, GitHub, Microsoft 365 and Slack, and custom connectors reach any remote MCP server. Internal systems usually need a server built for them.
Which AI platforms support MCP
| Platform | How it uses MCP servers |
|---|---|
| Claude | Custom connectors to remote MCP servers in Claude, Cowork and Claude Desktop, on every plan from Free to Enterprise. On Team and Enterprise plans an Owner turns connectors on. |
| Claude Code | Local servers over stdio and remote servers over HTTP. |
| Claude API | The MCP connector, in beta, lets an API request use remote MCP servers. |
| ChatGPT | Developer mode gives full MCP client support on the web for Plus, Pro, Business, Enterprise and Education accounts. |
| OpenAI API | An MCP tool in the Responses API. |
| Microsoft | MCP in Copilot Studio, generally available since 29 May 2025. Native MCP support in Windows has been in public preview since 18 November 2025. |
| Gemini CLI supports MCP servers, and on 10 December 2025 Google announced managed remote MCP servers for Google Cloud services. | |
| Developer tools | Cursor and VS Code, among others, act as MCP clients. |
Because the protocol is the same everywhere, one well-built server can serve Claude today and another AI application tomorrow.
Security and governance
An MCP server can read and change real systems, so it deserves the same care as any integration with production data.
- Authorisation. For remote servers the specification uses OAuth 2.1: a protected server acts as a resource server, and clients obtain tokens issued for that specific server. A server must not accept tokens issued for anything else. Local servers take their credentials from the environment they run in.
- Untrusted descriptions. The model follows tool descriptions, so a malicious server can hide instructions in them, an attack Invariant Labs named tool poisoning in April 2025. The specification says to treat tool descriptions as untrusted unless they come from a trusted server.
- Least privilege. Give each server only the scopes it needs, start read-only, and require a person’s approval for actions that send, pay or delete.
- An approved list. Decide which servers people may connect, and review new ones before they are turned on.
- Logs. Record which tools were called, by whom and with what result.
Build an MCP server or use an existing one
Start with what exists. If the vendor of a system publishes an MCP server or a connector, it is usually the fastest and safest route. Build a custom server when the system is internal, when you need tighter control over what the model can do, or when an existing server exposes far more than you want.
A good custom server is small: a handful of tools with clear names and descriptions, inputs checked against a schema, error messages the model can understand, and sign-in through the company’s identity provider. Test it with the real tasks people will give the AI, not only with unit tests.
See how we build MCP servers and connectors for Claude Enterprise.
Sources
- Anthropic: Introducing the Model Context Protocol, 25 November 2024
- Anthropic: Donating the Model Context Protocol and establishing the Agentic AI Foundation, 9 December 2025
- Model Context Protocol specification, version 2026-07-28
- MCP specification: authorization
- MCP specification: security best practices
- Claude Help Center: about custom connectors
- OpenAI: developer mode and MCP in ChatGPT
- Microsoft: MCP generally available in Copilot Studio
- Google Cloud: official MCP support for Google services
- Invariant Labs: tool poisoning attacks on MCP