What is MCP (Model Context Protocol)?

The working definition

MCP is an open protocol that lets an AI application discover and call external tools and data sources through one standard interface instead of a custom integration per model.

Anthropic published it as an open standard in November 2024 and handed stewardship to the Agentic AI Foundation in December 2025, so it is now governed as a vendor-neutral spec. Google's Agent2Agent protocol, which covers agent-to-agent communication rather than agent-to-tool, joined the same foundation in August 2026, which puts both halves of the interoperability story under one governance roof. The practical effect: a connector you write once can be used by any client that speaks the protocol.

The problem it solves

Before a shared protocol, every combination of model and tool was its own integration. Five models and eight internal systems is forty pieces of glue, each with its own auth handling, schema, and error semantics, all of it rewritten when you switch providers.

MCP collapses that into one server per system and one client per model: thirteen integrations instead of forty. The count stops multiplying, and the tooling stops being hostage to the model you happened to start with.

How it works

Hosts, clients, and servers

The host is the AI application the person is using. It runs clients, and each client holds a connection to one server. A server exposes a specific capability: a database, a file store, a ticketing system, an internal API.

What a server exposes

• Tools: actions the model can invoke, with typed inputs and a described effect.
• Resources: data the application can read into context, such as files, records, or documents.
• Prompts: reusable, parameterized templates the server offers for common tasks.

Discovery

The client asks the server what it offers rather than having the list hard-coded. Adding a capability to the server makes it available to every connected client without shipping a new build of the assistant. For finding servers in the first place, a shared public directory of servers exists but is still in preview, so treat it as a directory, not a dependency.

Transports

Servers can run on the same machine as the assistant or remotely over the web. Remote servers sign in with the same standard authorization used by modern business apps, so no shared passwords. The transport has moved on more than once, and anything built on the original server-sent-events transport needs migrating.

The current specification revision is 28 July 2026, and its headline change is stateless operation: a server can answer each call on its own without holding a session open between them. That is what makes a remote server cheap to run behind ordinary web hosting, and it is the shape we use for our own connector. If your reference material stops at the 2025 revisions, it predates this.

When to use MCP, and when not to

Use it when

• More than one AI client needs the same capability.
• You expect to change models and want the tooling to survive the change.
• You want capabilities discoverable at runtime rather than baked into a prompt.
• An off-the-shelf server already exists for the system you are connecting.

Skip it when

One application calls one internal service on a fixed path. A direct function call is simpler, faster, and easier to reason about. A protocol you added for elegance rather than need is still a dependency you now maintain.

For a live example of the first case, our own connector is a remote MCP server any compliant client can add, with the tool list and the security posture published on the page.

MCP and Agent Skills

Anthropic also ships Agent Skills: a packaged set of instructions a model loads for a task. The name is Anthropic's, though the same packaging idea is appearing under other labels elsewhere. The two are complementary rather than competing. MCP exposes tools and data; a Skill teaches the model how and when to use them. In practice a well-built subsystem now ships as both, so it can be installed into whichever managed-agent runtime a client is on.

For the wider picture of how these pieces are run together, see AI operations.

Security is the part people skip

An MCP server is a permission surface. Connecting one hands a model the ability to act inside a system on your behalf, so treat it with the seriousness of any other integration credential.

• Scope every server to the narrowest set of actions the job needs. Read-only unless writing is the point.
• Treat tool output as untrusted input. Content returned by a tool can carry instructions aimed at the model, and prompt injection through tool responses is a live attack path.
• Keep irreversible actions behind human approval no matter how reliable the loop has been.
• Log every tool call with its arguments so an unexpected outcome can be traced rather than guessed at.
• Vet third-party servers before installing them, the same way you would vet any dependency with credentials attached.

Those guardrails are what separates a demo from a system. See AI agents for where the approval step belongs in the loop.

Related guides

• What are AI agents?
• What is AI operations?
• What is an intelligence layer?
• All Nova3 AI guides

For reviewed frontier changes with dates and first-party sources, see Current State. For how Nova3 scopes, builds, and runs this work as a service, see AI operations.

Need your internal systems reachable by any model you run?