Signum
Learn

What is MCP? The Model Context Protocol explained

By Elliot Marsh, Editor · · 4 min read

If you follow AI news, you will have seen "now supports MCP" attached to more and more products. In October, for example, Apple said Pages, Keynote and Numbers on macOS 27 support the Model Context Protocol so that third-party AI agents can work with them. So what is it, and why does it matter?

The short version

The Model Context Protocol (MCP) is an open standard for connecting AI applications to external tools and data. Instead of every AI assistant building its own custom integration for every service, a service can offer one MCP server, and any MCP-compatible AI app (a client) can use it.

Anthropic introduced MCP in November 2024 and published it as an open specification. It has since been adopted widely across the industry. The official site often compares it to a USB-C port for AI: one standard connector instead of a drawer full of adapters.

The problem it solves

A language model on its own can only produce text. To be useful it needs to read files, search a database, create a calendar event or open a ticket. Before MCP, each of those connections had to be built separately for each AI product: one Slack integration for assistant A, another for assistant B, and so on. With M assistants and N tools, that is M times N integrations.

MCP turns that into M plus N: each assistant implements the client side once, each tool implements a server once, and they all work together.

How it works

MCP has three roles.

  • Host: the application the user interacts with, such as a desktop AI assistant, a code editor or an agent platform.
  • Client: the component inside the host that keeps a connection to one server.
  • Server: a program that exposes capabilities from some system, such as a file system, a database, GitHub or a design tool.

Messages between client and server use JSON-RPC 2.0. Servers can run locally (talking over standard input and output) or remotely over HTTP.

A server can offer three main kinds of capability:

  1. Tools: actions the model can call, each with a name, description and input schema, for example create_issue(title, body).
  2. Resources: data the application can read and give to the model, such as files, records or documents.
  3. Prompts: reusable templates for common tasks that the user can pick.

When the host connects, it asks the server what it offers. The tool descriptions are given to the model, which can then decide to call a tool. The host runs the call through the client, gets the result and passes it back to the model.

What MCP is not

  • Not a model. MCP does not make a model smarter; it gives it reach.
  • Not an agent framework. It is the plumbing agents use to reach tools, not the logic deciding what to do.
  • Not a security boundary on its own. Whether a tool call needs approval, and what data a server can see, is up to the host and the server.

Why it matters

For users, MCP means the same tools can follow you across assistants. For companies, one server makes a product usable from many AI apps at once, which is why software makers are rushing to publish them. For the AI industry, it is one of the few areas where competitors have converged on a shared standard rather than rival walled gardens.

The security catch

Connecting a model to tools gives it power, and MCP makes connecting easy. The main risks:

  • Prompt injection through tool results. If a tool returns text from an email, web page or document, that text can contain instructions. A model may follow them, for example by calling another tool to send data elsewhere.
  • Malicious or compromised servers. A server is code you run or trust. A bad one, or a good one whose update is hijacked, can misuse whatever access it has. Recent supply-chain incidents with AI editor extensions show this is not theoretical.
  • Over-broad permissions. A server with write access to your whole drive or inbox turns a small mistake into a big one.
  • Tool descriptions as an attack surface. Descriptions are read by the model, so a server can try to steer it through them.
  • Context bloat. Every connected tool's description takes up space in the model's context window. Many servers with many tools can crowd out the actual task and raise costs.

Using MCP safely

  1. Install servers only from sources you trust, and pin versions where you can.
  2. Give each server the least access it needs; prefer read-only.
  3. Keep human approval on for actions that send, delete, pay or publish.
  4. Connect only the servers a task needs.
  5. Treat any content a tool returns as data, not instructions.

The bottom line

MCP is a common language between AI applications and the tools they use. It has made connecting assistants to real systems far easier, which is exactly why it deserves care: every server you add is new power for the model and a new way in for an attacker.

Sources