An MCP server is a small program that gives an AI assistant a safe, structured way to use an outside system. It sits between the assistant and a tool such as a database, a CRM or a folder of files, and it publishes a list of actions the assistant is allowed to call. MCP stands for Model Context Protocol, an open standard for those connections.
The short version: without an MCP server, an AI assistant only knows what you paste into it. With one, it can go and look.
Why the protocol exists
Before MCP, every AI product built its own connector for every tool. Ten assistants and ten tools meant a hundred separate integrations, each with its own authentication and its own quirks. Nothing was reusable.
MCP splits that in two. The tool owner writes one server. The assistant vendor writes one client. Any client can then talk to any server. Ten plus ten replaces ten times ten.
The three parts
The host
The application you actually use: a chat client, an IDE, an agent runner. It manages connections and decides what the assistant is permitted to do.
The client
The piece inside the host that speaks the protocol. One client per server connection. You do not interact with it directly.
The server
The program that wraps the tool. It advertises what it can do and executes requests. This is the part people mean when they say “an MCP server”.
What a server exposes
An MCP server can offer three kinds of capability. Most offer the first.
| Capability | What it is | Example |
|---|---|---|
| Tools | Actions the assistant can call, with typed inputs | Create a CRM contact; run a SQL query |
| Resources | Data the assistant can read as context | A file; a database schema; a document |
| Prompts | Reusable templates the user can trigger | “Summarise this channel” |
When the assistant connects, it asks the server what it offers. The server replies with names, descriptions and input schemas. The assistant reads that list and chooses. Nothing about your specific tool is hard-coded into the model.
How a request actually flows
- You ask the assistant something that needs outside data.
- The assistant looks at the actions its connected servers advertise and picks one.
- The host checks permissions. Depending on configuration it may ask you to approve.
- The client sends the call to the server.
- The server talks to the real system using the credentials you gave it.
- The result comes back as structured data.
- The assistant reads the result and answers, or calls another action.
The important detail is step three. The assistant does not hold your credentials and cannot reach past what the server exposes. The server is the boundary.
MCP servers versus plugins and APIs
| Plain API | Vendor plugin | MCP server | |
|---|---|---|---|
| Who writes the integration | You do | The AI vendor | The tool owner, once |
| Works across assistants | Only where you build it | No | Yes |
| Assistant discovers actions | No | Partly | Yes, at connect time |
| Runs on your machine | If you build it that way | No | Yes, commonly |
| Credentials held by | You | The vendor | You |
An MCP server usually calls an API underneath. The difference is that the description of what is available is machine-readable and standard, so the assistant can work it out rather than being told.
What people use them for
- Code. Reading a repository, running tests, opening pull requests.
- Data. Querying a database in plain English against a schema the assistant has actually read.
- CRM and revenue. Answering pipeline questions and keeping records clean.
- Prospecting. Describing the buyer you want and getting back matching contacts with verified emails and mobile numbers.
- Files and documents. Working with a scoped folder instead of pasted excerpts.
- The web. Fetching a page and returning readable text.
If you want a concrete shortlist, see our guide to the best MCP servers.
How to run one
You do not need to write code to use an existing server. You add it to your host application’s configuration file with the command that starts it and any environment variables it needs, then restart the host. The server appears in the connected tools list, and you can ask the assistant to show you the actions it now has.
Servers run one of two ways. Locally, as a process on your own machine talking over standard input and output; nothing leaves the device except what the tool itself sends. Or remotely, over HTTP, for shared or hosted tools.
Security: what to actually worry about
- Credential scope. The server can do whatever its credential allows. A read-only database role and a restricted API key remove most of the risk.
- Write actions. Start every connection read-only. Add write access when you have watched it work.
- Untrusted content. If a server returns text from an outside source, treat that text as data rather than instructions. A malicious page can contain something that reads like a command.
- Where the server came from. Prefer official vendor builds and well-maintained community projects. A server runs with your permissions.
Frequently asked questions
What does MCP stand for?
Model Context Protocol. It is an open standard for connecting AI applications to external tools and data.
Is an MCP server the same as an API?
No. An API is the interface a tool exposes to any software. An MCP server is a wrapper that presents an API to an AI assistant in a standard, self-describing way. The server usually calls an API underneath.
Do I need programming skills to use one?
To use an existing server, no: it is a configuration change. To build a new one for a tool nobody has covered, yes.
Does an MCP server send my data to the model provider?
Only the results the assistant actually reads are included in the conversation, and those follow your assistant’s normal data policy. The server itself runs where you put it, and a local server keeps the connection to your tool on your machine.
Which assistants support MCP?
Support has spread across chat clients, coding tools and agent frameworks since the protocol was published. Because the standard is open, any application can implement a client.
How many can I connect at once?
There is no hard limit, but every server adds actions the assistant has to choose between. Three to six is a practical working range.
