What Is MCP (Model Context Protocol)? A Plain-English Guide

What problem does MCP solve?

MCP removes the need to build a separate connector for every pair of AI app and business system. Before it, connecting an assistant to your helpdesk meant code written for that one assistant. Anthropic's announcement describes the old state plainly: "Every new data source requires its own custom implementation."

With MCP, you describe your system once, as a server, and any AI app that speaks the protocol can use it. One piece of work can serve the team on Claude, the team on ChatGPT and the developers in VS Code.

MCP does not make a model smarter, and it does not decide how the AI uses what it gets. The architecture overview says MCP "focuses solely on the protocol for context exchange". Quality still depends on the model, the tool design and the data behind it.

How do the MCP host, client and server fit together?

The host is the AI app you use, the client is a connector the host creates inside itself, and the server is the program that offers capabilities. The architecture overview says the host creates one client for each server it connects to, and each client keeps its own dedicated connection.

Messages between client and server use JSON-RPC 2.0, a small, widely used format for requests and replies. They travel over one of two transports:

• stdio: the host starts the server as a local process on the same computer and talks to it through standard input and output. This is a "local" server, usually for one person.
• Streamable HTTP: the server runs on the internet or your network and many clients reach it by URL. This is a "remote" server. The overview says it supports bearer tokens, API keys and custom headers, and that "MCP recommends using OAuth to obtain authentication tokens."

The model never logs in to your system. The server holds the credentials and runs the action, so the server is where every limit belongs.

What do MCP tools, resources and prompts do?

They are the three things a server can offer: tools let the AI act, resources give it data to read, and prompts are templates a person picks. The server concepts page separates them by who is in control:

Tools turn a chat assistant into an agent that does things, which is also why the risk sits there. Each tool has a name, a description and a JSON Schema for its inputs.

What happens when an AI app calls an MCP tool?

The client lists the server's tools, the model picks one, and the client sends a tools/call request and passes the result back to the model. In order:

1. The client sends tools/list and the host gives the tool descriptions to the model with the question.
2. The model decides a tool is needed and fills in the arguments.
3. The host should show the call and ask the user to allow it.
4. The client sends tools/call; the server checks the input, runs the action and replies.

This is the request from the tools page of the specification, shortened the way the spec does (a real request also carries a _meta block with the protocol version and client details):

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "get_weather",
    "arguments": { "location": "New York" }
  }
}

The reply carries a content array of text the model reads, plus isError. Step 4 matters most. The same page says "there SHOULD always be a human in the loop with the ability to deny tool invocations."

Which AI apps support MCP servers?

Claude, ChatGPT, VS Code and Cursor all document MCP support, but they connect in different ways. This is what each vendor's own page said on 3 November 2026:

I list only the four whose documentation I read. Before a build, check that your staff's apps accept the transport and sign-in you plan.

What is MCP useful for in a business?

MCP pays off when people ask varied questions of your systems from inside an AI app. Typical uses I scope:

• Staff questions across data: "Which clients have unpaid invoices over 30 days and an open ticket?" answered from live data, not a stale export.
• Product access for your customers: a SaaS product that lets its users work with their own account from inside Claude or ChatGPT, signed in as themselves.
• One tool layer for several agents: the same server used by Claude, ChatGPT and an agent you build yourself.

For a worked example in one product, my WHMCS MCP server guide compares the modules and packages that exist, which API actions to expose first and how to keep money and services behind approval. My AI chatbot vs AI agent guide explains where tool use fits.

Do you need an MCP server or a normal API integration?

If a task runs the same way every time, a normal API integration or webhook is cheaper and easier to test than MCP. MCP earns its place when the request changes each time and a person is asking.

1. Does the job run the same way every time? Yes: use a normal API integration.
2. Will people ask varied questions in an AI app? No: skip MCP for now.
3. Does the software vendor host its own MCP server? Yes: use the vendor's server. OpenAI's page gives the example of connecting to the Stripe server hosted by Stripe instead of an unofficial copy.
4. Is read-only access enough to start? Yes: build a read-only MCP server. No: build it with a person approving every write.

Often the answer is both: an integration for fixed jobs and a small read-only server for the questions.

What does it cost to build an MCP server?

The cost depends on how many tools you need, how users sign in and how many write actions need approval, not on MCP itself. My planning hours and token bills for AI agents, including tool work, are in my AI agent development cost guide. What moves the number:

What are the security risks of MCP?

The main risks are prompt injection, tools with more permission than the job needs and careless handling of tokens. The spec is frank that "MCP itself cannot enforce these security principles at the protocol level", so the limits live in your server and your system. These rows come from the MCP security guidance, the local server security page and OpenAI's MCP page:

The spec's tools page adds four duties every server MUST meet: validate all tool inputs, implement proper access controls, rate limit tool invocations and sanitize tool outputs. It also says tool annotations, such as a read-only flag, must be treated as untrusted unless the server is trusted. So a label is not a control; the credential behind the tool is.