What Is MCP? The Model Context Protocol, Explained for 2026

MCP (Model Context Protocol) is an open standard for connecting AI applications to external tools and data. An AI app such as Claude, ChatGPT, Cursor or VS Code connects to an MCP server, asks which tools it offers, and lets the model call them over JSON-RPC. Anthropic introduced MCP in November 2024; it is now governed under the Linux Foundation, and the current spec version is 2026-07-28.

That is the short answer. The rest of this page covers how it works, what changed this year, who runs it, how it compares with APIs, function calling and A2A, and what to watch for on security.

MCP at a glance

• Full name: Model Context Protocol.
• Introduced: by Anthropic on November 25, 2024.
• Governed by: the Agentic AI Foundation (AAIF) under the Linux Foundation, since December 9, 2025.
• Current spec: 2026-07-28.
• Wire format: JSON-RPC 2.0.
• Standard transports: stdio (local) and Streamable HTTP (remote).
• Official SDKs: TypeScript, Python, C#, Go, Rust and Ruby at Tier 1, plus Java, Swift, PHP and Kotlin (SDK list, October 2026).
• Clients: Claude apps and Claude Code, ChatGPT, Cursor, VS Code with Copilot, Gemini CLI, OpenAI Codex, Devin Desktop (formerly Windsurf), Zed, Cline and many more.

Why MCP exists

Before MCP, every AI app that wanted to reach an outside system needed its own integration. Anthropic's launch post put it plainly: "Every new data source requires its own custom implementation, making truly connected systems difficult to scale."

Call it the N×M problem. With N AI applications and M tools, you need N×M connectors, each with its own auth, schema and bugs. With a shared protocol, each app implements the client side once and each tool implements the server side once, so the work drops to N + M. GitHub writes one server, and it works in Claude Code, Cursor and Codex without either side knowing about the other.

The official docs use a hardware analogy: "Think of MCP like a USB-C port for AI applications." The analogy is useful but incomplete. A USB-C port does not decide which device to use. With MCP, a language model reads tool descriptions and decides what to call, which is why security gets its own section below.

How MCP works

MCP has three participants:

• Host: the AI application you use, such as Claude Code, Cursor or ChatGPT. It runs the model and manages connections.
• Client: a component inside the host that holds a connection to one server. The host creates one client per server.
• Server: a program that exposes capabilities, such as GitHub's server, a database server, or a script you wrote.

Under that sit two layers. The data layer defines the JSON-RPC messages: discovery, the primitives below, and notifications. The transport layer defines how those messages travel.

Server primitives

Servers offer three kinds of things, and the spec defines each by who controls it:

In practice, tools do most of the work. Most clients support them; support for resources and prompts varies by client.

Client features and extensions

Servers can also ask the client for things. The main one is elicitation, where a server asks the user for more information mid-request. It has two modes. Form mode collects structured input through the client's UI. URL mode sends the user to a web page for anything sensitive, because servers must not request passwords, API keys or payment details through form mode.

The 2026-07-28 spec deprecates three older client features: sampling (asking the client's model for a completion), roots (telling the server which directories matter) and logging. They still work during a deprecation window of at least twelve months.

Optional extensions sit on top of the core. The first official one, MCP Apps, launched on January 26, 2026 and lets tools return interactive UI that renders in the conversation. Tasks (durable handles for long-running work) became an extension in 2026-07-28.

Local vs remote MCP servers

MCP defines two standard transports, in the spec's words (transports):

• stdio: "newline-delimited messages over the standard streams of a client-launched subprocess."
• Streamable HTTP: "each message is an HTTP POST to a single MCP endpoint; replies arrive as a JSON object or a request-scoped SSE stream."

A local server runs on your machine as a child process of the client. It suits tools that need your filesystem or a local browser, like Playwright, and it gets credentials from environment variables. It also runs with your user's privileges, so you are trusting its code.

A remote server is a URL. It suits SaaS products such as GitHub, Notion, Linear and Stripe, where the vendor hosts the server, handles OAuth sign-in, and serves many clients at once. Most vendor servers are remote now.

The older HTTP+SSE transport has been deprecated since the 2025-03-26 spec. If a guide tells you to connect to an /sse URL, it is out of date. For the per-client config syntax (Claude Code, Cursor, Codex, VS Code, Gemini CLI and others), see our remote MCP server setup guide.

A request, end to end

Here is one real remote server, followed through a single call. We use AlertMCP, our own server, because it shows both a plain tool call and the limits of in-band questions.

1. Connect. One command registers the server with Claude Code:

claude mcp add --transport http alertmcp https://api.alertmcp.com/mcp --header "Authorization: Bearer amcp_sk_…"

2. Discover. The client sends tools/list. The server returns each tool's name, description and a JSON Schema for its inputs. Under the current spec, a client may first call server/discover to learn the server's supported versions and capabilities in one request. The host hands the tool definitions to the model.

3. Call. You ask the agent to tell you when a migration is ready. The model picks the notify tool, and the client sends a tools/call request. Under the 2026-07-28 spec, every request carries its protocol version and the client's capabilities in _meta (simplified here):

{
  "jsonrpc": "2.0",
  "id": 7,
  "method": "tools/call",
  "params": {
    "name": "notify",
    "arguments": {
      "title": "Migration ready",
      "body": "12 tables changed. Tests pass on the staging copy.",
      "priority": "high",
      "topic": "deploys"
    },
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientCapabilities": { "elicitation": {} }
    }
  }
}

4. Result. The server replies with "resultType": "complete" and a content array, usually text. The host adds it to the model's context, and the model carries on.

Questions are more interesting. With elicitation, a server can pause a tool call and ask you something, but the answer has to come through the client UI in front of you. If you have walked away from the terminal, nobody answers. An out-of-band tool works differently. AlertMCP's ask sends the question to your phone, and the agent then calls get_answer, which waits up to 50 seconds and returns "pending" if you have not replied, so the agent loops until you tap a button or the deadline passes. Both are valid MCP; they solve different problems. Our Claude Code notifications guide covers that setup.

What changed in the 2026-07-28 spec

The 2026-07-28 release is the biggest revision so far. The announcement put it this way: "The highlight of this release is a stateless protocol core." Most explainers written before mid-2026 describe the old design. The main changes, from the changelog:

• No handshake, no sessions. The initialize exchange and the Mcp-Session-Id header are gone. Every request declares its protocol version and client capabilities in _meta, so any server instance can answer any request. Servers that need state across calls return an explicit handle as a normal tool argument.
• server/discover is mandatory. Servers must implement it to advertise versions, capabilities and identity. Clients may call it, or just send a request and handle a version error.
• Multi Round-Trip Requests. Servers no longer send requests to clients. When a server needs input (an elicitation, for example), it returns an InputRequiredResult, and the client retries the original request with inputResponses and an opaque requestState.
• Subscriptions. A single subscriptions/listen stream replaces the HTTP GET endpoint and resources/subscribe for change notifications.
• Tasks moved out of the core into the io.modelcontextprotocol/tasks extension, and ping was removed.
• HTTP details. Streamable HTTP requests carry Mcp-Method and Mcp-Name headers, and list results carry ttlMs and cacheScope caching hints.
• Deprecations. Roots, Sampling and Logging; the HTTP+SSE transport; and Dynamic Client Registration, in favor of Client ID Metadata Documents. Each gets at least twelve months before removal.

If you only use MCP servers, nothing changes for you. If you run one, upgrade your SDK: stateless servers scale behind an ordinary load balancer without sticky sessions, and the spec defines a backward-compatibility path for clients and servers still on the handshake-based versions.

For context, here is how the spec got here:

Who governs MCP

Anthropic created MCP, but it no longer controls it alone. On December 9, 2025, the Linux Foundation formed the Agentic AI Foundation with three founding projects: MCP from Anthropic, goose from Block and AGENTS.md from OpenAI. The launch Platinum members were AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI.

The foundation has grown fast. Google's Agent2Agent protocol (A2A) joined on August 17, 2026. On October 22, 2026, AAIF reported 305 member organizations and 10 hosted projects.

Day-to-day technical decisions stay with MCP's own maintainers, and Anthropic said at the move that the governance model would remain unchanged. Per the governance page, Lead Maintainers David Soria Parra and Den Delimarsky hold final authority, a group of Core Maintainers steers the spec, and seats belong to individuals, not companies. Spec changes go through Specification Enhancement Proposals (SEPs), which anyone can write.

How widely MCP is used

Adoption numbers get repeated without dates, so here they are with dates and sources. They measure different things and should not be compared directly.

Client support is the more useful measure. Anthropic's December 2025 announcement already listed ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code as adopters. The MCP Registry is still in preview, and it lists servers without curating or security-scanning them.

MCP vs APIs, function calling and A2A

These four get confused because they overlap. They sit at different layers.

MCP vs API. An MCP server usually wraps an API. The API is still there; MCP adds a standard way for an AI client to discover what it can do, with descriptions the model can read, a common auth model and a common transport.

MCP vs function calling. Function calling (Anthropic calls it tool use) is how a model asks to run a function. MCP is where the functions come from. A host takes the tools it discovers over MCP and passes them to the model as function definitions. Model APIs now accept MCP servers directly: Claude's MCP connector (in beta) takes remote servers in the Messages API, and OpenAI's Responses API has an mcp tool type with a require_approval setting.

MCP vs A2A. The AAIF describes them as complementary: MCP covers how an agent reaches tools and data, and A2A covers how one agent delegates work to another. Both are now AAIF projects.

Is MCP secure?

The protocol gives you good building blocks; it does not make a server trustworthy.

What the spec defines (authorization):

• Authorization is optional, but HTTP servers that implement it follow an OAuth 2.1-based flow and must publish OAuth Protected Resource Metadata (RFC 9728).
• Tokens go in the Authorization: Bearer header on every request, never in the URL query string.
• Servers must reject tokens that were not issued for them, and passing a client's token through to another API is forbidden.
• Local stdio servers should not use this flow and instead read credentials from the environment.
• There should always be a human able to deny tool invocations, and clients must treat a server's own tool annotations (such as "read-only") as untrusted unless the server is trusted.

What the spec cannot fix:

• Prompt injection. Tool results (an issue body, a web page, a database row) can carry instructions aimed at the model. Treat everything a tool returns as data.
• Tool poisoning and supply chain. The OWASP Top 10 for Agentic Applications lists Agentic Supply Chain Vulnerabilities as ASI04, with examples including hidden instructions in MCP tool descriptions and a malicious npm package that impersonated postmark-mcp to copy emails to an attacker (September 2025).
• Local server compromise. A local server runs with your privileges, so a bad install command can read your SSH keys. The MCP security best practices require clients to show the exact command before a one-click install.
• Excessive agency. OWASP's LLM Top 10 lists it as LLM06:2025: a model given more permissions than its task needs.

The practical rules are short: connect vendor-maintained servers, give each the narrowest token that works, start in read-only mode, pin local server versions, and keep a human approval step on writes. Our guide to human-in-the-loop AI agents covers when to ask and how.

How to start using MCP

1. Use a client you already have. Claude Code, Cursor, VS Code, Codex, Gemini CLI, ChatGPT and the Claude apps all support MCP.
2. Add one vendor-maintained server. In Claude Code, claude mcp add --transport http notion https://mcp.notion.com/mcp, then run /mcp to sign in. In ChatGPT, custom servers go in at chatgpt.com/plugins, under + and Add custom MCP server; our ChatGPT MCP guide walks through it. In claude.ai, use Customize > Connectors > + Add > Add custom connector.
3. Look at what it exposes. The MCP Inspector lists a server's tools and lets you call them by hand:

npx @modelcontextprotocol/inspector --server-url https://mcp.context7.com/mcp --transport http

4. Pick the next few deliberately. Three to six servers per project is plenty for most people. Our list of the best MCP servers in 2026 has install commands and read-only settings for ten.
5. Build your own when nothing fits. The official SDKs handle the protocol, so a useful server can be a few dozen lines that wrap an API you already call.