Jump to content

Model Context Protocol

From IdeaWazaWiki

Model Context Protocol (MCP) is an open protocol that lets AI assistants and agents connect to tools, data sources, and services through one common interface. Developers build against one shared standard instead of a separate integration for every service.

The problem it addresses

A language model knows only its training data and its current prompt. To read a file or query a database, an assistant needs a connection to that system, and each AI application once needed its own connector for each source. Its announcement called this a problem of fragmented integrations.[1]

Ten applications and ten services could need one hundred custom connectors. With a common protocol, twenty pieces suffice. The official site compares MCP to a USB-C port for AI applications.[2]

Origin and governance

Anthropic introduced MCP as an open standard on November 25, 2024.[1] Other vendors then adopted it. By December 2025 the Linux Foundation listed Claude, ChatGPT, Gemini, and Microsoft Copilot among supporting platforms.[3]

On December 9, 2025, the Linux Foundation announced the Agentic AI Foundation with MCP among its founding projects, as a neutral home for the protocol.[3] The specification has dated revisions, and 2026-07-28 was the latest on the official site in October 2026.[4]

How it works

A host is the AI application. It creates one client per server, each with a dedicated connection to that server, a program that provides context.[5]

Servers offer three kinds of features. Tools are functions the model can run, such as a database query. Resources are data, such as a file. Prompts are reusable templates.[5] Messages use JSON-RPC 2.0, a small standard for requests and replies in JSON.[6] A client lists what a server offers, calls a tool, and returns the result to the host. In revision 2026-07-28 each request carries its own version and capabilities.[4]

Two standard transports carry the messages. With stdio, the client launches a local subprocess and exchanges messages over its standard streams. With Streamable HTTP, each message is an HTTP POST, which suits remote servers.[7]

Authorization is optional. For HTTP the specification builds on OAuth 2.1, where the client obtains an access token. For stdio, implementations should instead read credentials from the environment.[8]

Function calling and REST

Function calling is a feature of model APIs: an application describes functions, the model asks to call one, the application runs code, and the result returns to the model.[9] MCP sits one layer outside that loop. It standardizes how an application finds and runs tools in separate programs, then offers them to its model.[5]

A REST API exposes resources over HTTP for developers who read its documents. An MCP server may wrap such an API, since tools can call APIs.[10] It adds machine-readable tool descriptions that an application can discover at run time. The two work as layers.

Google created the Agent2Agent protocol, known as A2A, and the Linux Foundation launched it as a project in June 2025.[11] The A2A site describes MCP as agent-to-tool communication and A2A as agent-to-agent communication, and calls them complementary.[12]

The llms.txt proposal is simpler: a site publishes a Markdown file at /llms.txt with an overview and links for models to read on demand.[13] A robots.txt file asks crawlers to avoid certain paths, and the standard says these rules are not a form of access authorization.[14] So robots.txt says what to skip, llms.txt says what to read, and MCP defines how to act.

Benefits for local models

A chat tool that runs a local model and supports MCP can use many of the same servers as cloud assistants. A server for a notes folder can run on the same computer over stdio, so data can stay there. A person can change the model and keep the tools. The goose agent framework is a local-first example.[3] Small local models may pick tools less reliably, so begin with read-only tools. See Running AI models locally.

Security and privacy concerns

The specification says tools represent arbitrary code execution, tool descriptions are untrusted unless they come from a trusted server, and hosts must obtain explicit user consent before invoking any tool.[4] Prompt injection is the central risk, because text a model reads, such as a tool description, can contain instructions the user never wrote.[15]

  • Least privilege. Grant each tool and token only the access a task needs. The security guide warns against wildcard scopes.[16]
  • Human approval. The tools specification says a human should be able to deny calls.[10] Keep consequential actions, such as sending, spending, deleting, or publishing, behind approval.
  • Token handling. Tokens must not appear in a URL query string, and a server must accept only tokens issued for itself.[8]
  • Local servers. They run with the client's privileges, so the guide advises showing the exact command and using a sandbox.[16]
  • Privacy. A connected server sees what the host sends it, so connect only what a task needs.

Connections to this wiki

Agent-to-agent commerce covers agents that find each other, agree on terms, and pay. MCP covers how an agent reaches tools. Agent allowlists for spend and publish proposes human-written limits that suit tool permissions. A guide to this wiki for AI agents explains how agents can read and cite pages here. Open research shows why open specifications aid learning. Running AI models locally covers the local side.

Discussion questions

  • Which tasks would you let an assistant do through a tool without asking, and which need approval?
  • What should a tool description show so that a person can judge it?

Essay ideas

  • Compare MCP, function calling, and a plain REST API, and say when each fits best.

AI prompt ideas

  • Explain hosts, clients, and servers with a kitchen analogy, then quiz me with five questions.
  • Help me write a least privilege checklist for connecting a notes folder to a local model.

Readings from Wikipedia

See also

References

  1. ↑ 1.0 1.1 Introducing the Model Context Protocol, Anthropic
  2. ↑ What is the Model Context Protocol, modelcontextprotocol.io
  3. ↑ 3.0 3.1 3.2 Linux Foundation announces the Agentic AI Foundation, December 9, 2025
  4. ↑ 4.0 4.1 4.2 MCP specification, revision 2026-07-28
  5. ↑ 5.0 5.1 5.2 MCP architecture overview
  6. ↑ JSON-RPC 2.0 specification
  7. ↑ MCP specification, transports
  8. ↑ 8.0 8.1 MCP specification, authorization
  9. ↑ Function calling, OpenAI API documentation
  10. ↑ 10.0 10.1 MCP specification, tools
  11. ↑ Linux Foundation launches the Agent2Agent protocol project, June 23, 2025
  12. ↑ A2A Protocol
  13. ↑ The /llms.txt file, llmstxt.org
  14. ↑ RFC 9309, Robots Exclusion Protocol
  15. ↑ Model Context Protocol, Wikipedia
  16. ↑ 16.0 16.1 MCP security best practices
Retrieved from "https://ideawaza.com/index.php?title=Model_Context_Protocol&oldid=92293"