What is MCP (Model Context Protocol)? A Developer Guide for 2026

Quick definition: MCP (Model Context Protocol) is an open standard that lets AI applications connect to external tools and data through one shared interface, so a coding agent can read your repo, query your database, and file your tickets without a custom integration for each one. The official docs put it plainly: "MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems."¹

One-minute highlights

• Anthropic open-sourced MCP in November 2024, and the protocol moved to the Agentic AI Foundation under the Linux Foundation in December 2025.
• Everything runs over JSON-RPC 2.0 between three roles: hosts, clients, and servers.
• Servers expose three things: Resources, Prompts, and Tools.
• The 2026-07-28 spec made the core stateless, which is what let MCP servers move onto serverless and edge infrastructure.

If you have spent any time with AI developer workflows in the last year, you have hit the wall this protocol exists to remove: the agent is smart enough to do the work, but it cannot see the thing it needs.

---

What is the Model Context Protocol (MCP)?

MCP is plumbing. Boring, useful plumbing.

The official documentation defines it as "an open-source standard for connecting AI applications to external systems"¹ and then reaches for the analogy everyone repeats: "Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect electronic devices, MCP provides a standardized way to connect AI applications to external systems."¹

The analogy is fine but it undersells the actual problem. Before MCP, every AI app that wanted to read your Postgres database wrote its own Postgres integration. Every AI app that wanted your Figma files wrote its own Figma integration. Ten apps, ten services, a hundred bespoke connectors that all rot at different speeds. MCP collapses that into one protocol both sides implement once.

Anthropic announced it on 25 November 2024: "Today, we're open-sourcing the Model Context Protocol (MCP), a new standard for connecting AI assistants to the systems where data lives, including content repositories, business tools, and development environments."²

The part people miss is what happened next. In December 2025 Anthropic gave the protocol away. Per Wikipedia, "Anthropic donated the MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI, with support from other companies."³ That matters if you are deciding whether to build on it. A standard controlled by one model vendor is a bet on that vendor. A standard sitting in the Linux Foundation with OpenAI as a co-founder is a different risk profile.

One more framing worth stealing, from Brij Pandey on X: "MCP is often misunderstood. It is not an agent framework. It is not a reasoning engine. It does not provide governance automatically. It is standardized plumbing."⁴ Correct. It does not make your model smarter. It makes your model reachable.

---

How MCP works

Three roles, one message format. The specification is explicit: "The protocol uses JSON-RPC 2.0 messages to establish communication between: Hosts: LLM applications that initiate connections. Clients: Connectors within the host application. Servers: Services that provide context and capabilities."⁵

The design borrows from something most developers already trust. Per the spec, "MCP takes some inspiration from the Language Server Protocol, which standardizes how to add support for programming languages across a whole ecosystem of development tools."⁵ If you have ever wondered why your editor gets Go autocomplete without the editor authors ever learning Go, this is the same trick applied to AI context.

The three primitives

A server can offer three kinds of capability, and the spec's own definitions are worth memorizing because tutorials constantly blur them:⁵

• Resources: "Context and data, for the user or the AI model to use"
• Prompts: "Templated messages and workflows for users"
• Tools: "Functions for the AI model to execute"

Resources are read. Tools are do. Prompts are the workflows you would otherwise paste from a scratch file for the tenth time. Most servers in the wild lean almost entirely on Tools, which is a shame, because Resources are how you feed an agent a large body of reference material without pretending it is a function call.

Clients can offer capabilities back to servers too. The spec lists Elicitation: "Server-initiated requests for additional information from users."⁵ That is the mechanism behind a server pausing to ask you which environment to deploy to instead of guessing.

What changed in the 2026-07-28 spec

The current version is 2026-07-28, and it was a structural change rather than a feature drop. Anthropic's writeup lists three headline items:⁶

• "Stateless core. MCP moves from a bidirectional stateful protocol to a request/response model. Servers can now deploy on serverless and edge infrastructure."
• "Standardized extensions. MCP Apps and Tasks now ship under a versioned extensions framework, giving developers a formal path to add capabilities like interactive UIs and long-running work without changing the core protocol."
• "Auth hardening. Authorization now aligns with production OAuth 2.0 and OIDC deployments, so MCP servers connect to enterprise identity systems like Entra or Okta without workarounds."

If you tried MCP in 2025 and gave up because hosting a persistent stateful server for a five-second tool call felt absurd, that complaint is now fixed. The spec's key details section confirms the new shape: "JSON-RPC message format. Stateless, self-contained requests. Per-request capability negotiation."⁵

The extensions framework is the underrated half. Notable extensions now include Tasks ("Asynchronous execution of long-running operations, with polling, mid-flight input, and durable handles"), Skills over MCP, and MCP Apps ("Interactive UI elements (charts, forms, video players) rendered inline within conversations").⁵ Long-running agent work stops being a hack you build around the protocol.

---

Why MCP matters for coding agents

Adoption numbers first, since this is where most explainers stop at "it is growing fast" and cite nothing.

Anthropic reported in the 2026-07-28 release post: "MCP recently surpassed 400M monthly SDK downloads, a 4x increase this year, and has become the industry standard for connecting AI agents to applications."⁶ Same post on the connector side: "Claude now lists over 950 MCP servers in the connectors directory, used by millions of people every day."⁶

The developer-tool adoption started at launch. Anthropic's announcement named the first wave: "Early adopters like Block and Apollo have integrated MCP into their systems, while development tools companies including Zed, Replit, Codeium, and Sourcegraph are working with MCP to enhance their platforms."² Those are IDE and code-search companies, not enterprise CRM vendors. Coding was the beachhead.

Here is what it buys you day to day. The Claude Code docs list the tasks the protocol unlocks once servers are connected, and they read like a list of things you currently do by hand:⁷

• "Implement features from issue trackers: 'Add the feature described in JIRA issue ENG-4521 and create a PR on GitHub.'"
• "Query databases: 'Find emails of 10 random users who used feature ENG-4521, based on our PostgreSQL database.'"
• "Integrate designs: 'Update our standard email template based on the new Figma designs that were posted in Slack'"
• "React to external events: an MCP server can also act as a channel that pushes messages into your session, so Claude reacts to Telegram messages, Discord chats, or webhook events while you're away."

Notice the shape of those. None of them are "write me a function." They are all cases where the model already knows how to code and the bottleneck is that it cannot see your Jira, your database, or your Figma. That is the whole pitch. We covered how this landed in practice in the Claude Code updates writeup, and the same pattern shows up in narrower tools like the Apidog MCP server, which exists purely so your agent can read an OpenAPI spec without you pasting it.

Honestly, the first time a server saves you a copy-paste loop it feels like a party trick. The tenth time, you stop noticing, which is the actual sign it worked.

---

MCP vs function calling, RAG, and custom APIs

These get conflated constantly, and the distinction is not academic. They solve different layers.

Function calling is not the competitor people think it is. Your model still uses tool calling under the hood; MCP is the layer that decides which tools exist, where they live, and how the host talks to them. Wikipedia frames the history well: earlier approaches "solved similar problems but required vendor-specific connectors."³ That is the difference in one line. Write a Postgres MCP server once and Claude Code, Cursor, and whatever ships next quarter can all use it. Write a Postgres function-calling integration and you own it forever, per app.

RAG is orthogonal. RAG is a retrieval strategy; MCP is a connection standard. You can absolutely serve RAG results through an MCP Resource, and plenty of teams do.

---

Getting started: connect your first server

You do not need to build anything to start. Connecting an existing server takes about a minute.

1. Pick a host. Any MCP-capable app works. Claude Code is the fastest path for developers because the CLI has MCP management built in. Browse the AI coding tools directory if you want to compare hosts first.

2. Add a server. In Claude Code, remote servers from the Anthropic Directory are added with the CLI: the docs state you "can add any remote server listed there with claude mcp add."⁷

3. Verify before you connect. The same page carries the warning that matters most: "Verify you trust each server before connecting it. Servers that fetch external content can expose you to prompt injection risk."⁷ Read that twice. An MCP server is code you are handing your session to.

4. Ask for something that needs the server. Do not test with a question the model could answer alone. Ask it to read a specific ticket, or query a table, or list open PRs. If the answer is real, the connection works.

Building your own is a bigger topic, and the official quickstart at modelcontextprotocol.io walks the whole path. There is also a scaffolding shortcut: per the Claude Code docs, "You can also have Claude scaffold a server for you with the official mcp-server-dev plugin."⁷ Yes, you can vibe code the plumbing that lets you vibe code. The recursion is a little silly and it works.

---

Where to find MCP servers

Two places worth bookmarking, both official.

The reference implementations live in the modelcontextprotocol/servers repository on GitHub, alongside the official SDKs for TypeScript, Python, Java, Kotlin, C#, Go, PHP, Ruby, Rust, and Swift.⁸ There is also an official MCP Registry for discovery.⁹

For the first-party set, Anthropic's launch post is still the clearest list: "we're sharing pre-built MCP servers for popular enterprise systems like Google Drive, Slack, GitHub, Git, Postgres, and Puppeteer."² Those six cover a surprising share of real developer work: docs, chat, code, version control, data, and a browser.

I am deliberately not publishing a ranked table of "the 10 best MCP servers" here with links I cannot verify. Server quality changes weekly and half the lists circulating are copied from each other. Start from the registry and the reference repo, then judge each server by whether you would run its code with your credentials.

---

Security: the part that gets skipped

MCP hands an AI model the ability to execute things on your behalf. The specification does not pretend otherwise: "The Model Context Protocol enables powerful capabilities through arbitrary data access and code execution paths. With this power comes important security and trust considerations that all implementors must carefully address."⁵

The first key principle in the spec is user consent: "Users must explicitly consent to and understand all data access and operations. Users must retain control over what data is shared and what actions are taken."⁵ In practice that means approving tool calls rather than blanket-allowing a server, at least until you trust it.

The security best practices page documents the specific attack classes, and two are worth knowing by name:¹⁰

• Confused deputy. "Attackers can exploit MCP proxy servers that connect to third-party APIs, creating 'confused deputy' vulnerabilities. This attack allows malicious clients to obtain authorization codes without proper user consent."
• Token passthrough. Passing a token straight through an MCP server to a downstream API breaks the audit trail and the authorization boundary, which is why the spec calls it out explicitly.

Then there is prompt injection, which is the one that will actually bite a solo developer. A server that fetches web content can return text engineered to instruct your agent. The Claude Code docs put it bluntly: servers "that fetch external content can expose you to prompt injection risk."⁷

Practical rules I would hold to: run unfamiliar servers locally over stdio before you give them network reach, scope credentials to the narrowest role that works, and never connect a write-capable server to an agent you are not watching. Read-only first is not paranoia, it is just cheaper than the alternative.

---

FAQ

What is the Model Context Protocol? An open standard for connecting AI applications to external systems. Official docs: "MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems."¹

Who created MCP? Anthropic. The announcement went out on 25 November 2024: "Today, we're open-sourcing the Model Context Protocol (MCP), a new standard for connecting AI assistants to the systems where data lives."²

Who governs MCP now? The Agentic AI Foundation. Per Wikipedia, in December 2025 "Anthropic donated the MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI."³

How does MCP work? Over JSON-RPC 2.0, between hosts (the AI app), clients (connectors inside the host), and servers (the services exposing capabilities).⁵

What is an MCP server? A service that exposes Resources, Prompts, or Tools over the protocol. It can run locally on your machine or remotely, and since the stateless core landed it can run on serverless infrastructure.⁶

What are the three primitives? Resources ("Context and data, for the user or the AI model to use"), Prompts ("Templated messages and workflows for users"), and Tools ("Functions for the AI model to execute").⁵

Is MCP only for Claude? No. Wikipedia notes that after the announcement "the protocol was adopted by major AI providers, including OpenAI and Google DeepMind."³ Hosts across the coding-tool ecosystem support it.

Is MCP free? Yes. The protocol, spec, and official SDKs are open source.⁸ You still pay for model tokens and for whatever the connected service charges.

How is MCP different from function calling? Function calling is a per-model schema you supply in a request. MCP is a transport and discovery layer that lives outside the model, so a server written once works with any MCP-capable host.⁵

Can I run MCP servers locally? Yes, and for anything touching credentials or your filesystem it is the sane default. Local-first also means you can read the server's source before you run it.

---

Should you care yet?

If you write code with an agent, you already should. The gap between an agent that guesses at your schema and one that reads it is not subtle, and MCP is the thing that closes it without you maintaining glue code per tool.

If you are building AI features into a product, the calculus changed in December 2025. A protocol under the Linux Foundation with 400M monthly SDK downloads⁶ behind it is not a vendor bet anymore.

Start small. Connect one read-only server to your coding agent this week, on a repo you do not mind an agent poking at, and see whether it changes how you work. If it does not, you lost twenty minutes. Compare hosts in the AI coding tools directory, and if you want the workflow layer around all this, the AI developer workflows hub is the map.

Then go argue with me about whether Resources deserve more attention than Tools. I think they do, and almost nobody is building them.

---

Sources

Footnotes

1. What is the Model Context Protocol (MCP)? ↩ ↩² ↩³ ↩⁴

2. Introducing the Model Context Protocol ↩ ↩² ↩³ ↩⁴

3. Model Context Protocol, Wikipedia ↩ ↩² ↩³ ↩⁴

4. Post by @LearnWithBrij on X ↩

5. Specification, Model Context Protocol ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹

6. MCP 2026-07-28 spec: stateless core, coming to Claude ↩ ↩² ↩³ ↩⁴ ↩⁵

7. Connect Claude Code to tools via MCP ↩ ↩² ↩³ ↩⁴ ↩⁵

8. modelcontextprotocol/servers on GitHub ↩ ↩²

9. Official MCP Registry ↩

10. Security Best Practices, Model Context Protocol ↩