What is an MCP server, in plain terms?

What does MCP stand for, and who runs it?

MCP is the Model Context Protocol. The project's own introduction calls it "an open-source standard for connecting AI applications to external systems." A protocol is an agreed message format, so any AI application that speaks MCP can use any server that speaks it, whoever wrote either side.

The project publishes a specification, official SDKs (software development kits, the libraries you build with) for several languages, a testing tool called the MCP Inspector, and a set of reference servers. As of the docs read on 16 October 2026, the current specification version is dated 2026-07-28, according to the architecture overview.

Host, client, server: who does what?

The architecture page names three participants. The names are confusing at first because "client" here is not the app you see.

Participant	What it is	Example
MCP host	The AI application you use, which manages one or more connections	Claude Code, Claude Desktop, Visual Studio Code
MCP client	A component inside the host that keeps one connection to one server	The host creates one client per server it connects to
MCP server	"A program that provides context to MCP clients"	The Filesystem server, the GitHub server, the Sentry server

So when you add three servers to VS Code, VS Code (the host) runs three clients, one for each server. The model never talks to a server directly. The host decides what to send, runs the call, and passes the result back into the conversation.

What does an MCP server actually expose?

A server offers up to three kinds of thing, which the specification calls primitives:

1. Tools. Functions the AI application can call to do something, such as run a database query, call an API or write a file. Each tool has a name, a description and a schema for its inputs.
2. Resources. Data the application can read for context, such as file contents, database records or an API response.
3. Prompts. Reusable templates that help structure a request, such as a system prompt or worked examples.

The host first asks the server for its list (for tools, a tools/list request), then calls an item from that list (for tools, tools/call). Most servers you will meet are mainly tools. The architecture page gives a database example: a server can expose tools to query the database, a resource holding its schema, and a prompt with examples of how to use the tools.

Servers can also ask the user for input through the host, a feature called elicitation. The page notes that sampling, where a server asks the host's model for a completion, is deprecated as of protocol version 2026-07-28.

Local or remote: how does a server connect?

MCP defines two standard transports, meaning the channel the messages travel over.

	Local server	Remote server
Transport	stdio: standard input and output between two processes on your machine	Streamable HTTP: HTTP POST, with optional server-sent events for streaming
How you add it	A command, such as npx -y @modelcontextprotocol/server-filesystem /path	A URL, such as https://api.githubcopilot.com/mcp/
Who it usually serves	One client	Many clients
Sign-in	Inherits your local permissions	HTTP authentication; the docs recommend OAuth for tokens

Whether to run a service's server locally or use its hosted version is a real trade-off; the remote or local GitHub MCP server thread works through it for one case.

What can go wrong?

An MCP server is code that acts with your permissions. The project's security best practices tell client authors to "Warn that MCP servers run with the same privileges as the client", and the tools specification says "there SHOULD always be a human in the loop with the ability to deny tool invocations." The other risk is prompt injection: text a server fetches (a web page, a support ticket, an issue comment) can contain instructions that the model may follow. Stripe's MCP documentation warns users to "exercise caution when using the Stripe MCP with other servers to avoid prompt injection attacks."

To try a server safely:

1. Start with a read-only mode where the server offers one; GitHub, Linear and Supabase all document one.
2. Give it the narrowest folder or token that works. The Filesystem sandbox thread shows how for one server.
3. Keep per-call approval on, and read each call before you approve it.
4. Install from the vendor's own repository or documentation, not a copy.

The CodeLifter MCP directory lists 15 servers with their install line, licence and what each can read, write or reach. If you would rather make one, see how to build a simple MCP server.

Short version

• An MCP server is a program that offers tools, resources and prompts to an AI application over a standard protocol.
• The host (the app) runs one client per server; the model never calls a server directly.
• Local servers run as a command over stdio; remote servers are a URL over Streamable HTTP.
• A server acts with your permissions, so scope it narrowly and approve calls by hand.