Review Model Context Protocol (MCP)

Model Context Protocol (MCP) is an open protocol that standardizes how AI applications exchange context and capabilities with external services through a host-client-server architecture.

MCP gives compatible applications and services shared rules for discovering and using prompts, resources, and tools. The host application manages clients and user control; each client connects to a particular server. The protocol defines the exchange, while each implementation decides what capabilities to offer and authorize.

A shared protocol can reduce one-off integration work and make external capabilities more portable across AI applications. The same connection can expose data or actions, so clear permissions, isolation, and informed consent remain part of the architecture.

A desktop AI application uses MCP clients to connect separately to a source-code server and a calendar server. Both integrations use the same protocol, but each server exposes different capabilities and keeps a separate connection boundary.

MCP is not a model, an MCP server, or blanket permission for an AI to use every connected system. It standardizes messages and capabilities. The host, client, server, and user still have distinct security and authorization responsibilities.

MCP is the language of the connection; a server is one participant.

* [[mcp-server|MCP Server]] * [[orchestration|Orchestration]] * [[ai-agent|AI Agent]] * [[system|System]] * [[prompt-injection|Prompt Injection]]

* [Model Context Protocol, “Architecture”](https://modelcontextprotocol.io/specification/2025-06-18/architecture) — specifies the host-client-server architecture, capability negotiation, and security boundaries. * [Model Context Protocol, “Server features overview”](https://modelcontextprotocol.io/specification/2025-06-18/server/index) — defines prompts, resources, and tools as server primitives with different control relationships.

* Read [[mcp-server|MCP Server]] for the implementation role that exposes selected capabilities. * Treat server output as an external trust boundary and evaluate risks such as [[prompt-injection|Prompt Injection]].