What is MCP (Model Context Protocol)? A simple guide with examples

The problem MCP solves

AI models are much more useful when they can read your data (files, databases, documents) and take actions (create a ticket, query an API, run a search). Before MCP, every AI app needed its own custom integration for every service:

• 5 AI apps × 20 services = 100 separate integrations, each built and maintained differently.

MCP turns that into "build once, use everywhere":

• each service publishes one MCP server,
• each AI app implements one MCP client,
• any app can then talk to any server.

How MCP works: hosts, clients and servers

Messages use JSON-RPC 2.0, a simple request/response format. Servers run either:

• locally, as a process the host starts (communicating over standard input/output), or
• remotely, over HTTP, so many users can share one server.

What an MCP server can offer

Tools (actions)

Functions the model can call, such as create_issue, search_docs or run_query. Each tool has a name, a description and a schema for its inputs, so the model knows when and how to use it.

Resources (data)

Read-only content the app can load into context, such as files, records or documents, identified by URIs.

Prompts (templates)

Reusable prompt templates a server provides, for example "summarise this pull request", which users can pick in the host app.

MCP vs APIs vs function calling

• APIs are how services expose functionality to programs. MCP servers often wrap existing APIs.
• Function calling is how a model asks the app to run a function. It's model-side and app-specific.
• MCP standardises the connection between AI apps and tools, so the same tool works across many apps and models.

They work together: the model uses function calling, the app routes the call through an MCP client, and the MCP server calls the real API.

Example: an MCP server in about 20 lines

Using the official Python SDK:

pip install "mcp[cli]"

from mcp.server.fastmcp import FastMCP
 
mcp = FastMCP("weather")
 
@mcp.tool()
def get_forecast(city: str) -> str:
    """Get a short weather forecast for a city."""
    # Call a real weather API here
    return f"Sunny and 24°C in {city}"
 
@mcp.resource("notes://travel-tips")
def travel_tips() -> str:
    """Packing tips for travellers."""
    return "Pack light, bring a charger, check visa rules."
 
if __name__ == "__main__":
    mcp.run()

Add this server to an MCP-compatible host (most have a settings page or a JSON config listing servers and the command to start them). The model can then call get_forecast when a user asks about the weather.

What people build with MCP

• Developer tools: GitHub, Git, databases, logs and error trackers inside coding agents.
• Knowledge access: company docs, wikis and drives searchable by an assistant.
• Business actions: CRM updates, ticket creation, calendar scheduling.
• Personal automation: files, notes and local apps on your own computer.

Agent frameworks and personal agents increasingly use MCP-style connectors. For example, personal agents like Muse, Dots and Duet rely on connectors to reach your apps (see Claude Duet vs OpenAI Dots vs Meta Muse).

Security: what to watch out for

MCP makes it easy to give AI powerful access, and that's exactly why it needs care.

• Only install servers you trust. A server runs code on your machine or holds your credentials. Treat it like any other software dependency.
• Least privilege: give servers read-only access where possible and scope API keys tightly.
• Prompt injection: content a server returns (web pages, emails, tickets) can contain hidden instructions. Read our prompt injection guide.
• Tool poisoning: a malicious server can describe its tools in misleading ways to manipulate the model.
• Approval for risky actions: require confirmation before tools send, delete, pay or deploy. See adding human approval in LangChain.
• Protect tokens: don't log credentials, and prefer OAuth flows over pasted long-lived keys. The LiteLLM supply-chain attack shows how leaked tokens get abused.

Frequently asked questions

What is MCP in AI?

MCP, the Model Context Protocol, is an open standard that lets AI applications connect to external tools and data sources in a consistent way. A service builds one MCP server, and any MCP-compatible AI app can use it.

Who created MCP?

Anthropic introduced the Model Context Protocol in November 2024 as an open standard. It has since been adopted by many AI companies, tools and developers.

What is the difference between an MCP server and an MCP client?

An MCP server exposes tools, resources and prompts, for example access to GitHub or a database. An MCP client lives inside an AI application (the host) and connects to one server on the app's behalf.

Is MCP the same as an API?

No. An API is how a service exposes functionality to programs. MCP standardises how AI applications discover and use tools and data, and MCP servers often wrap existing APIs.

How do I build an MCP server?

Use an official SDK, such as the Python SDK with FastMCP: define functions decorated as tools or resources, run the server, and register it in an MCP-compatible host app's settings.

Is MCP safe to use?

It can be, with care. Install only trusted servers, give them least-privilege access, watch for prompt injection in returned content, require approval for risky actions and protect the tokens servers use.

Sources

• Anthropic: Introducing the Model Context Protocol
• Model Context Protocol documentation
• MCP Python SDK on GitHub