What Is MCP? The Model Context Protocol Explained Simply

You saw "MCP server" in a product launch or a changelog, and every explanation assumed you write code. This guide is for founders, support leads, marketers and students who want the plain version first and the precise version second.

You will learn who governs the protocol, how one request travels from your question to a tool and back, which AI products support it, how it differs from an API, function calling and A2A, what can go wrong, and whether your business needs it. Every dated fact was read on its source's own page on 12 November 2026.

What is MCP?

MCP (Model Context Protocol) is an open set of rules that lets an AI application, such as Claude, ChatGPT or a coding editor, discover and use tools and data held in other systems. A company builds one MCP server for its product, and any AI app that speaks MCP can use it, without a separate integration for each app.

Terms as defined in the architecture overview on modelcontextprotocol.io, read on 12 November 2026.

"Context" means what a model works with when it answers: files, records and the actions it may take. MCP standardises how that reaches the model, not the model itself.

What does MCP mean in AI, and who created it?

In AI, MCP means the Model Context Protocol, created at Anthropic and announced on 25 November 2024 as "a new standard for connecting AI assistants to the systems where data lives." The first revision of the specification carries the date 2024-11-05.

Anthropic's announcement named the problem in one line: "Every new data source requires its own custom implementation." It released the specification, software development kits (SDKs), local server support in the Claude Desktop apps and ready-made servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer. Block and Apollo had already integrated MCP.

The announcement names David Soria Parra and Justin Spahr-Summers as MCP's creators. Today the governance page lists Soria Parra and Den Delimarsky as lead maintainers, with Spahr-Summers as co-inventor and emeritus lead maintainer. The design borrows from the Language Server Protocol, which lets one code editor support many programming languages.

Who owns and governs MCP today?

The Linux Foundation hosts MCP through the Agentic AI Foundation (AAIF), a directed fund announced on 9 December 2025 with MCP, Block's goose and OpenAI's AGENTS.md as founding projects. Anthropic donated MCP that day, keeping its governance model unchanged.

The Linux Foundation's announcement lists Amazon Web Services, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI as platinum members, and names Claude, Cursor, Microsoft Copilot, Gemini, VS Code and ChatGPT as adopters.

Technical decisions sit with people, not companies: maintainer roles are "for individuals, not companies", with no reserved seats. Changes go through written Specification Enhancement Proposals (SEPs), and code and specifications use the Apache License 2.0.

What problem does MCP solve?

MCP solves the many-to-many integration problem: without a shared protocol, every AI application needs its own connector to every tool, so the work grows with apps times tools; with MCP it grows with apps plus tools.

Say four AI apps each want to reach the same 25 business tools. Built one pair at a time, that is 4 × 25 = 100 connectors to maintain. If each app speaks MCP once and each tool ships one server, the total is 4 + 25 = 29, and a fifth app adds one more piece of work, not 25.

The famous comparison comes from the project's own MCP introduction: "Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect electronic devices, MCP provides a standardized way to connect AI applications to external systems."

The analogy has a limit: a plug is passive, while an MCP server can run code and change records, so who built it matters far more than with a cable.

How does the MCP protocol work?

MCP works in two layers: a data layer, where client and server exchange JSON-RPC 2.0 messages to list and call tools, read resources and fetch prompts, and a transport layer that carries them inside one computer or over the web. JSON-RPC is a small format for sending a named request and getting a reply.

Host, client and server

The host is the AI application the person uses. For each server, the host creates one client with a dedicated connection. The server is the program that offers context. In the project's own example, Visual Studio Code is the host, with one client for Sentry's remote server and another for a local filesystem server.

Tools, resources and prompts

A server can offer three kinds of thing, each with a different owner of the decision to use it.

From "Understanding MCP servers" and the 2026-07-28 specification, read on 12 November 2026.

The one client feature not deprecated is elicitation, which lets a server ask the user for missing details or a confirmation.

Transports: stdio and Streamable HTTP

The specification defines two standard transports. With stdio, the host launches the server as a subprocess on the same machine and they exchange one message per line over standard input and output: a "local" server. With Streamable HTTP, each message is an HTTP POST to a single endpoint and the reply comes back as a JSON object or as a stream tied to that one request: a "remote" server, which can serve many clients.

Authorization for remote servers

Authorization is optional and applies to HTTP transports only; stdio servers take credentials from their environment. A protected remote server acts as an OAuth 2.1 resource server: it tells the client where to sign in, the user approves access in a browser, and the client sends an access token with every request. The token must be issued for that exact server, servers must reject any other token, and passing a token through to another service is forbidden.

What changed in the 2026-07-28 revision?

The 2026-07-28 specification made MCP stateless: the opening handshake and sessions are gone, every request carries its protocol version and the client's capabilities, and servers must answer a new server/discover request. Roots, Sampling, Logging, the old HTTP+SSE transport and Dynamic Client Registration are deprecated, which normally means they stay at least twelve months before removal.

Products adopt revisions at their own pace: on 12 November 2026, Claude's connector documentation listed the 2025-03-26, 2025-06-18 and 2025-11-25 authorization specifications.

What happens when you ask an AI "what is the status of order 1234?"

When you ask an MCP-connected assistant about an order, the model never contacts the store itself: it picks a tool, the host's client calls the store's MCP server, and the model answers from the result. Here is the round trip for a store whose server offers a tool called get_order_status.

1. Connect. Earlier, someone added the store's server and approved access through OAuth, so the client holds an access token for that server alone.
2. Discover. The client sent tools/list and got back get_order_status, its description ("Look up an order's status by order number") and an input schema requiring order_number.
3. Ask. You type the question. The host sends it to the model with the available tools' names, descriptions and schemas.
4. Decide. The model replies with a tool call, not text: get_order_status with the order number 1234.
5. Approve. The specification says a human should be able to deny tool calls and recommends showing the inputs first.
6. Call. The client sends a tools/call request as an HTTP POST with the access token, shown shortened below.
7. Run. The server checks the token and input, queries the order system and returns the result; an unknown order comes back marked isError.
8. Answer. The host hands the result to the model as data, and the model replies: "Order 1234 shipped on 10 November and is expected on 13 November."

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "get_order_status",
    "arguments": { "order_number": "1234" },
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 3,
  "result": {
    "resultType": "complete",
    "content": [
      { "type": "text", "text": "Order 1234: shipped 10 November, expected 13 November." }
    ],
    "isError": false
  }
}

A website support agent can give the same answer without MCP: PepoChat's Shopify action asks for the order number and reads only the order's name, date, payment and fulfilment status, as our guide to connecting a chatbot to Shopify order status shows.

Which AI apps support MCP?

On 12 November 2026, the official documentation of Claude, ChatGPT, Microsoft Copilot Studio, Google's Gemini API, Visual Studio Code and Cursor each described MCP support, though each supports a different part of it.

Claude's connector docs cover claude.ai, Claude Desktop, Claude mobile, Cowork and Claude Code. OpenAI's MCP guide covers ChatGPT Plugins and the Responses API, Microsoft documents an MCP wizard in Copilot Studio, and Google's Gemini API guide covers its Interactions API.

From each vendor's own documentation, read on 12 November 2026.

What are examples of MCP servers?

MCP servers range from reference programs kept by the MCP project, such as Filesystem and Git, to official servers run by companies such as GitHub, Stripe and Notion.

Reference servers

The project's servers repository on GitHub keeps seven: Everything (a test server), Fetch, Filesystem, Git, Memory, Sequential Thinking and Time. Its README calls them "educational examples" for developers, not "production-ready solutions". The Google Drive, Slack, GitHub and Postgres servers from the 2024 launch are archived.

Vendor servers

• GitHub runs a remote server that "connects AI tools directly to GitHub's platform", with toolsets for repositories, issues, pull requests and Actions, and a read-only mode.
• Stripe runs one at mcp.stripe.com, signed in with OAuth or an agent API key; refunds through it carry a Human confirmation step, approved by a person in the Stripe Dashboard.
• Notion documents Notion MCP for working with a workspace from Claude, ChatGPT or Gemini.
• Sentry is the remote server the MCP architecture guide uses as its example.

Each was checked on the vendor's own documentation on 12 November 2026; the MCP Registry lists many more.

MCP vs API vs function calling vs plugins vs RAG: what is the difference?

An API is one product's interface, function calling lets a model pick a function, a plugin extends one product, RAG feeds documents into a prompt, and MCP is the shared protocol that lets any compatible AI app use a tool someone else built.

Function calling, also called tool calling, is the model feature underneath: in Google's words, it "lets you connect models to external tools and APIs"; the model picks the function and arguments, and your application runs it. MCP standardises how those functions are described and called across apps. An API (application programming interface) is the documented way programs talk to one service, and most MCP servers are thin layers over one. RAG (retrieval-augmented generation) adds relevant passages from your documents to the prompt before the model answers.

Definitions from the MCP specification, Google's Gemini API guide and each vendor's documentation, read on 12 November 2026.

The lines blur in practice: Claude's plugins and ChatGPT's Plugins now package MCP servers. PepoChat's custom actions are function calling against your own HTTPS endpoint, with no MCP in between. For how tool-using agents decide what to do, see agentic AI in customer service.

What is the difference between MCP and A2A?

MCP connects one AI agent to its tools and data, while A2A (Agent2Agent), which Google announced on 9 April 2025, connects separate AI agents to each other so they can share tasks. The A2A project's own comparison calls MCP vertical, deepening one agent, and A2A horizontal, connecting agents across teams or companies, and advises using both. Since 27 August 2026, A2A has also been a project of the Agentic AI Foundation, alongside MCP.

Is MCP safe? The security risks to know

MCP is as safe as the servers you connect and the permissions you grant: the specification says tools represent arbitrary code execution, and it admits that MCP "cannot enforce these security principles at the protocol level", so consent and access control fall to the apps that implement it.

Prompt injection through tool results

Prompt injection is text written to override an AI's instructions, hidden in content the model reads. A web page fetched by one tool can steer the model into calling another. Stripe's MCP documentation tells users to turn on tool approval and to take care combining its server with others "to avoid prompt injection attacks." Our list of AI chatbot security risks covers the same threat on a website.

Poisoned tool descriptions

The model reads every tool description as instructions. The project's local server security guide warns that a server can hide directives there, even about other servers' tools, and can change them after you approved it.

Over-broad permissions

A token granted every scope up front turns one leak into access to everything. The MCP security best practices recommend a minimal set of low-risk read scopes, with more requested only when a privileged operation is first attempted.

Untrusted and local servers

A local server runs as an ordinary program with your account's access to files, keys and the network. Clients that install servers in one click must show the exact command and get explicit approval, and the project's advice is to treat a third-party local server as untrusted code, pin its version and run it in a container. OpenAI recommends not connecting a custom server "unless you know and trust the underlying application."

Who needs MCP, and who does not?

You need MCP if you build AI applications or want your product usable from Claude, ChatGPT and coding tools; you can ignore it if you are adding a ready-made AI support agent to your website.

Who benefits. Software companies that want their product inside AI assistants, as GitHub, Stripe and Notion did; developers building agents that need many tools; IT teams connecting company assistants to internal data.

Who does not. A shop, clinic or agency adding a support agent to its site, where the vendor's integrations do the connecting, and a team whose one app calls one API, where plain function calling is simpler.

An AI support agent for a website is a finished product; MCP matters to whoever builds it, not to the business that installs it.

MCP meaning: what else does MCP stand for?

Outside AI, MCP often stands for Microsoft Certified Professional, a Microsoft certification title, and in medicine for the metacarpophalangeal joints, the knuckles where the fingers meet the hand. If the question mentions AI, agents, Claude or ChatGPT, it means the Model Context Protocol.

How can you try MCP?

You can try MCP by adding a connector to an AI assistant you already use, or, if you write code, by running a reference server with the MCP Inspector.

1. Add a connector. In Claude, add a server from the directory or enter its URL as a custom connector. In ChatGPT, open Plugins and choose Add custom MCP server.
2. Start read-only. Use a read-only mode or a sandbox account, such as a Stripe sandbox, and keep tool approval on.
3. Watch the messages. Run the MCP Inspector against the Everything reference server to see tools/list and tools/call without a model.
4. Build one tool. Use an official SDK, expose one read-only tool and test it in the Inspector.
5. Secure it before production. Scope tokens narrowly, confirm writes and log every tool call.

Common misconceptions about MCP

• "MCP is an AI model." It is a protocol; the architecture guide says it "does not dictate how AI applications use LLMs."
• "MCP replaces APIs." Most servers wrap an existing API; Stripe's server calls the Stripe API.
• "A listed server has been vetted." The project's security guide says "a listing on a registry is not an endorsement."
• "MCP gets my website into ChatGPT." Citations depend on crawling and indexing; MCP plays no part, and llms.txt is a separate proposal.

Where PepoChat fits

PepoChat's AI support agent does not use MCP: it neither connects to MCP servers nor exposes one, so you cannot add PepoChat to Claude or ChatGPT as a connector or point it at a vendor's MCP server. We confirmed this in the product code on 12 November 2026.

It reaches other systems in three ways instead:

• 22 prebuilt actions across 13 tools, such as Shopify order status by order number, Stripe subscription checks, tickets in Zendesk, Freshdesk or Zoho Desk, and a Zapier action for the apps Zapier connects, as in our Zapier guide.
• Custom actions that call any HTTPS endpoint, with up to 10 inputs and a list of response fields the agent may read (custom actions).
• A REST API and signed webhooks for conversations, contacts, leads and handoffs.

For your customer the result matches an MCP tool call: they ask where order 1234 is, and the agent looks it up. The agent is instructed to treat tool results as data, never as instructions, and actions run at least once, so refunds and payments stay with a person.

If your team needs MCP specifically, for example to reuse one server across Claude, ChatGPT and your support bot, choose a platform that documents it. If you want an agent that answers from your knowledge base, runs these actions and hands off to your team inbox, start on the free plan: 100 AI replies a month, no credit card.

What to do next

• Decide what an agent may do before you connect anything, with our chatbot permissions guide.
• Read how PepoChat integrations work: you can test each action with a real request, and the agent reads only the response fields listed on it.
• Compare plans and reply allowances on the pricing page.
• Create a free PepoChat workspace and connect Shopify, Stripe or your own endpoint as an action, with every chat feature on the free plan.
• Related explainers: What is an AI agent?, What is prompt injection? and What is agentic AI?.