An MCP server is a program that exposes the data and actions of one system, such as a database, a CRM or a file store, to AI applications through the Model Context Protocol, an open standard for connecting AI assistants to external systems. Once an AI application like Claude or ChatGPT is connected to it, the assistant can read what the server offers and call the actions it allows, within whatever permissions the server enforces. It is best understood as an adapter: the server speaks MCP on one side and your system's own API on the other.
What is the Model Context Protocol?
The official documentation defines MCP as an open-source standard for connecting AI applications to external systems, through which assistants can reach data sources, tools and workflows. It uses a hardware comparison: think of MCP like a USB-C port for AI applications, one standard plug instead of a custom cable for every device.
Anthropic open-sourced the protocol on November 25, 2024 to solve a specific problem: every new data source requires its own custom implementation, making truly connected systems difficult to scale. On December 9, 2025 Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. At that point it reported more than 10,000 active public MCP servers and adoption by ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code, among others.
For a business, the practical meaning is that you can build one MCP server around a system and any compatible assistant can use it, instead of building a separate integration for each AI product your team uses.
How does an MCP server work?
MCP has three participants. The architecture guide defines them as the MCP host, the AI application that coordinates one or more clients; the MCP client, which maintains a connection to a server; and the MCP server, a program that provides context to clients. The host creates one MCP client for each MCP server, so an assistant connected to your CRM and your document store holds two separate connections.
Messages between client and server are JSON-RPC 2.0. The current specification defines two standard transports: stdio, newline-delimited messages over the standard streams of a client-launched subprocess, and Streamable HTTP, where each message is an HTTP POST to a single MCP endpoint and replies arrive as a JSON object or a request-scoped SSE stream. Older explainers still list SSE as a separate transport, because the 2024-11-05 revision defined HTTP with SSE as one of its two standard transports. In the current specification, SSE appears only as a way of streaming replies inside Streamable HTTP, not as a transport of its own.
The documentation for the current revision describes MCP as a stateless protocol: every request carries the protocol version and the relevant capabilities, so the server can process each request on its own. Clients learn what a server supports through a server/discover request. If you read older tutorials that begin with an "initialize" handshake, they describe an earlier revision; the specification notes that earlier protocol revisions established a connection-scoped session with an initialize handshake and explains how implementations fall back.
What does an MCP server expose?
Servers offer three kinds of capability, and the difference between them is who decides when they are used. The server concepts page sets them out in one table:
| Primitive | What it is | Example | Who controls it |
|---|---|---|---|
| Tools | Functions the model can call to act: write to a database, call an API, modify a file | Search flights, send a message, create a calendar event | The model |
| Resources | Read-only data provided as context: file contents, database schemas, documentation | Retrieve documents, read a calendar | The application |
| Prompts | Prebuilt instruction templates for working with the server's tools and resources | Plan a vacation, summarize my meetings | The user |
All three rows come from the official server concepts documentation. Tools are schema-defined interfaces that use JSON Schema for validation, discovered with tools/list and executed with tools/call. Resources each have a unique URI and a declared MIME type. Prompts are user-controlled, requiring explicit invocation rather than automatic triggering, which is why they often appear as slash commands.
This split matters when you design one. Anything that changes data belongs in a tool, and tools are where the permission questions live. Anything that only informs the model can be a resource, which the application chooses to include.
Is an MCP server an actual server?
Not necessarily. The documentation is explicit that MCP server refers to the program that serves context data, regardless of where it runs. When Claude Desktop launches the filesystem server, it runs locally on the same machine because it uses the STDIO transport. The official Sentry server, by contrast, runs on the Sentry platform and uses the Streamable HTTP transport. Local servers typically serve a single MCP client, whereas remote servers typically serve many.
For a company, a local server suits one person's tools on one laptop. A remote server suits a system the whole team or your customers should reach, and it needs real authentication: the architecture guide notes that MCP recommends using OAuth to obtain authentication tokens for remote servers.
How is an MCP server different from an API?
An API is how software talks to your system. An MCP server usually sits in front of that API and describes it in a form an AI application can discover and use without custom code. Each tool arrives with a name, a description and an input schema, so a host can discover available tools and present them to the model. The API still does the work.
That is why "MCP vs API" is the wrong choice to frame. If one internal automation needs to call your CRM, a direct API call inside a workflow is simpler and easier to audit, which is the argument in our piece on AI agents vs workflow automation. An MCP server pays off when several AI applications, or an assistant working across open-ended tasks, need the same access.
It is also different from llms.txt. An llms.txt file helps AI systems read your public website. An MCP server lets an assistant query and act inside a system, usually a private one.
Does your business need an MCP server?
Three situations make a good case:
- Your team already works in an MCP-capable assistant and keeps copying data in and out of an internal system by hand. A server around that system removes the copying.
- You sell software and your customers want to use it from their own AI assistants. A remote server with proper authorization is the standard way to offer that.
- You are building an agent that needs several systems. Wrapping each in a server keeps the agent's tools consistent and replaceable.
If none of those apply, you probably do not need one yet. A process with fixed steps is better served by a workflow that calls the API directly.
What are the security risks of an MCP server?
An MCP server hands an AI model the ability to act, so the risks are those of any powerful integration plus one that is specific to language models. The specification's tools page is direct: for trust and safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations. It requires servers to validate all tool inputs, implement proper access controls, rate limit tool invocations and sanitize tool outputs, and asks clients to prompt for user confirmation on sensitive operations and log tool usage for audit purposes. Clients must consider tool annotations to be untrusted unless they come from trusted servers.
The first risk is too much access. OWASP's entry on Excessive Agency describes a system where the model has access to extensions which include functions that are not needed, for example a document reader whose third-party extension can also modify and delete. The MCP security guide makes the same point about tokens: broad scopes granted up front mean a stolen broad token enables unrelated tool and resource access, and it recommends a minimal initial scope set with incremental elevation.
The second is injected instructions. Anything a server returns becomes text the model reads, and OWASP lists indirect prompt injection, where an LLM accepts input from external sources such as websites or files, as a core risk. A tool that fetches an email or a web page can deliver an attacker's instructions straight into the model's context.
The third applies to local servers: they are programs that run on your machine, and the security guide warns that a malicious configuration or package can lead to arbitrary code execution with MCP client privileges. Install local servers only from sources you trust, as you would any software.
What should you decide before building one?
Five decisions shape a safe server:
- Which system, and which operations. List the reads and writes the assistant needs, and leave everything else out.
- Whose identity it acts as. OWASP recommends executing actions in the context of the specific user, with the minimum privileges necessary, not through one all-powerful service account.
- Which actions need approval. Sending, paying and deleting should wait for a person.
- Where authorization is enforced. OWASP's advice is to implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed.
- What gets logged. Every tool call, its inputs and its result, so you can see what happened.
Qubba builds AI agents, workflow automation and internal tools on a fixed written quote after a 30 minute call.
Frequently asked questions
Can I use MCP with ChatGPT?
Yes.
The MCP documentation lists Claude and ChatGPT among the AI assistants that support it, and Anthropic's December 2025 announcement names ChatGPT among the products that adopted MCP.
How you add a server differs by product and plan, so check the assistant's own documentation.
How much does an MCP server cost?
The protocol itself is open source, so there is no license fee.
The cost is building and running the server: the development work, hosting for a remote server, and the upkeep when the underlying API changes.
There is no standard price, because a read-only server around one database and a multi-tenant server with OAuth for your customers are very different projects.
What is the difference between MCP and RAG?
RAG is a technique for finding relevant passages and adding them to a prompt.
MCP is a protocol for connecting an AI application to external systems.
They meet in resources and tools: an MCP server can expose a search tool over your documents, and the host application decides how to use the information, whether by selecting portions, searching with embeddings or passing it all to the model.
Who controls the MCP standard?
Since December 2025 the protocol sits with the Agentic AI Foundation under the Linux Foundation, where it joined goose by Block and AGENTS.md by OpenAI as founding projects.
The specification is versioned by date; the latest revision as of October 2026 is 2026-07-28.