Model Context Protocol (MCP) Explained

Model Context Protocol (MCP) is an open standard that defines how applications provide tools and contextual data to large language models. Anthropic released it as open source in November 2024, and in December 2025 it became a founding project of the Linux Foundation's Agentic AI Foundation. It is built on JSON-RPC 2.0: an MCP client inside an AI application talks to MCP servers that expose tools, resources and prompts. Since the July 28, 2026 revision, MCP is stateless, with optional capabilities placed in extensions. This brief covers architecture, call flow, security and how MCP relates to agents and A2A.

Key concepts

MCP host and client

The AI-powered application (chatbot, IDE assistant or agent) acts as the host and runs an MCP client component, which connects to MCP servers to use the capabilities they expose. S5 · stytch.com

MCP server

A lightweight program wrapping an external integration. It exposes functions, data resources or prompt templates over the protocol, so any compatible client can use it without a custom integration. S5 · stytch.comS7 · descope.com

N×M integration problem

Without a shared protocol, every AI application needs its own integration with every tool. MCP has each client and server implement the protocol once, reducing integrations from N×M to N+M. S3 · databricks.com

Transports

MCP supports stdio for servers running on the same machine and Streamable HTTP for servers reached over a network. S7 · descope.com

Agent-to-Agent (A2A)

A communication approach in which agents collaborate, share goals and divide work. It is complementary to MCP, which covers agent access to tools and resources. S4 · auth0.com

Tool versus skill

A tool is a discrete, callable function such as a web search or database query. A skill is a higher-order capability that shapes how an agent reasons through a class of problems. S1 · neo4j.com

How an MCP tool call flows

1. Connect client to serverThe host application creates an MCP client for the target server. In the Microsoft example, it launches the GitHub server package with npx over a stdio transport.
2. List the server's toolsThe client retrieves the tools the server exposes. In the .NET SDK this is done with the ListToolsAsync method.
3. Convert tools for the agentMicrosoft Agent Framework converts the MCP tools to AIFunction objects so they can be added to an agent.
4. Agent sends a structured requestWhen the agent needs outside information or a tool to crunch numbers, it sends a structured request to the MCP server asking for what it needs.
5. Server checks permission, returns resultThe MCP server checks whether the agent has permission and returns the result.
6. Output enters working memoryThe fresh data or tool output is added into the agent's working memory for the next reasoning step.

Architecture, transports and the N×M problem

MCP uses a client-server architecture. The AI-powered application, such as a chatbot, IDE assistant or agent, acts as the host and runs an MCP client, while each external integration runs as an MCP server exposing tools, resources and prompts. The model does not call APIs directly; the exchange passes through the MCP client and server, which structures it. This addresses the N×M problem: without a shared protocol, every AI application needs its own integration with every tool. When each client and server implements MCP once, total integrations fall from N×M to N+M. Servers can run on the user's machine, on a private network or on the public internet. Same-machine servers use stdio, and servers reached over a network use Streamable HTTP.

Authorization and security practices

Servers reached over HTTP can use OAuth 2.1 to authorize clients, with Proof Key for Code Exchange (PKCE), Protected Resource Metadata and Resource Indicators named as supporting mechanisms. Commonly cited risks include unauthenticated servers, local server compromise, tool poisoning, token passthrough and over-broad scopes. Microsoft's guidance for its Agent Framework adds operational advice. Remote MCP servers are created by third parties, and Microsoft has not tested or verified them, so teams should carefully review and track which servers they add. Microsoft recommends relying on servers hosted by trusted service providers themselves rather than proxies. The MCP tool can pass custom headers such as authentication keys, set per run in tool resources or through a header_provider on Python local MCP tools. Review all data shared with remote servers, log it for auditing, and be aware of non-Microsoft practices for retention and location of data.

MCP alongside agents, tools and A2A

MCP is an integration standard, not an agent. It does not make decisions or plan actions; it provides context and tool access so the agent can act. In the agent-tools view, tools are functions and services that let an agent call APIs, query databases, send messages and run workflows, and MCP standardizes how those tools are integrated. A tool is a discrete callable function, while a skill is a higher-order capability that shapes how the agent reasons through a class of problems. Agent-to-Agent (A2A) communication addresses a different layer: how agents collaborate, share goals and divide work. Auth0 describes MCP and A2A as complementary building blocks rather than competing standards, and Descope says MCP complements APIs, CLIs, Agent Skills and A2A rather than replacing them. Scoping an agent to only the tools the job needs makes it more reliable and predictable.

MCP versus Agent-to-Agent (A2A)

Timeline

1. 2024-11
   Anthropic releases MCP as open source.descope.com
2. 2025-12
   Linux Foundation forms the Agentic AI Foundation with MCP as a founding project.descope.com
3. 2026-07
   July 28 revision makes MCP stateless and moves optional capabilities into extensions.descope.com

Common pitfalls

• Remote MCP servers are built by third parties and are not tested or verified by Microsoft. Review and track every server you add, and prefer providers' own hosted servers over proxies.
• Custom headers can carry API keys or OAuth access tokens to remote servers. Review all data shared, log it for auditing, and check the server operator's retention and data-location practices.
• Commonly faced MCP risks are unauthenticated servers, local server compromise, tool poisoning, token passthrough and over-broad scopes.
• Do not expect MCP to plan or decide. It provides context and tool access, while the agent supplies the reasoning and planning.

Key takeaways

• MCP is an open, JSON-RPC 2.0-based standard where clients in AI apps use servers that expose tools, resources and prompts.
• Treat every remote MCP server as third-party code: review it, log shared data, scope credentials narrowly and use OAuth 2.1 over HTTP.
• MCP complements APIs, skills and A2A rather than replacing them; it standardizes tool access, not agent reasoning.

FAQ

How this page is made. Built from the full text of 8 sources found with the AISA Tavily API (advanced search), refreshed weekly. A language model organizes what those sources state into the blocks above; each block links the sources it draws on, and figures that do not appear in the sources are removed.