MCP in one minute
Think of an agreed format for asking an external system what it offers and requesting a specific operation. A catalogue server might expose a stock lookup. The AI application still needs to decide when to use it, authenticate appropriately, enforce the user's access and check the result.
MCP connects hosts, clients and servers
The AI application that organises the interaction and determines which integrations are available.
The component inside the host that communicates with an MCP server.
Software exposing capabilities such as tools, resources or reusable prompts.
A server is a software role, not necessarily a separate physical machine. It can run locally as a process or be reached remotely. A host may work with several clients and servers. The protocol provides a common communication structure, while the host remains responsible for how these capabilities enter the user's workflow.
Suppose a company wants its assistant to consult a product catalogue and an internal document collection. Each source could be exposed through an MCP server. The host can then work with their advertised capabilities without using an unrelated conversational format for each source. The underlying catalogue API, document permissions and business rules still exist beneath that interface.
The distinction matters when implementing an integration. The current changelog removes the old protocol-session and initialisation exchange, and provides server discovery through server/discover. A server must implement that discovery method, but a client does not necessarily have to call it before every operation. Applications should follow the version they actually implement instead of combining incompatible examples.
Stateless protocol requests do not mean an application cannot retain data. A server or host may maintain application state, stored records or explicitly referenced work. AI Memory describes separate ways of retaining information. It should not be confused with a protocol-level session or with the model automatically remembering every earlier request.
Tools, resources and integration are different layers
| Capability | Purpose | Catalogue example |
|---|---|---|
| Tools | Expose operations with defined inputs and results. | Look up stock for a particular product variant. |
| Resources | Make data or content available for the application to use. | Provide a catalogue document or product reference. |
| Prompts | Offer reusable prompt templates or interaction patterns. | A template for reviewing a product description. |
A tool may read information or cause a change; the label 'tool' does not imply one or the other. Its description and schema help the application understand the operation, but access restrictions must be enforced by software. A resource can be selected and supplied as context without becoming an instruction to perform unrelated actions.
MCP uses JSON-RPC messages and defines transports including standard input/output for local processes and Streamable HTTP for remote communication. Transport describes how messages travel. It does not determine whether a returned product price is correct, whether the user requested an update or whether a model has chosen the right next step.
A Connector is the broader integration with an external service, including authentication, mapping and supported operations. It may use MCP, a direct API or another interface. Tool Use describes the model requesting an operation. RAG describes retrieving relevant information and supplying it to generation. The same application can use all three without treating them as synonyms.
MCP also does not prescribe the full behaviour of AI Agents. Planning, retries, stopping conditions and review screens belong to the host and surrounding process. Exposing a catalogue server does not by itself build a reliable catalogue-maintenance agent. The workflow must still determine completeness, handle conflicting records and verify changes.
This separation is useful when diagnosing failures. An integration may exchange perfectly valid protocol messages while returning stale data or querying the wrong warehouse. Conversely, a correct source can be unreachable because transport or authorisation is misconfigured. Check the failing layer instead of assuming every problem is a language-model error.
Permissions and supervision remain application responsibilities
The current authorisation specification describes an OAuth-based framework for applicable HTTP implementations. It is not a statement that every local server uses the same login process. Standard-input/output connections follow a different execution arrangement. Authentication, granted scopes and downstream account permissions need to fit the actual transport and service.
Technical access and task authority are different. An integration that can edit a catalogue should not infer permission to delete products from a request to analyse missing descriptions. Expose only necessary capabilities and enforce their boundaries in the application and service, rather than relying on the model to remember a warning.
Server descriptions, resource contents and tool results may include untrusted text. Treating that text as instructions from the user creates a prompt-injection risk. A server advertising a capability does not establish that it is trustworthy or appropriate for the task. The host needs a deliberate integration choice and a clear policy for which data and operations it exposes.
For an approved product update, show the precise record, old value, proposed value and supporting source. Human-in-the-loop can place review before execution. If the record changes during that pause, the application must revalidate the proposal. Approval of one version should not authorise a materially different update.
Finally, keep a trace of the operation and actual outcome without unnecessarily copying sensitive data into logs. An Agentic Workflow can organise retries and exception handling around MCP calls. The protocol simplifies a communication layer; reliable work still depends on scoped access, trustworthy sources, clear goals and checks that match the consequences of the action.