# What is MCP and How It Gives AI One Standard Way to Plug Into Your Tools > Source: > Published: 2026-11-14 14:01:02+00:00 The Model Context Protocol is often called “USB-C for AI.” Here is what it actually is, how the pieces fit together, what a tiny MCP server looks like in Python, and what to watch out for before you connect one. Think about the drawer of old phone chargers most of us have at home. One cable for this phone, a different one for that tablet, another for the headphones. Every device had its own plug. Then USB-C came along, and slowly one cable started working with almost everything. AI apps had a similar problem with tools. Every time you wanted a chatbot or agent to read your files, query a database, or check a ticket in some system, someone had to write a custom connector for that exact app and that exact tool. The Model Context Protocol, or MCP, is an attempt to fix that with one shared plug. In the article on AI agents, we saw that a language model becomes much more useful when it can use tools. But the model doesn’t run tools by itself. The app around it does. And each app used to wire up each tool in its own way. Here’s the engineering problem in numbers. Say there are 5 AI apps and 10 tools people want to connect. If every app builds its own connector for every tool, that’s 5 × 10 = 50 separate integrations to write and maintain. With a shared standard, each app implements the protocol once and each tool implements it once. That’s 5 + 10 = 15 pieces of work, and any app can talk to any tool. When Anthropic open-sourced MCP in November 2024, this is exactly how they described it: AI models were “trapped behind information silos,” and every new data source needed “its own custom implementation” [1]. MCP replaces those one-off integrations with a single protocol. MCP is an open standard for how AI applications talk to external tools and data. It’s not a model, and it’s not a product. It’s a set of rules, like HTTP is for websites. It also doesn’t decide how the AI uses what it gets. The official docs are clear that MCP only covers the exchange of context. How the app uses the model is up to the app [2]. MCP uses a client-server setup with three roles [2]: Host. The AI application the user actually works in, like Claude Desktop, VS Code, or ChatGPT. Client. A small connector inside the host. The host creates one client for each server it connects to. Server. A program that offers capabilities to the AI. For example, a GitHub server, a Postgres server, or a server for your company’s internal order system. Going back to the charger drawer: the host is your laptop, each client is a USB-C port, and each server is a device you plug in. A server can run locally on your machine, talking to the host through standard input and output (called stdio), or remotely over the internet using a transport called Streamable HTTP [2]. Either way, the messages themselves use JSON-RPC 2.0, a simple, well-known format for “call this method with these inputs, get this result back.” An MCP server can expose three main kinds of things, called primitives [2]: Tools. Actions the AI can take, like “search tickets,” “run this SQL query,” or “create a calendar event.” Resources. Data the AI can read for context, like a file’s contents or a database schema. Prompts. Reusable templates, like a ready-made “summarize this bug report” instruction. The flow is simple. The client asks the server what it offers (for tools, that’s a tools/list request). The server replies with each tool’s name, a description, and a schema for its inputs. The host passes that list to the model. When the model decides to use a tool, the host sends a tools/call request to the right server and hands the result back to the model [2]. Same pattern as tool calling in any agent. The model decides. The code does. MCP just standardizes the “code does” part. This is where it gets practical. With the official Python SDK [3], a working server is a few lines. Here’s a toy server for a small online shop: ``` python from mcp.server import MCPServermcp = MCPServer("Shop")ORDERS = {"4512": "Held at Lahore warehouse since Monday"}@mcp.tool()def order_status(order_id: str) -> str: """Look up the delivery status of an order by its ID.""" return ORDERS.get(order_id, "Order not found") ``` That’s the whole thing. The function’s type hints become the input schema, and the docstring becomes the description the model reads. No hand-written JSON, no protocol code. You can test it in the MCP Inspector with uv run mcp dev server.py, which comes with the SDK’s cli extra [3]. Once it’s running, any MCP-compatible host can discover order_status and let the model call it. In a real project, you’d replace the dictionary with a call to your actual database or API. The point is that you write this connector once, and it works with every host that speaks MCP. MCP spread fast. In December 2025, about a year after launch, Anthropic donated MCP to the Agentic AI Foundation, a new fund under the Linux Foundation co-founded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, Cloudflare, and Bloomberg [4][5]. The Linux Foundation is the same neutral home behind projects like Kubernetes and Node.js. At that time, the MCP team reported over 10,000 active servers and client support in ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, VS Code, and more [4]. So it’s no longer one company’s experiment. It’s shared infrastructure. MCP makes connecting tools easy. That’s also the risk. Tool descriptions are instructions too. The model reads each tool’s description to decide how to use it. In April 2025, security researchers at Invariant Labs showed “tool poisoning” attacks, where a malicious server hides instructions inside a tool description. In their demo, an innocent-looking “add two numbers” tool told the agent to read private config files and quietly pass them along [6]. It’s a form of prompt injection, aimed at the tool list instead of the chat. Descriptions can change later. The same researchers showed a server can look harmless when you approve it and change its tool descriptions afterward, which they called a “rug pull” [6]. More tools, more power. A server that can send email or edit records gives the AI that power too. A mistake now becomes an action. A few habits help, in line with the official security guidance [7]: Only install servers from sources you trust, the same way you’d treat any package you run. Give each server the smallest permissions it needs. Read-only where possible. Keep a human approval step for risky actions like sending, deleting, or paying. Treat everything a tool returns as untrusted data, not as instructions. MCP is an open standard that gives AI apps one common way to connect to tools and data. Instead of writing a custom connector for every app and every tool, you build an MCP server once, and any MCP-compatible host can use it. It has three roles (host, client, server) and three main things a server can offer (tools, resources, prompts). Under the hood, it’s JSON-RPC messages over stdio or HTTP. It’s genuinely useful for anyone building agents. Just remember that every server you plug in is new code your AI will trust, so choose and limit them carefully. So the next time someone says “we added MCP support,” a good follow-up question is: “Which servers, and what are they allowed to do?” [1] Anthropic, “Introducing the Model Context Protocol,” Nov 25, 2024. [https://www.anthropic.com/news/model-context-protocol](https://www.anthropic.com/news/model-context-protocol) [2] Model Context Protocol docs, “Architecture overview.” [https://modelcontextprotocol.io/docs/learn/architecture](https://modelcontextprotocol.io/docs/learn/architecture) [3] MCP Python SDK, official GitHub repository. [https://github.com/modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk) [4] MCP Blog, “MCP joins the Agentic AI Foundation,” Dec 9, 2025. https://blog.modelcontextprotocol.io/posts/2025–12–09-mcp-joins-agentic-ai-foundation/ [5] The Linux Foundation, “Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF),” Dec 9, 2025. [https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation](https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation) [6] Invariant Labs, “MCP Security Notification: Tool Poisoning Attacks,” Apr 2025. [https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) [7] Model Context Protocol, “Security Best Practices.” [https://modelcontextprotocol.io/specification/latest/basic/security_best_practices](https://modelcontextprotocol.io/specification/latest/basic/security_best_practices) I write one simple AI explainer every week. Follow if you want the next one. [What is MCP and How It Gives AI One Standard Way to Plug Into Your Tools](https://pub.towardsai.net/what-is-mcp-and-how-it-gives-ai-one-standard-way-to-plug-into-your-tools-a8bc1948fc49) was originally published in [Towards AI](https://pub.towardsai.net) on Medium, where people are continuing the conversation by highlighting and responding to this story.