MCP server
In plain wordsA small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol.
A program that implements the server side of the Model Context ProtocolModel Context Protocol, prop. n.: An open standard that lets AI assistants plug into outside apps and data — files, calendars, databases, business software — through one common connector instead of a custom link for every pairing; often likened to a USB-C port for AI., exposing toolstool, n.: Any outside capability an AI model is allowed to use — a web search, a calculator, a code runner, a database or an app — described to the model so it can ask for it by name., resources and prompts from some system — a database, file store, business application, browser or device — to MCP-compatible AI applications. Local servers usually run as a subprocess on the user's machine and communicate over standard input/output; remote servers run as web services reached over HTTP, usually with OAuth authorization, and are often branded 'connectors' in consumer apps. A server lists its capabilities on request, and the host decides which tools to show the model and whether calls need the user's approval. Because a server's tool descriptions and outputs enter the model's context, a malicious or compromised server can inject instructions (tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them.), and a local server runs with the user's privileges; vetted registries, signing, sandboxingsandbox, n.: A sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed. and least-privilege scopes are the main defenses.
Install the Postgres MCP server in read-only mode and the agent can inspect the schema itself.
Origin
Defined with the protocol at its launch by Anthropic on 25 November 2024, which shipped reference servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer. Community and vendor servers multiplied through 2025; when the Linux Foundation formed the Agentic AI FoundationAgentic AI Foundation, prop. n.: A nonprofit group under the Linux Foundation that looks after shared, open technical standards for AI agents, such as the Model Context Protocol, so that no single company controls them. in December 2025, it counted more than 10,000 published servers.
Usage note
A critical flaw in mcp-remote, a widely used client-side proxy (CVE-2025-6514, July 2025), let a malicious server run commands on the user's computer — a reminder to treat servers as untrusted code. Not to be confused with a model server, which hosts the model itself (see model servingmodel serving, n.: Running a trained AI model as a live service, so that apps and people can send it requests and get answers back quickly, reliably and at a sensible cost.).
Related
- Model Context ProtocolModel Context Protocol, prop. n.: An open standard that lets AI assistants plug into outside apps and data — files, calendars, databases, business software — through one common connector instead of a custom link for every pairing; often likened to a USB-C port for AI.
- tooltool, n.: Any outside capability an AI model is allowed to use — a web search, a calculator, a code runner, a database or an app — described to the model so it can ask for it by name.
- tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them.
- sandboxsandbox, n.: A sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed.
- permission systempermission system, n.: The rules that decide what an AI agent may do on its own, what it must ask a person about first, and what it may never do — like a phone's settings for which apps can use the camera.
- AI supply chain securityAI supply chain security, n.: Protecting everything an AI system is built from — downloaded models, datasets, code libraries and tools — against tampering, so a poisoned or fake part cannot sneak into the finished product.
- model servingmodel serving, n.: Running a trained AI model as a live service, so that apps and people can send it requests and get answers back quickly, reliably and at a sensible cost.
Sources
- Anthropic (2024). Introducing the Model Context Protocol. anthropic.com/news/model-context-protocol
- Linux Foundation (2025). Linux Foundation Announces the Formation of the Agentic AI Foundation. Press release, 9 December 2025. linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation
Mentioned in
Model Context ProtocolModel Context Protocol, prop. n.: An open standard that lets AI assistants plug into outside apps and data — files, calendars, databases, business software — through one common connector instead of a custom link for every pairing; often likened to a USB-C port for AI., AI supply chain securityAI supply chain security, n.: Protecting everything an AI system is built from — downloaded models, datasets, code libraries and tools — against tampering, so a poisoned or fake part cannot sneak into the finished product., tooltool, n.: Any outside capability an AI model is allowed to use — a web search, a calculator, a code runner, a database or an app — described to the model so it can ask for it by name., code modecode mode, n.: A way for AI agents to use tools by writing a short program that calls them, instead of asking for each tool one step at a time., tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them.