MCP, the Model Context Protocol, is an open standard that lets an AI application call tools and read data from systems it was never built to know about. An MCP server is a small program that exposes tools, resources, and prompts over JSON-RPC 2.0, either as a local process on stdio or as a remote HTTP endpoint. It is not an alternative to APIs, it is a uniform wrapper around them, and it is not RAG, which is a retrieval strategy rather than a transport. Anthropic released MCP on 25 November 2024 and donated it to the Linux Foundation on 9 December 2025.
- MCP standardises how an AI app discovers and calls tools. That is the entire scope.
- An MCP server is a program exposing tools, resources, and prompts over JSON-RPC 2.0.
- Two transports: stdio for local processes, Streamable HTTP for remote services.
- MCP does not replace APIs. Nearly every server is a wrapper around one.
- MCP is not RAG. Different layer. They compose rather than compete.
- It is not free: tools cost context, and a tool server runs with its own credentials.
The definition, without the analogy
The Model Context Protocol is an open specification for how an AI application asks an external program what it can do, and then asks it to do one of those things. A client sends tools/list and gets back a set of named functions with JSON Schema parameters. It sends tools/call with a name and arguments and gets back content. That exchange rides on JSON-RPC 2.0.
The reason this is a standard rather than a library is combinatorial. Before it, every AI product wrote its own integration for every tool: N applications times M tools. MCP makes a tool integration written once work in every client that speaks the protocol, which as of August 2026 includes Claude Code, Claude, ChatGPT, Cursor, VS Code, Gemini, and most of the rest.
Host, client, server
| Role | What it is | Example |
|---|---|---|
| Host | The AI application coordinating everything | Claude Code, Claude Desktop, VS Code |
| Client | One connection manager per server, inside the host | Created automatically; you never see it |
| Server | The program exposing tools and data | The GitHub server, a local database server |
Anthropic published MCP on 25 November 2024 with a Python and a TypeScript SDK. On 9 December 2025 it was donated to the Agentic AI Foundation, a directed fund under the Linux Foundation, alongside Block's goose and OpenAI's AGENTS.md. That governance change matters for one practical reason: the protocol is no longer any single vendor's to change, which is why building against it is a safer bet in 2026 than it was in 2025.
What an MCP server actually is
A server exposes up to three kinds of thing. Most expose only the first.
The three server primitives, with the methods that back them.
| Primitive | What it does | Methods |
|---|---|---|
| Tools | Functions the model can call to act | tools/list, tools/call |
| Resources | Data the client can read as context | resources/list, resources/read |
| Prompts | Reusable templates the user can invoke | prompts/list, prompts/get |
In Claude Code these land in three different places. Tools become callable functions named mcp__<server>__<tool>, which is the name you write in a permission rule or a hook matcher. Resources appear in the @ autocomplete as @server:protocol://path. Prompts appear as slash commands named /mcp__servername__promptname.
The two transports
| stdio | Streamable HTTP | |
|---|---|---|
| Runs | As a child process on your machine | On someone else's infrastructure |
| Message channel | stdin and stdout | HTTP POST, with optional SSE streaming |
| Auth | Environment variables you pass it | OAuth, bearer tokens, custom headers |
| Serves | Usually one client | Many clients at once |
| Latency | No network hop | A network hop per call |
| Typical use | Filesystem, local database, custom scripts | SaaS vendors: GitHub, Sentry, Linear, Stripe |
A third transport, SSE, still exists in the wild and is deprecated in favour of Streamable HTTP. A handful of vendors have not migrated, which is why Claude Code still ships --transport sse.
# remote, HTTP, OAuth at first use
claude mcp add --transport http sentry https://mcp.sentry.dev/mcp
# local, stdio, credentials passed as env
claude mcp add --env AIRTABLE_API_KEY=YOUR_KEY --transport stdio airtable \
-- npx -y airtable-mcp-server
claude mcp listMCP vs API: not a competition
This is the most common misreading of MCP, and it is worth being blunt about: MCP is not a replacement for REST or GraphQL. Open the source of almost any MCP server and you will find HTTP calls to a normal API. The GitHub MCP server calls the GitHub API. The Stripe one calls Stripe. MCP is the layer above, and what it standardises is not the transport to the vendor, it is the description handed to a model.
The genuine differences, once you stop treating them as alternatives.
| A REST or GraphQL API | MCP | |
|---|---|---|
| Consumer | A programmer writing code | A model choosing at runtime |
| Discovery | Docs, an OpenAPI file, a client SDK | tools/list, at connection time |
| Shape | Whatever the vendor designed | Uniform across every server |
| Auth | Per-vendor, per-SDK | OAuth or headers, handled by the host |
| Errors | Vendor-specific status codes | JSON-RPC errors and content |
| Who wires it up | You, per integration | One config line per server |
| Statefulness | Varies | Stateless per request as of the 2026-07-28 revision |
The practical consequence for a team: if you already have an internal API, you do not migrate it to MCP. You write a thin MCP server in front of it that exposes the eight operations an agent should actually be allowed to perform, with tight schemas and a credential scoped to those eight. That is a very different job from publishing the API.
MCP vs RAG: different layers
Retrieval-augmented generation is a strategy: embed a corpus, find the passages most relevant to a question, put them in the prompt. MCP is a protocol: how an application talks to an external program. Comparing them is a category error, but the comparison keeps getting made because both answer the same user-level complaint, which is that the model does not know about your stuff.
| RAG | MCP | |
|---|---|---|
| Kind of thing | A retrieval technique | A wire protocol |
| Data movement | You index it ahead of time | Fetched live, per call |
| Freshness | As fresh as the last index run | Current at call time |
| Can it act | No. Read-only by construction | Yes. Tools have side effects |
| Selection | Similarity search picks the chunks | The model picks the tool and arguments |
| Cost driver | Embedding and storage | Tool definitions plus tool output in context |
| Good at | Large static corpora, semantic questions | Live systems, precise lookups, actions |
They compose, and the composition is the interesting part: an MCP server whose one tool runs a vector search over your documentation is RAG delivered over MCP. Several shipped servers are exactly that. Context7 is the widely used example, serving version-pinned library documentation as a tool call instead of asking you to paste it.
What it looks like in a real session
Claude Code is a useful place to see the abstraction because nothing is hidden. Servers are added with one command, and both the configured list and the live connection state are inspectable.
claude mcp add --transport http linear https://mcp.linear.app/mcp
claude mcp listChecking MCP server health…
betterstack: https://mcp.betterstack.com (HTTP) - ! Needs authentication
gbrain: /Users/you/.bun/bin/gbrain serve - ✔ Connected
linear: https://mcp.linear.app/mcp (HTTP) - ✔ Connected
playwright: npx @playwright/mcp@latest - ✔ Connected
node_repl: /Applications/Codex.app/… - ✘ Failed to connectThe client asks what exists
At connect time the host sends tools/list and receives names, descriptions, and JSON Schemas. Nothing has run yet.
The model picks one
The schema is what it picks from, so vague tool descriptions produce wrong calls far more often than people expect.
The host asks you, or does not
Permission rules, approval modes, and any server-declared requiresUserInteraction annotation all land here. This is the last gate before something happens.
The server does the work
With its own credentials, in its own process, over whatever API it wraps. It returns content, which enters the conversation as tool output.
What MCP costs
Every connected server has a price in context, and it is charged on every turn, not once. Historically this was brutal: five servers with a dozen tools each meant a few thousand tokens of schema in front of every message you sent.
Claude Code now defers tool definitions by default, a feature called tool search: only tool names and server instructions load at session start, and full schemas enter context when the model searches for them. You can change it with ENABLE_TOOL_SEARCH, where auto loads schemas upfront if they fit inside 10% of the context window and defers the rest, and false restores the old always-upfront behaviour. Verified against the Claude Code docs in August 2026.
Where the tokens actually go.
| Source | Charged | Lever |
|---|---|---|
| Tool definitions | Every turn, if loaded upfront | Tool search, or fewer servers |
| Server instructions | Every turn | Truncated at 2KB per server anyway |
| Tool output | Once, then carried in history | Ask for less; paginate |
| Failed calls | Same as successful ones | Tighter schemas |
The security shape, stated once
MCP moves capability, and capability is exactly the thing a careful permission model is built to constrain. Three properties are worth holding in your head permanently.
- A server runs as you, with its own credentials. The host's filesystem sandbox governs what the agent touches directly, not what a tool reaches on its behalf. Scope the credential, not the prompt.
- Anything that fetches external content is an instruction channel. A server that reads issues, web pages, or emails can carry text written by someone else into a context where a model is deciding what to do next. This is prompt injection, and it is the failure mode with real incidents behind it.
- Servers accumulate. The one added for a migration eight months ago is still connecting, still costing context, and still holding a credential nobody has rotated. Audit the list on a schedule.
Questions people ask
MCP, the Model Context Protocol, is an open standard for connecting AI applications to external tools and data. A client asks a server what tools it has, then calls them, over JSON-RPC 2.0. Anthropic released it in November 2024 and donated it to the Linux Foundation in December 2025.
A program that exposes tools, resources, and prompts to an AI application over the protocol. It can be a local process your editor launches on stdio, or a remote HTTP endpoint run by a vendor. Server describes the role, not the deployment.
They are different layers. MCP is a uniform way for a model to discover and call capabilities at runtime; most MCP servers are thin wrappers around a normal REST or GraphQL API. MCP does not replace your API, it presents a curated slice of it to a model.
No. RAG is a retrieval technique over a pre-built index and cannot take actions. MCP is a protocol for calling live tools that can. They compose: a server whose tool runs a vector search is RAG delivered over MCP.
They answer different questions. Use retrieval for large static corpora and semantic search. Use MCP when the answer can change while you are asking, or when the agent needs to do something rather than only know something.
Yes, in two places. Tool definitions sit in context, though Claude Code now defers them by default with tool search. Tool output is charged once and then carried in conversation history, which is where a single unbounded query does the real damage.
The Agentic AI Foundation, a directed fund under the Linux Foundation, since 9 December 2025. Anthropic created and donated it; the foundation was co-founded with Block and OpenAI, which is what makes vendor neutrality more than a claim.
With scoped credentials and a reviewed server list, yes. The two real risks are a server holding a credential broader than the task needs, and prompt injection through any server that pulls in external content. Prefer read-only endpoints and treat a server list like a dependency list.
Sources
Every figure above was read from these pages on 3 August 2026. Vendors reprice without notice; if you find a stale number, tell us.