What Is an MCP Server? MCP Meaning, How It Works and Examples (Nov 2026)

An MCP server is a small program that gives an AI app new abilities. It tells the app which tools and data it offers, such as "search my GitHub issues" or "read this folder". The AI model decides when to use them, and the app runs them. MCP (Model Context Protocol) is the open standard they speak.

Without MCP, an AI assistant can only use what's in the chat. With an MCP server plugged in, it can look things up, read files, or take actions in another app. You add a server once, and any app that speaks MCP can use it.

What does MCP stand for? (MCP meaning)

MCP stands for Model Context Protocol. "Model" is the AI model, "context" is the extra information and tools it gets, and "protocol" means a shared set of rules for passing messages.

The official specification describes it as "an open protocol that enables seamless integration between LLM applications and external data sources and tools."

A short history:

• November 25, 2024: Anthropic open-sourced MCP as "a new standard for connecting AI assistants to the systems" where data lives.
• December 9, 2025: Anthropic donated MCP to the Agentic AI Foundation, "a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI."
• Today: the current spec version is dated 2026-07-28.

So when people say "MCPs", they usually mean MCP servers: the plug-ins themselves, not the protocol. "What is a MCP server" and "what is an MCP server" are the same question; the correct article is "an", because MCP is spoken letter by letter ("em-see-pee").

What does an MCP server do? A worked example

Say you use Claude with the GitHub MCP server added. You type: "Which issues are still open on my website repo?"

1. The app already knows the tools. When it connected, the GitHub server listed what it can do, each tool with a name, a short description and the inputs it needs.
2. The model picks one. Claude reads your question, sees a tool for listing issues, and fills in the repo name.
3. You approve it. The app asks before running the tool (most apps let you allow a tool once or always).
4. The server does the work. It calls GitHub's normal API with your token and sends back the result.
5. The model answers. Claude reads the result and replies in plain words.

You never wrote code. The server did the API work; the model decided what to ask for.

Hosts, clients and servers

The spec names three parts. You will see these words in every MCP setup guide.

Part	What it is	Example
Host	The AI app you use. The spec calls it the "LLM application that initiates connections".	Claude Desktop, Claude Code, Cursor, VS Code
Client	A connector inside the host. Each client "communicates with exactly one server".	One per server you add
Server	The program that provides "context and capabilities".	GitHub, Filesystem, Playwright, Notion

MCP server vs MCP client: the client lives inside your AI app and does the asking. The server is the separate program that does the work. You install or connect servers; your app handles the clients for you.

One design rule matters for safety. Per the architecture page, servers "should not be able to read the whole conversation, nor 'see into' other servers." The host decides what each server gets to see.

What can an MCP server offer? Tools, resources and prompts

The spec lists three features a server can provide:

Feature	What the spec says	In plain words
Tools	"Functions for the AI model to execute"	Actions: search, create a ticket, run a query
Resources	"Context and data, for the user or the AI model to use"	Things to read: a file, a database schema, a doc
Prompts	"Templated messages and workflows for users"	Ready-made instructions you pick from a menu

Most servers are mostly tools. The difference between the three is about who decides when they get used; we cover it in MCP resources vs tools.

A tool definition is short. This is the kind of thing a server sends when the app asks what it can do:

{
  "name": "list_issues",
  "description": "List open issues in a GitHub repository",
  "inputSchema": {
    "type": "object",
    "properties": {
      "owner": { "type": "string" },
      "repo": { "type": "string" }
    },
    "required": ["owner", "repo"]
  }
}

The model only ever sees that name, description and input list. That is why a clear description matters, and why a misleading one is a security problem (more below).

Local and remote MCP servers

An MCP server runs in one of two places.

• Local (stdio). Your AI app starts the server as a program on your own computer and talks to it through standard input and output. Nothing listens on the network. Most servers that read files or run commands work this way. See local MCP server.
• Remote (Streamable HTTP). The server runs on someone else's machine, usually the vendor's. Your app sends each message as an HTTP request to one web address. You sign in with OAuth instead of pasting a key. See MCP authentication.

These are the two standard transports in the spec. Remote servers are easier to set up; local ones keep your data on your machine.

How an MCP server works under the hood

You don't need this part to use MCP, but it helps when something breaks.

• Messages are JSON-RPC 2.0. Every message is a small JSON object with a method name, such as tools/list (what can you do?) or tools/call (do this, with these inputs).
• Every request stands on its own. In the 2026-07-28 version the spec says "MCP is a stateless protocol: every request is self-contained and carries its own protocol version and capabilities." Older versions started with an initialize handshake; current clients and servers can fall back to that for older counterparts.
• It borrows an old idea. The spec says MCP "takes some inspiration from the Language Server Protocol", which let code editors support any programming language through one standard. MCP does the same for AI apps and outside tools.

To watch the messages yourself, use the MCP Inspector. When a server won't start or its tools don't show up, see MCP server not working.

MCP server examples

Some of the most-used servers in our directory, each with an editorial trust grade:

Server	What it lets the AI do	Runs
GitHub	Read and manage repos, issues and pull requests	Remote or local
Filesystem	Read and write files in folders you allow	Local
Playwright	Drive a real browser: click, type, take snapshots	Local
Context7	Pull current library docs into the chat	Remote or local
Notion	Search and edit pages in your workspace	Remote
Slack	Read channels, search and post messages	Remote
Stripe	Look up customers, payments and invoices	Remote or local
Supabase	Query and manage your database and project	Remote or local
Figma	Read designs so the AI can turn them into code	Remote or local
Tavily	Search the web and pull page content	Remote or local

Browse the rest in the MCP server directory.

How to add an MCP server to your AI app

Each app has its own screen or file for this, but the idea is the same: give the app either a command to start a local server, or a web address for a remote one.

A local server in a JSON config file (the mcpServers format Claude Desktop, Cursor and others use) looks like this, here for the official Filesystem server:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/absolute/path/to/project"]
    }
  }
}

In Claude Code you add a remote server with one command: claude mcp add --transport http notion https://mcp.notion.com/mcp. Full steps: Claude Code MCP setup and VS Code MCP setup.

Are MCP servers safe?

They can be, but treat each one like software you install with your own permissions. The spec is blunt: "Tools represent arbitrary code execution and must be treated with appropriate caution." It also says tool descriptions "should be considered untrusted, unless obtained from a trusted server."

The main risks, in plain words:

• Too much access. A server with your full GitHub token or your whole disk can do anything you can. Give it the smallest scope that works.
• Prompt injection. Text the server reads (a web page, an issue, an email) can contain hidden instructions the model then follows. See MCP prompt injection.
• Bad or abandoned packages. Anyone can publish a server. Some have known vulnerabilities; some stop getting fixes.
• Too many tools. Every tool's description takes up room in the model's context and gives it more ways to pick the wrong one. See limit MCP tools.

That's why every listing here has a trust grade. We check who publishes it, known CVEs, maintenance, permissions and auth; the method is in how TrustedMCP scores servers. The longer read is are MCP servers a security risk.

MCP vs API

An API lets your code call a service. MCP lets an AI model find and call it. Most MCP servers are a thin layer over a normal API: the Stripe server calls Stripe's API, the GitHub server calls GitHub's. If your own code already knows which call to make, a plain API is simpler. Full comparison: MCP vs API.

Can I build my own MCP server?

Yes. Official SDKs exist for TypeScript, Python and several other languages, and a basic server with one tool is a short file. The hard parts are auth, input checks and keeping the tool list small. Our build a secure MCP server guide walks through it.

If you'd rather have one built for your product or internal systems, we do that: tell us what you need.

Frequently asked questions

What is an MCP server in simple terms?

A plug-in for AI apps. It gives an assistant like Claude or Cursor a set of tools (search, read files, create tickets) that the model can use when your question needs them.

What is a MCP server used for?

To connect an AI app to something outside the chat: a code host like GitHub, your files, a browser, a database or a payments account. The server lists its tools, the model picks one, and the app runs it with your approval.

What does MCPs mean?

"MCPs" is shorthand for MCP servers, the plug-ins that add tools and data to an AI app. MCP itself stands for Model Context Protocol, the open standard they all follow.

What does MCP mean in Claude?

The same thing as everywhere else: Model Context Protocol. Claude Desktop, Claude Code and claude.ai can connect to MCP servers (claude.ai calls remote ones "connectors"), so Claude can use outside tools and data.

Is MCP only for Claude?

No. Anthropic created it, but it's an open standard now run under the Linux Foundation's Agentic AI Foundation. Cursor, VS Code and many other AI apps support MCP servers too.

What is the difference between an MCP server and an MCP client?

The client is the connector inside your AI app; it asks. The server is the separate program that does the work and answers. One client talks to exactly one server.

Are MCP servers free?

Most are open source and free to run. Remote servers from vendors are usually free to connect, but you still need an account with that service, and paid APIs still charge for usage.

Do I need to code to use an MCP server?

No. You paste a config snippet or a web address into your AI app, or run one command. Coding only comes in if you want to build your own server.

Can an MCP server see my whole chat?

It shouldn't. The spec says servers receive only what they need and that the full conversation stays with the host app. A server does see whatever the model sends to its tools, so don't pass secrets through a server you don't trust.