Model Context Protocol
In plain wordsAn open standard that lets AI assistants plug into outside apps and data — files, calendars, databases, business software — through one common connector instead of a custom link for every pairing; often likened to a USB-C port for AI.
An open standard that gives AI applications one common way to reach outside software and data. In its client–server design the AI application — the host, such as a chat client, code editor or coding agentcoding agent, n.: An AI agent that writes and fixes software by itself: it reads a codebase, edits files, runs commands and tests, and keeps working until a feature is built or a bug is fixed. — keeps a separate client connection to each MCP serverMCP server, n.: A small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol., and a server can offer three kinds of capability: toolstool, n.: Any outside capability an AI model is allowed to use — a web search, a calculator, a code runner, a database or an app — described to the model so it can ask for it by name. the model may invoke, resources such as files or records that the application can pull into context, and prompts, prewritten templates a user can pick. Messages use JSON-RPC 2.0, carried over standard input/output for local servers or HTTP for remote ones, with OAuth-based authorization for remote access. Standardizing the interface turns an M×N integration problem (every application wired to every service) into M+N. The message design borrows from the Language Server Protocol used by code editors. Security problems — tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them., prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger. through tool results, over-broad permissions and malicious servers — have shaped successive revisions; the 2026-07-28 specification made the core protocol stateless and moved features such as long-running tasks into optional extensions.
Instead of writing a Jira integration for each assistant, we published one MCP server.
Origin
Created at Anthropic by David Soria Parra and Justin Spahr-Summers and open-sourced on 25 November 2024 with SDKs and reference servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer. OpenAI adopted it in March 2025, followed by Google DeepMind, Microsoft and others; in December 2025 Anthropic donated it to the Linux Foundation's Agentic AI FoundationAgentic AI Foundation, prop. n.: A nonprofit group under the Linux Foundation that looks after shared, open technical standards for AI agents, such as the Model Context Protocol, so that no single company controls them..
Usage note
MCP standardizes how tools and context are served to an application; it does not dictate how a model requests tools (function callingfunction calling, n.: A feature of AI model services that lets the model reply with a neatly formatted request to run one of a program's functions, rather than with ordinary text; the program, not the model, then runs it.) or how independent agents talk to each other (see Agent2Agent protocolAgent2Agent protocol, prop. n.: An open standard that lets AI agents built by different companies find each other, say what they can do and work together on tasks, much as email lets different mail systems exchange messages.). By December 2025 more than 10,000 public MCP servers had been published.
Related
- MCP serverMCP server, n.: A small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol.
- tooltool, n.: Any outside capability an AI model is allowed to use — a web search, a calculator, a code runner, a database or an app — described to the model so it can ask for it by name.
- function callingfunction calling, n.: A feature of AI model services that lets the model reply with a neatly formatted request to run one of a program's functions, rather than with ordinary text; the program, not the model, then runs it.
- Agent2Agent protocolAgent2Agent protocol, prop. n.: An open standard that lets AI agents built by different companies find each other, say what they can do and work together on tasks, much as email lets different mail systems exchange messages.
- Agentic AI FoundationAgentic AI Foundation, prop. n.: A nonprofit group under the Linux Foundation that looks after shared, open technical standards for AI agents, such as the Model Context Protocol, so that no single company controls them.
- tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them.
- agent skillagent skill, n.: A packaged how-to guide for an AI agent — written steps, sometimes with small programs and examples attached — that sits unread until a job of that kind comes up, when the agent opens it.
- Agent2Agent protocolAgent2Agent protocol, prop. n.: An open standard that lets AI agents built by different companies find each other, say what they can do and work together on tasks, much as email lets different mail systems exchange messages.
Sources
- Anthropic (2024). Introducing the Model Context Protocol. 25 November 2024. anthropic.com/news/model-context-protocol
- Soria Parra, D. & Delimarsky, D. (2026). The 2026-07-28 Specification. Model Context Protocol blog, 28 July 2026. blog.modelcontextprotocol.io/posts/2026-07-28
Mentioned in
AnthropicAnthropic, prop. n.: An American AI company that makes the Claude chatbot and models. It was founded in 2021 by former OpenAI staff and puts particular emphasis on AI safety research., agent skillagent skill, n.: A packaged how-to guide for an AI agent — written steps, sometimes with small programs and examples attached — that sits unread until a job of that kind comes up, when the agent opens it., Agent2Agent protocolAgent2Agent protocol, prop. n.: An open standard that lets AI agents built by different companies find each other, say what they can do and work together on tasks, much as email lets different mail systems exchange messages., Claude CodeClaude Code, prop. n.: A coding assistant from Anthropic that works as an agent: given a programming task, it explores the project, changes the code and runs programs to check its work, from the web, a desktop app, an editor or a terminal., context poisoningcontext poisoning, n.: When a mistake or a planted falsehood gets into an AI's working notes or memory and the AI keeps relying on it, so the error grows over later steps., function callingfunction calling, n.: A feature of AI model services that lets the model reply with a neatly formatted request to run one of a program's functions, rather than with ordinary text; the program, not the model, then runs it., JSON SchemaJSON Schema, prop. n.: A standard way of writing down exactly what a piece of JSON data must look like — which fields, of which types — so that software and AI models can check it or follow it., lethal trifectalethal trifecta, n.: A rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over., MCP serverMCP server, n.: A small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol., OpenAI-compatible APIOpenAI-compatible API, n.: An AI service that accepts the same request format as OpenAI's, so software written for OpenAI's models can use other companies' or self-hosted models by changing an address and key., tooltool, n.: Any outside capability an AI model is allowed to use — a web search, a calculator, a code runner, a database or an app — described to the model so it can ask for it by name., tool usetool use, n.: An AI model's ability to reach beyond its own knowledge by operating outside tools — searching the web, running code, using a calculator or an app — and folding the results into its work., Agentic AI FoundationAgentic AI Foundation, prop. n.: A nonprofit group under the Linux Foundation that looks after shared, open technical standards for AI agents, such as the Model Context Protocol, so that no single company controls them., AI gatewayAI gateway, n.: A checkpoint between an organization's apps and the AI models they use that handles access, costs, logging, safety checks and switching between providers in one place., ChatGPT pluginsChatGPT plugins, prop. n.: Add-ons, launched in 2023 and retired in 2024, that let ChatGPT use outside services — web browsing, a code runner, travel booking or shopping sites — while answering a user., code modecode mode, n.: A way for AI agents to use tools by writing a short program that calls them, instead of asking for each tool one step at a time., externalizationexternalization, n.: Moving an AI agent's know-how and memory out of the model itself and into files, tools and rules around it, so the whole system can do more than the model alone., tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them.