Quick answer: what MCP is
The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to external systems: data sources, tools and workflows. Its own documentation calls it a USB-C port for AI applications. Anthropic open-sourced MCP on 25 November 2024. As of September 2026 the MCP docs name Claude, ChatGPT, Visual Studio Code and Cursor among the apps that connect to MCP servers, which is their own naming rather than a full roster. Everything below comes from the protocol's documentation and specification, and from vendors' official pages read in September 2026.
What MCP stands for and what problem it solves
MCP stands for Model Context Protocol. Anthropic presented it as a fix for one specific annoyance. Every new data source needed its own custom integration, so the same plumbing got rebuilt for each assistant and each system. One protocol replaces that pile of one-off connectors. The documentation names three groups that benefit. Developers write an integration once instead of once per assistant. AI applications and agents get a consistent way to reach context and take action. End users get assistants that touch their actual systems rather than talk about them.
The documentation's examples are deliberately ordinary: an agent reads a user's Google Calendar and Notion, Claude Code generates a web app from a Figma design, and enterprise chatbots query multiple databases. In theory none of that needs a new protocol. In practice each case used to need its own glue code. MCP gave that glue a standard shape.
How MCP works: hosts, clients and servers
The architecture page defines three roles. The host is the AI application that coordinates one or more clients. Each client holds a connection to exactly one server. A server is a program that provides context to clients. Hosts create one client per server, so three servers mean three clients with three dedicated connections.
"Stdio transport : Uses standard input/output streams for direct process communication between local processes on the same machine ... Streamable HTTP transport : Uses HTTP POST for client-to-server messages with optional Server-Sent Events ... This transport enables remote server communication"
Source: modelcontextprotocol.io
Underneath, MCP uses JSON-RPC 2.0, with notifications for messages that need no response. It defines two transports. The stdio transport covers local processes on the same machine as the host. Streamable HTTP covers remote servers, using HTTP POST with optional Server-Sent Events. That transport supports standard HTTP authentication methods, and MCP recommends OAuth for obtaining tokens.
Specification version 2026-07-28 makes the base protocol JSON-RPC with stateless, self-contained requests and per-request capability negotiation. Specification version 2025-06-18 describes stateful connections with server and client capability negotiation. Both versions are published. That is what changed between them, not one being wrong.
A single tool call runs like this.
- You ask the assistant for something that needs an outside system.
- The client lists what its server offers, tools first for example.
- The model picks a tool and emits the call.
- The host intercepts it and routes it to the right MCP server.
- The server executes it and returns a result. The host passes that result to the model as part of the conversation.
The building blocks: tools, resources and prompts
| Primitive | Who controls it | What it is for | Example |
|---|---|---|---|
| Tools | Host invokes, user consents first | Executable functions the model calls | Query a database, create an issue |
| Resources | Server provides, client reads | Data that adds context | Calendar entries, Notion pages |
| Prompts | Server offers, client lists them | Reusable interaction templates | Template that shapes a request |
| Sampling (deprecated 2026-07-28) | Server asks the client's AI app | Request a model completion | Ask the client's model to draft text |
| Elicitation | Server asks, user answers | Get extra input or confirmation | Ask for a missing detail |
Tools are executable functions the AI application can invoke. Resources are the data sources that provide contextual information. Prompts are reusable templates that structure interactions with language models. A client lists what a server offers, then calls what it needs.
Two features sit at the client end. Elicitation lets an MCP server request extra information or confirmation from the user, so it can ask for a missing detail instead of failing. Sampling let servers request language model completions from the client's AI application. As of protocol version 2026-07-28 it is deprecated, and new implementations are told to integrate directly with LLM provider APIs. In specification version 2025-06-18 clients could still offer sampling and roots to servers, which is why older material lists both.
Who created MCP and who runs it now
David Soria Parra and Justin Spahr-Summers created MCP at Anthropic, and Anthropic open-sourced it on 25 November 2024. The launch shipped three things: the specification and SDKs, local MCP server support in the Claude Desktop apps, and an open-source repository of MCP servers. As named in Anthropic's launch announcement of 25 November 2024, Block and Apollo were early adopters, and Zed, Replit, Codeium and Sourcegraph were development tools companies working with it. That is who Anthropic named at launch, not a current adopter list. Names, ownership and branding have moved since.
Stewardship has since moved: the modelcontextprotocol.io footer states that the Model Context Protocol is a Series of LF Projects, LLC. Specifications are versioned by date. The 2025-06-18 specification page is marked as an older version and points to 2026-07-28 as the latest.
MCP servers and clients you can use today
The documentation lists seven current reference servers: Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking and Time. Early ones including GitHub, Google Drive and Puppeteer are now archived. The official repository holds only the steering group's reference servers. It warns they are educational examples rather than production-ready solutions, and points to the MCP Registry at registry.modelcontextprotocol.io.
"Each MCP client requires its own MCP server. ... but only one server per named MCP client. ... There is no limit on the number of tools you can add to a server, or the number of tool calls you can make per session. The only usage limit is the task allowance included with your Zapier plan ."
Source: docs.zapier.com
Vendor servers do the day-to-day work, and Cloudflare documents building and deploying your own on its platform. Each line below comes from that vendor's own documentation, read in September 2026. Most of those pages carry no update date.
- GitHub: repositories, code files, issues, pull requests and workflow automation, plus a GitHub-hosted remote version, per its README as of September 2026.
- Notion: a Notion-hosted remote server where, after an OAuth authorisation, clients such as Claude Code or Cursor search, read and update content, as of September 2026.
- Stripe: labelled public preview as of September 2026, with tools for the Stripe API and its knowledge base, authorised by OAuth rather than a shared API key.
- Atlassian: search and summaries across Jira, Jira Service Management, Confluence, Bitbucket, Projects and Goals under permission-respecting OAuth 2.1. Per its support docs as of September 2026, calls draw Rovo credits from a shared organisation pool at no stated rate.
- HubSpot: read and write access to HubSpot CRM data, requiring the new HubSpot Developer Platform, per its developer docs as of September 2026.
- Supabase: tool groups with everything except Storage on by default, a read-only Postgres mode, and experimental branching tools needing a paid plan the page does not name, as of September 2026.
- Playwright: browser automation through structured accessibility snapshots instead of screenshots, needing Node.js 18 or newer, as of September 2026.
Automation platforms wrap their catalogues too. Zapier's documentation states that each successful Zapier MCP tool call uses two tasks from your Zapier plan, and that failed calls do not count. Its own page at zapier.com/mcp calls MCP available on all Zapier plans as of September 2026 and badges it MCP Beta in its hero. According to IFTTT's MCP page, as of September 2026, its MCP server lets AI tools search, build and run automations across more than 1,000 services and more than 50 million applets. Both are IFTTT's own counts. The paid plan in its setup steps is the AI tool's own, linked as Claude paid plans. Latenode, whose blog this is, meters on a different axis, and no page read here says whether it exposes an MCP server. As of September 2026 its pricing page bills workflow runtime in CPU seconds rather than per operation or per step, and charges per CPU second once the included volume is spent. The first 10,000 CPU seconds are free every month on the Free and Pay as you go plans, and the Free plan costs $0 a month with no credit card required.
MCP versus function calling, plugins and APIs
Function calling is a model feature inside one application: that application defines the functions, the model asks for one and the application runs it. Nothing travels. MCP is a protocol, so a server written once answers any client that speaks it. A plugin belongs to the product that hosts it. That ownership is what MCP moves: the integration no longer belongs to the assistant.
APIs do not go away. An API still sits behind an MCP server. The server standardises how a model discovers that API and calls it, listing capabilities before invoking one. According to OpenAI's platform documentation, as of September 2026, connectors are OpenAI-maintained MCP wrappers for popular services, with Google Workspace and Dropbox as its own examples. Both connectors and remote MCP servers count there as capabilities beyond function calling.
| Approach | Scope | Reuse across apps | Best fit |
|---|---|---|---|
| Function calling | One model in one app | No, the app defines it | Logic inside your own app |
| Product plugin | One host product | No, tied to that product | Features for that product |
| Direct API call | One fixed integration | Not applicable | A single stable integration |
| MCP server | Any client speaking MCP | Yes, one protocol | Many clients, many systems |
One exception: with a single fixed integration, MCP adds a moving part you do not need.
Security and consent: what the protocol asks of you
Specification 2026-07-28 requires explicit user consent for all data access and operations, and consent before user data is exposed to a server. Clear interfaces for reviewing and authorizing activity sit one level down: the specification says implementors should provide them, not must. It also warns that tools represent arbitrary code execution, so hosts must obtain explicit user consent before invoking any tool. MCP cannot enforce that at the protocol level. Implementors are told to build solid consent and authorization flows into their own applications.
OpenAI's platform documentation, as of September 2026, warns that remote MCP servers have not been verified by OpenAI. It flags prompt injection as a particular risk when a model can reach servers holding sensitive data or taking action. Its advice: official servers hosted by the service providers themselves, plus the require_approval and allowed_tools parameters so sensitive actions go through an approval flow. The same page says OpenAI requests the developer's approval by default before data reaches a connector or remote MCP server. That default require_approval can change, so it is no guarantee. Stripe's documentation, as of September 2026, requires human confirmation before certain write actions, naming refunds and outbound payments as examples. Cloudflare recommends several focused servers with narrowly scoped permissions to reduce over-privileged access. In practice: least-privilege tokens, approve anything that writes or sends, prefer official servers.
How to try MCP in ten minutes
- Pick a client that supports MCP. As of September 2026 the MCP docs name Claude, ChatGPT, Visual Studio Code, Cursor and MCPJam, their own list rather than a full roster.
- Choose a server: a reference server such as Fetch, Filesystem or Memory, an official vendor server, or something from the registry at registry.modelcontextprotocol.io.
- Add it to your client's configuration. A local server goes in by the command that launches it, for example the documentation's memory server started with npx -y @modelcontextprotocol/server-memory. A remote server goes in by its URL plus authentication.
- Check that your host handles remote servers. GitHub's README, as of September 2026, names VS Code 1.101 or newer, Claude Desktop, Cursor and Windsurf. Host support moves quickly, so check the host's current docs.
- Approve the connection, then expect a second prompt on first use: with Zapier MCP the client asks you to approve the first tool run.
- Ask the assistant to do one small thing that needs the server, then check the result against the source system.
