What is the Model Context Protocol (MCP)? A beginner's guide

The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to external systems such as files, databases and tools. Anthropic released it on 25 November 2024 and donated it to the Linux Foundation's Agentic AI Foundation on 9 December 2025. A server describes what it offers, and any MCP-capable application, including Claude Code, Cursor and Visual Studio Code, can use it.

What problem does MCP solve?

Before MCP, every connection between an AI application and a data source needed its own custom code. Anthropic's launch post of 25 November 2024 describes exactly this: every new data source required its own custom implementation, and MCP replaces those fragmented integrations with a single protocol.

The arithmetic shows why that matters. Take a hypothetical team in Pune with 3 AI applications and 4 internal systems. Without a shared protocol, each application needs its own connector to each system, which makes 12 connectors. With MCP, each system gets one server and each application one client, which makes 7 pieces. Adding a fifth system adds one server, not three connectors.

The MCP documentation compares the idea to a USB-C port for AI applications: one standard connector instead of a different cable for each device.

Who created MCP and who governs it now?

Anthropic created and open-sourced MCP. The launch bundled the specification and SDKs, local MCP server support in the Claude Desktop apps and an open-source repository of servers for systems such as Google Drive, Slack, GitHub, Git, Postgres and Puppeteer.

On 9 December 2025 Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. Anthropic said MCP's governance model stays unchanged. The project's own governance page describes it as Model Context Protocol, a Series of LF Projects, LLC, run by contributors, maintainers, core maintainers and lead maintainers, where membership belongs to individuals rather than companies.

In the same December 2025 post Anthropic reported more than 10,000 active public MCP servers and adoption by ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code. Those are Anthropic's figures from that date, not a current count. The specification is versioned by date, and the current revision on 7 November 2026 is 2026-07-28.

How does MCP work: hosts, clients and servers?

MCP has three participants. An MCP host is the AI application, such as Claude Code or Claude Desktop. The host creates one MCP client for each MCP server it connects to, and each client keeps a dedicated connection to its server. The server is the program that provides context, whether it runs locally or remotely.

Messages use JSON-RPC 2.0 and travel over one of two transports. A local server using the stdio transport typically serves a single client. A remote server using the Streamable HTTP transport typically serves many.

The 2026-07-28 revision made the protocol stateless. Every request carries the protocol version and the client's capabilities in a _meta field, and a client may call a mandatory server/discover request to learn a server's versions, capabilities and identity. Tutorials that begin with an initialize handshake describe revisions up to 2025-11-25.

What are the three MCP primitives?

A server can offer three kinds of capability. The table shows each primitive, what it contains and who decides when it is used.

Clients discover tools with tools/list and run them with tools/call. Clients can also offer a primitive of their own: elicitation, which lets a server ask the user for more information. Sampling and protocol logging are deprecated as of 2026-07-28, so a beginner can skip them even though older guides teach sampling as a core feature.

How is MCP different from function calling and REST APIs?

Function calling, also called tool calling, is how a model asks an application to run a function. OpenAI's guide describes five steps: send a request with the tools the model could call, receive a tool call, run the code in the application, send the output back, and receive the final response. Anthropic's documentation puts it plainly: the model never runs anything on its own.

MCP does not replace that exchange. The MCP architecture page says MCP focuses solely on the protocol for context exchange and does not dictate how applications use LLMs. A host fetches tools from servers with tools/list, hands them to the model through ordinary tool calling and routes each call to the right server with tools/call. OpenAI's function-calling guide lists access to an MCP server among its built-in tools, so the two are used together.

A REST API is written for developers, who read documentation and write code against its endpoints. An MCP server is written for an AI application: it lists its tools with descriptions and schemas at run time, so a host can discover them without custom code. An MCP server can wrap an existing REST API.

For one application calling one API, direct function calling or a plain REST call is simpler. MCP pays off when several applications need the same tools, which is the 3 by 4 situation above.

What does a first MCP server look like?

The official Python SDK is the package mcp, version 2.3.0 on PyPI, MIT licensed and requiring Python 3.11 or later according to its README. The sample below is a hypothetical finance helper with one tool, one resource and one prompt. The decorators build the JSON Schema from the type hints and docstring, so none is written by hand.

from mcp.server import MCPServer

mcp = MCPServer("Finance helper")

@mcp.tool()
def lakh_to_rupees(lakh: float) -> int:
    """Convert an amount in lakh to rupees."""
    return round(lakh * 100_000)

@mcp.resource("policy://refunds")
def refund_policy() -> str:
    """The refund policy text."""
    return "Refunds above Rs 500 need manager approval."

@mcp.prompt()
def check_refund(amount: int) -> str:
    """Ask the model to check a refund against the policy."""
    return f"Does a refund of Rs {amount} need manager approval? Use policy://refunds."

if __name__ == "__main__":
    mcp.run()

A client can launch that file as a subprocess over stdio, list what it offers and call the tool:

import asyncio
import sys
from mcp import Client, StdioServerParameters

async def main() -> None:
    params = StdioServerParameters(command=sys.executable, args=["server.py"])
    async with Client(params) as client:
        print([t.name for t in (await client.list_tools()).tools])
        print([str(r.uri) for r in (await client.list_resources()).resources])
        print([p.name for p in (await client.list_prompts()).prompts])
        print((await client.call_tool("lakh_to_rupees", {"lakh": 12.5})).structured_content)
        print((await client.read_resource("policy://refunds")).contents[0].text)

asyncio.run(main())

Output from saving the two files as server.py and client.py and running the second with Python 3.12 and mcp 2.3.0:

['lakh_to_rupees']
['policy://refunds']
['check_refund']
{'result': 1250000}
Refunds above Rs 500 need manager approval.

Underneath, the call is plain JSON-RPC. Sending a tools/call line to the same server over stdin, with no initialize step, returned the result below (trimmed; every request also carries the three _meta keys for protocol version, client info and client capabilities):

{"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "lakh_to_rupees", "arguments": {"lakh": 12.5}}}
{"jsonrpc": "2.0", "id": 2, "result": {"content": [{"type": "text", "text": "1250000"}], "isError": false, "structuredContent": {"result": 1250000}}}

The SDK's README says mcp dev server.py opens the MCP Inspector for testing a server in the browser. The SDK's v2 notes also say FastMCP is now called MCPServer, so older tutorials show a different import. The free agentic AI courses list two free MCP courses, from Hugging Face and Anthropic Academy.

What are the security limits of MCP?

A tool can read files, call APIs and change data, so a protocol that makes tools easy to connect also makes mistakes easy to connect. The specification says there should always be a human in the loop with the ability to deny tool invocations, and that applications should show which tools are exposed, indicate when they run and ask for confirmation.

A warning in the AutoGen README says to connect only to trusted MCP servers, because they may execute commands in the local environment or expose sensitive information. MCP's security guidance describes the confused deputy problem, in which an attacker abuses an MCP proxy server that talks to third-party APIs to obtain authorisation without proper user consent.

OWASP's Excessive Agency entry (LLM06:2025) gives a rule that fits MCP servers: avoid open-ended tools such as running any shell command, and give each tool the minimum functionality and permissions it needs. A server that exposes a narrow read-only tool is safer than one that exposes a general shell. Agentic AI interview questions often probe exactly this point.

Where does MCP fit in an AI and ML programme?

Certification in Artificial Intelligence and Machine Learning is an online programme from Vishlesan i-Hub, IIT Patna, delivered on Masai's online platform, that covers Python, machine learning, deep learning, generative AI and LLMs, agentic systems and deploying models to production. MCP is one way an agent reaches data and tools, so it pairs naturally with the programme's module on Generative AI, LLM Engineering and Agentic Systems. For how tools fit into an agent's loop, see the core elements of an AI agent.

Frequently asked questions

What problem does MCP solve?

MCP removes the need for custom code between every AI application and every data source. Anthropic's launch post says each new source otherwise required its own implementation. With one protocol, a system exposes a single MCP server and any MCP-capable application can connect to it through a client.

Which company created the Model Context Protocol, and when?

Anthropic created and open-sourced MCP on 25 November 2024. On 9 December 2025 it donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. Day-to-day decisions remain with the project's maintainers under its published governance model.

How is MCP different from function calling?

Function calling is the exchange in which a model requests a tool call and the application runs it. MCP standardises where tool definitions come from and how calls reach the code, using servers that list tools at run time. A host uses MCP to fetch tools and ordinary function calling to give them to the model.

Is MCP the same as an API?

No. A REST API exposes endpoints that a developer calls from code. An MCP server exposes tools, resources and prompts that an AI application discovers and uses at run time through a standard protocol. An MCP server can wrap a REST API, but the two serve different readers.

Do you need Python to build an MCP server?

No. Cursor's documentation says MCP servers can be written in any language that can print to standard output or serve an HTTP endpoint, and official SDKs exist for several languages. The official Python SDK needs Python 3.11 or later according to its README, and Anthropic Academy's MCP course lists working Python knowledge as a prerequisite.

Next step

Run the finance helper above, connect it to an MCP-capable application and note which of its tools you would hesitate to let a model call without approval. The Certification in Artificial Intelligence and Machine Learning page lists the agentic systems and deployment modules for readers who want a structured route into building agents.