# MCP (Model Context Protocol) Source: https://ordergroup.co/glossary/model-context-protocol/ Last updated: 2026-10-20 > MCP (Model Context Protocol) explained for teams buying AI features: host, client and server, tools, resources and prompts, security and what your system must handle. [AI](https://ordergroup.co/glossary/ai/) 3 min read # MCP (Model Context Protocol) Model Context Protocol Also known as: MCP, MCP server, Model Context Protocol server Definition The Model Context Protocol (MCP) is an open standard that connects AI applications to external data sources and tools. An MCP server publishes a list of tools, each with a name, a description and an input schema, and the AI client asks what is available and lets the model choose. Cite this entry Text "MCP (Model Context Protocol)". Order Group, Software glossary, 20 October 2026. https://ordergroup.co/glossary/model-context-protocol/ HTML `MCP (Model Context Protocol) - Order Group` Reviewed by [Łukasz Gajownik](https://ordergroup.co/experts/lukasz-gajownik/), Head of AI & Frontend Last reviewed 20 October 2026 ## How MCP works MCP uses a client-host-server architecture. The host is the AI application the user works in, such as a chat assistant or a code editor. It creates and coordinates one or more clients and enforces security policies and user consent. Each client connects to exactly one MCP server, and each server exposes capabilities to the model. Messages use JSON-RPC. A server can be a local process on the user's machine or a remote service reached over the network. A server offers three kinds of building blocks: - **Tools** are functions the model can call, such as creating a record or searching a catalog. - **Resources** are data the model can read, for example a log file or a database schema. - **Prompts** are ready-made templates for a type of interaction. Each tool has a name, a description and a typed input schema. The client asks the server which tools are available and passes those descriptions to the model, which picks the tool it needs. Client and server also declare which protocol features they support. The specification dated 2026-07-28 describes MCP as stateless: every request carries its own protocol version and capabilities. By design, a server does not see the whole conversation and cannot look into other servers. The full history stays with the host, and a server only learns what the host passes to it. ## What MCP means for your software An MCP server lets AI agents act in your system, so the server, not the prompt, has to hold the rules. Requirements for any system that exposes an MCP server: - The rules an agent must not break are response codes and validation on the server. An instruction in the prompt can explain a rule, but only the server can enforce it. - Every request carries the token of one person or one integration, and every call is logged, so you can answer which agent did what. - A public scope, if there is one, is separate from the authenticated one and allows only what anyone may do without a token. - The server asks for the smallest scope first and raises permissions only when an operation needs them. - Tool names, descriptions and input schemas are written as carefully as an API contract, because the model chooses tools only from them. - The MCP server calls the existing API where one exists, so validation and permissions are not written twice. - The server declares which protocol versions it supports, and a version change is tested like any other release. MCP does not replace APIs. In many systems the MCP server sits on top of an existing API, which stays the boundary of the service while MCP becomes the boundary of the agent. The comparison is covered in [MCP vs API](https://ordergroup.co/blog/mcp-vs-api/). Writing the specification? Add MCP (Model Context Protocol) to your requirements checklist Collect the terms your project touches and get their system requirements in one e-mail, ready for an RFP. The parts of an MCP setup and what each one does | Part | What it is | What it decides | |---|---|---| | Host | The AI application the user works in | User consent, policies, which servers the user connects | | Client | A connection inside the host to one server | Which capabilities it declares for that server | | Server | A local process or remote service | Which tools, resources and prompts it exposes, and what it allows | | Tools | Functions the model can call | What an agent can change in your system | | Resources | Data the model can read | What an agent can see | | Prompts | Ready-made interaction templates | How a typical task is started | ## Rules and standards Anthropic introduced MCP on 25 November 2024 as an open standard for two-way connections between data sources and AI tools. In December 2025 Anthropic donated the protocol to the Agentic AI Foundation, hosted by the Linux Foundation and co-founded by Anthropic, Block and OpenAI. According to the same announcement, ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code support MCP, and more than 10,000 public MCP servers were active. The official guide "Security Best Practices" (version 2026-07-28) describes the main attacks on MCP servers, including confused deputy, token passthrough, server-side request forgery and compromise of a local MCP server, and gives mitigations for each. Public servers can be listed in the official MCP registry, where AI clients and developers can look them up. ## From our projects Since 9 July 2026 we have run a production MCP server for the CMS behind this website, built on Wagtail. On 20 October 2026 it had 164 tools, and each tool calls the CMS REST API. Three gates sit on the server: creating a page without a strategy brief returns HTTP 400, and writing content before a person approves the brief or publishing while the audit has errors returns HTTP 409. Since 8 October 2026 we have also run a public MCP endpoint at https://ordergroup.co/mcp. It needs no token, offers two tools for reading our case studies and sending a project enquiry, and is listed in the official MCP registry as co.ordergroup/public. We build MCP servers for other products as part of our [MCP server development services](https://ordergroup.co/ai-software-development/mcp-server-development/). ## Related terms - [LLM evaluation](https://ordergroup.co/glossary/llm-evaluation/) LLM evaluation is the systematic testing of a language model's outputs on a fixed set of inputs against agreed acceptance criteria, using automatic checks, model-based grading and human review. It decides whether a model, prompt or version is good enough to ship. - [Self-hosted LLM](https://ordergroup.co/glossary/self-hosted-llm/) A self-hosted LLM is a large language model whose weights run on infrastructure you control, your own servers or rented GPUs. Prompts and outputs never reach a model vendor. ## Read more on the blog - Article [MCP vs API: What We Learned Running an MCP Server in Production](https://ordergroup.co/blog/mcp-vs-api/) ## Sources 1. [Introducing the Model Context Protocol](https://www.anthropic.com/news/model-context-protocol) - Anthropic 2. [Donating the Model Context Protocol and establishing the Agentic AI Foundation](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation) - Anthropic 3. [MCP specification 2026-07-28: Architecture](https://modelcontextprotocol.io/specification/2026-07-28/architecture) - Model Context Protocol 4. [Security Best Practices](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) - Model Context Protocol 5. [Official MCP registry: co.ordergroup/public](https://registry.modelcontextprotocol.io/v0/servers?search=co.ordergroup/public) - Model Context Protocol Łukasz Gajownik reviewed this entry. Ask how it applies to your project. [Ask an engineer](https://ordergroup.co/contact-us/) ## FAQ ![Łukasz Gajownik](https://ordergroup.co/media/images/T02DHCC1Z-UT420UBA7-d74022d27c3c-512.format-webp.webp) Łukasz Gajownik Head of AI & Frontend [Talk to an engineer](https://ordergroup.co/contact-us/) ### What is an MCP server? An MCP server is a program that exposes tools, resources and prompts to AI applications through the Model Context Protocol. It can run locally or as a remote service, and an AI client connects to it to let the model use those capabilities. ### Is MCP the same as an API? No. An API exposes fixed endpoints for a programmer who knows the operations in advance. An MCP server publishes a list of tools with descriptions, and the AI client lets the model choose. Many MCP servers call an existing API underneath. ### Which AI assistants support MCP? According to Anthropic's December 2025 announcement, ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code support MCP. Claude, Anthropic's own assistant, has supported it since the protocol was introduced in November 2024. ### Is MCP secure? The protocol builds in some protection: the host enforces user consent and policies, and a server does not see the full conversation or other servers. The rest depends on the server, which should enforce its rules itself, give each caller its own token and log every call. ## Building a system with MCP (Model Context Protocol) in scope? See how we build software for this domain, with case studies and the stack we use. [See AI Software Development Company](https://ordergroup.co/ai-software-development/) Requirements checklist For each term we send the definition and what it requires from your software. Free, no sales call needed. Your checklist is empty. Use the plus next to a term to add it.