MCP (Model Context Protocol)

MCP uses a client-host-server architecture. The host is the AI application the user works in, such as a chat assistant or a code editor. It creates and coordinates one or more clients and enforces security policies and user consent. Each client connects to exactly one MCP server, and each server exposes capabilities to the model.

Messages use JSON-RPC. A server can be a local process on the user's machine or a remote service reached over the network. A server offers three kinds of building blocks:

• Tools are functions the model can call, such as creating a record or searching a catalog.
• Resources are data the model can read, for example a log file or a database schema.
• Prompts are ready-made templates for a type of interaction.

Each tool has a name, a description and a typed input schema. The client asks the server which tools are available and passes those descriptions to the model, which picks the tool it needs. Client and server also declare which protocol features they support. The specification dated 2026-07-28 describes MCP as stateless: every request carries its own protocol version and capabilities.

By design, a server does not see the whole conversation and cannot look into other servers. The full history stays with the host, and a server only learns what the host passes to it.

An MCP server lets AI agents act in your system, so the server, not the prompt, has to hold the rules. Requirements for any system that exposes an MCP server:

• The rules an agent must not break are response codes and validation on the server. An instruction in the prompt can explain a rule, but only the server can enforce it.
• Every request carries the token of one person or one integration, and every call is logged, so you can answer which agent did what.
• A public scope, if there is one, is separate from the authenticated one and allows only what anyone may do without a token.
• The server asks for the smallest scope first and raises permissions only when an operation needs them.
• Tool names, descriptions and input schemas are written as carefully as an API contract, because the model chooses tools only from them.
• The MCP server calls the existing API where one exists, so validation and permissions are not written twice.
• The server declares which protocol versions it supports, and a version change is tested like any other release.

MCP does not replace APIs. In many systems the MCP server sits on top of an existing API, which stays the boundary of the service while MCP becomes the boundary of the agent. The comparison is covered in MCP vs API.

Anthropic introduced MCP on 25 November 2024 as an open standard for two-way connections between data sources and AI tools. In December 2025 Anthropic donated the protocol to the Agentic AI Foundation, hosted by the Linux Foundation and co-founded by Anthropic, Block and OpenAI. According to the same announcement, ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code support MCP, and more than 10,000 public MCP servers were active.

The official guide "Security Best Practices" (version 2026-07-28) describes the main attacks on MCP servers, including confused deputy, token passthrough, server-side request forgery and compromise of a local MCP server, and gives mitigations for each. Public servers can be listed in the official MCP registry, where AI clients and developers can look them up.

Since 9 July 2026 we have run a production MCP server for the CMS behind this website, built on Wagtail. On 20 October 2026 it had 164 tools, and each tool calls the CMS REST API. Three gates sit on the server: creating a page without a strategy brief returns HTTP 400, and writing content before a person approves the brief or publishing while the audit has errors returns HTTP 409.

Since 8 October 2026 we have also run a public MCP endpoint at https://ordergroup.co/mcp. It needs no token, offers two tools for reading our case studies and sending a project enquiry, and is listed in the official MCP registry as co.ordergroup/public. We build MCP servers for other products as part of our MCP server development services.