Model Context ProtocolMCP

An open standard that lets artificial intelligence (AI) applications and agents connect to outside tools and data, such as a calendar, a file store, or a company database, through one common method instead of a custom connection for each.

A work assistant might use MCP to reach a person's email, project tracker, and sales database, with the person approving each connection.

A client-server protocol that Anthropic introduced in November 2024 and donated in December 2025 to the Agentic AI Foundation (AAIF), a fund under the Linux Foundation. The current revision is dated July 28, 2026.

MCP splits each connection into three roles:

• Host, the AI application the person uses, which creates connections, enforces consent, and handles the person's authorization decisions.
• Client, a connector inside the host that talks to exactly one server.
• Server, a local program or remote service that exposes tools, data, and prompt templates.

For remote servers, MCP's authorization rules build on OAuth 2.1, the draft update to the OAuth framework for granting an app limited access to an account. The March 2025 revision added this framework, and the June 2025 revision required each token to name the one server it is for, so a malicious server cannot replay it elsewhere. Authorization stays optional, and local servers take credentials from their environment.

MCP sits next to terms that are easy to mix up:

• Agent2Agent protocol (A2A) connects agents to other agents, while MCP connects one agent to its tools and data. Many systems use both.
• Tool poisoning is an attack that hides malicious instructions in the tool descriptions an MCP server sends.
• Authorization is what an MCP access token expresses: the scopes a client may use, such as reading files.