On this page
An MCP server exposes capabilities that an AI application can discover and use through the Model Context Protocol. It might provide access to a document collection, a narrowly scoped business operation or a developer tool. It is an integration boundary, not the language model or the agent's entire control loop.
This guide uses the official specification reviewed on 9 November 2026. Protocol revisions matter: older examples can describe connection initialization and message directions that differ from the current revision. Match both the specification and the SDK version when implementing a server.
Host, client and server
The host is the AI application. A client is the connector within that host. The server supplies external context or capabilities. These roles describe responsibility, not a requirement that every component run on a separate machine.
For an illustrative inventory assistant, the host decides how to help the user, the client carries protocol messages, and the inventory server implements a stock lookup. The underlying database or business API remains another boundary with its own access rules.
Do not put all business authority in the host's prompt. The server must enforce the operations and data access its caller is actually allowed to use.
What capabilities can a server expose?
| Capability | Purpose | Example design |
|---|---|---|
| Tools | Callable operations | Look up stock for one SKU |
| Resources | Context or data | Read an approved reference document |
| Prompts | Reusable interaction templates | Prepare a structured review request |
The host's support determines which capabilities users can access. A server advertising a feature does not establish that every client supports it. Document the tested combinations rather than promising universal compatibility.
For a first integration, expose the smallest useful surface. A stock lookup with a bounded identifier is easier to reason about than a general database query tool. Add more capabilities when a real workflow requires them.
Transport is separate from meaning
The current transport specification defines stdio and Streamable HTTP bindings. Stdio carries newline-delimited messages over a client-launched subprocess. Streamable HTTP sends messages to a single MCP endpoint and supports JSON or request-scoped event-stream responses.
These delivery choices do not define what an operation means. Your business code still decides how a lookup behaves, what counts as an unknown identifier and which records the caller may see.
Use stdio for an appropriate local subprocess integration. Use an HTTP deployment when clients need a network service, with the additional authentication, isolation and operational work that implies. A publicly reachable URL is not automatically safe to expose.
Current revisions versus old tutorials
The July 2026 protocol describes self-contained requests with per-request metadata. Earlier revisions used a connection-scoped initialization handshake. Do not combine pieces from those eras into a homemade protocol implementation.
Prefer a maintained SDK and test the protocol modes you claim to support. The Python tutorial pins the SDK used for its executable example and states exactly what was tested.
When troubleshooting, record server package version, client version, transport and protocol behavior. “MCP is broken” is too broad to distinguish an authorization problem from an unsupported capability or an outdated client.
Authorization and business permissions
The HTTP authorization specification describes access-token-based authorization for restricted HTTP servers. Local stdio integrations have a different credential context. Do not copy a network authorization assumption into a local process or vice versa.
Authentication answers who is calling. Authorization answers what they may do. After validating the caller, enforce access to each private object and operation. A caller allowed to use the inventory tool should not thereby receive access to all tenants' stock records.
Never accept an arbitrary user-supplied account identifier as proof of ownership. Derive the permitted account scope from trusted identity and policy, then apply it to the underlying data query.
Tool descriptions are not executable policy
A description helps a host understand a capability. It cannot prevent the handler from writing data, leaking secrets or exceeding a budget. Review implementation behavior and permissions independently.
Likewise, external content returned by a tool can include malicious instructions. A document telling an assistant to reveal credentials should remain untrusted document text. It must not acquire authority over the application's instructions or access controls.
Keep consequential operations narrow and observable. Record the requested action, validated arguments and result with appropriate redaction. Avoid logging secrets or full private documents merely to obtain debugging context.
Failure behavior is part of the interface
Define missing-data, invalid-input, timeout and denied-access behavior. Distinguish zero stock from an unknown SKU; treating both as an empty answer can mislead the user into believing a lookup succeeded.
For write operations, distinguish a failed request from an unknown final outcome. A timeout after an external change may require reconciliation rather than a blind retry. Idempotency and recovery belong in the business implementation.
Cancellation should also be tested. A disconnected client should not leave unlimited expensive work running. Set deadlines and resource boundaries even if the underlying SDK supports cancellation messages.
Distribution is another responsibility
A package registry distributes executable artifacts. An MCP catalogue publishes discovery information. A hosting provider runs a service. These functions can belong to different organizations.
The MCP publishing guide separates those responsibilities and describes evidence users need before installing a package or connecting to an endpoint. A registry listing does not establish that a server passed a security audit.
Start with one verifiable capability
Choose a read-only operation, document its schema and test discovery, success, missing data and invalid input. Then test the actual transport and client configuration. Keep the demonstration's claims within those results.
MCP can make integrations more consistent, but it does not make an application autonomous or supply its business permissions. For those decisions, read agent versus chatbot. For a working local example, follow build an MCP server in Python, or explore developer documentation.
To decide which layer your application needs, read AI agent versus MCP server. It separates task coordination from tool-service authorization.