Model Context Protocol (MCP)
Also known as: MCP, Model Context Protocol
The Model Context Protocol (MCP) is an open standard for connecting AI assistants to outside tools and data, such as files, calendars, databases, and business apps.
A developer builds an 'MCP server' for a tool once, and any AI app that supports MCP can use it. While MCP has been compared to a USB-C port for AI, connecting AI to real systems also opens new security risks, such as prompt injection through tool results and over-broad permissions.
Model Context Protocol (MCP), explained at three levels
At home
Think of MCP as a universal power outlet for AI assistants. Before it, every AI app needed custom wiring for every tool, like a different plug for each appliance. With MCP, a tool maker builds one 'MCP server' that speaks a shared language, and any assistant that supports MCP can plug into it. That is how one assistant can reach your files, calendar, or notes.
At work
The Model Context Protocol is an open standard for connecting AI assistants to business systems such as databases, ticketing tools, and document stores. A team builds one MCP server for a system, and every approved AI product that supports MCP can use it. For a business, that means fewer custom integrations, and one place to control what the AI is allowed to see and do.
At home
MCP has two sides. The AI app you use, such as a chat assistant or code editor, is the client. Each connected tool runs an MCP server, either on your own computer or online. When they connect, the server sends a list of what it offers, like 'search notes' or 'create a file,' with a description of each. The AI reads that list, decides when a tool would help, and asks the server to run it, usually checking with you first.
At work
MCP servers expose three kinds of things: tools, which are actions the model can call; resources, which are data such as files or records; and prompts, which are reusable templates. Messages use JSON-RPC, carried over standard input and output for local servers or over HTTP for remote ones, and remote servers authorize users with OAuth. Function calling is how a model asks for a tool; MCP standardizes how tools are discovered, described, and invoked across different AI apps.
At home
An MCP server is just a program, and a local one usually runs with your user account's permissions. It can read what you can read, and its tool descriptions go straight into the AI's instructions, so a malicious server can steer the model too. While the protocol itself is sound, it trusts whoever wrote each server. In my opinion, treat MCP servers like browser extensions: only install ones from sources you trust.
At work
MCP's risks come from mixing untrusted text with real permissions. Tool results can carry prompt injection, tool descriptions can be poisoned to redirect the model, and a server may request broader OAuth scopes than it needs or handle tokens insecurely. Community servers add supply-chain risk. The spec is now governed by the Agentic AI Foundation, but control of deployments is yours: approved server lists, least-privilege scopes, logging of tool calls, and human approval for sensitive or write actions.
Real-world examples
At home
Carlos connected his AI assistant to his notes app through an MCP server. Now he can ask it to find last month's meeting notes and draft a follow-up email using them.
At work
Lena is an IT director at a Winnipeg manufacturer. Her team built one MCP server for their inventory system, and staff could then use it from several approved AI tools without separate integrations.
How it compares
| feature | Model Context Protocol (MCP) | Function Calling |
|---|---|---|
| What it is | A shared standard for AI-to-tool connections | A model feature for requesting a tool action |
| Scope | Discovery, connection, permissions, transport | The model's structured request |
| Reuse across AI apps | Yes | Depends on each app's code |
| Relationship | Often uses function calling underneath | Building block MCP relies on |
Function calling lets a model ask for a tool. MCP standardizes how tools are offered.
For analysts
MCP can cut integration costs, but every connection is a new access path into your systems. I'd keep an approved list of servers and require approval before AI tools take write actions.
History & origin
Before MCP, each AI app needed custom code for every tool it wanted to use, and every tool maker had to integrate separately with each AI product. Anthropic introduced MCP as an open specification in November 2024, alongside open-source software development kits. Developer tools and AI apps adopted it quickly, and in 2025 OpenAI, Google, and Microsoft announced support. Thousands of community-built MCP servers appeared for services such as GitHub, Slack, and databases. In December 2025, Anthropic donated MCP to the new Agentic AI Foundation, a fund under the Linux Foundation co-founded with Block and OpenAI. In my view, MCP succeeded because it solved a boring integration problem that everyone had, which is exactly how lasting standards are born.