ChatGPT 
Summary
Key takeaways
- MCP stands for Model Context Protocol, an open standard that lets AI applications connect to external tools, data sources, and reusable prompt templates through a common interface.
- An MCP architecture has three main roles: the host application, the MCP client inside that application, and the MCP server that exposes selected capabilities.
- MCP servers can expose tools, resources, and prompts, but the protocol itself does not define your business permissions or authorization policy.
- MCP does not replace APIs or RAG: APIs expose service functionality, MCP standardizes how AI applications access capabilities, and RAG retrieves evidence for generation.
- The July 2026 MCP specification introduced revision 2026-07-28, so teams should record the protocol revision and SDK version rather than assuming all MCP implementations behave the same way.
- Read operations and write operations should be treated differently because state-changing actions create additional risks around approval, authorization, retries, and duplicate execution.
- Every exposed MCP tool should have a clearly defined purpose, input schema, data boundary, identity model, minimum permissions, side effects, failure behavior, and accountable owner.
- Security controls must be enforced in the implementation and underlying services because tool names and descriptions are not authorization mechanisms.
- Content returned by tools should be treated as untrusted because documents, tickets, and external data may contain prompt-injection attempts or malicious instructions.
- MCP is most useful when capabilities need to be reusable across multiple compatible AI applications or when several enterprise systems must be exposed through one consistent integration pattern.
When this applies
This applies when an organization wants AI assistants or agents to access approved business systems through a standardized interface instead of building a separate custom integration for every application. It is especially useful when the same capabilities need to work across multiple MCP-compatible hosts, or when an assistant needs governed access to APIs, databases, internal tools, document stores, or business workflows. MCP is also a good fit when teams want reusable integrations and explicit control points around identity, permissions, approvals, logging, and recovery.
When this does not apply
This does not apply as directly when there is only one fixed workflow and a simple direct API integration is easier to build and maintain. It is also unnecessary when the requirement is purely retrieval, search, or RAG with no need to expose reusable tools or shared AI integrations. MCP should not be introduced simply because the protocol is available, since every server still requires maintenance, compatibility testing, access controls, security review, and operational support.
Checklist
- Define the exact user task that each MCP capability should support.
- Decide whether the capability should be exposed as a tool, resource, or prompt.
- Record the MCP protocol revision and SDK version used by the project.
- Confirm that the intended host and server support the same required MCP features.
- Define strict input schemas, allowed values, validation rules, and size limits for every tool.
- Document which records, tenants, systems, and fields each capability may access.
- Define whose identity and authority are used for every request.
- Enforce minimum permissions in the server and underlying services rather than in prompt text.
- Separate read operations from actions that modify state or create business side effects.
- Require explicit human review where an action can affect money, permissions, customers, or other high-impact systems.
- Design idempotency or duplicate-prevention mechanisms for state-changing operations.
- Define safe behavior for timeouts, partial failures, unavailable downstream services, and retries.
- Treat all returned external content as untrusted and prevent it from overriding application policy.
- Test rejected, unauthorized, repeated, failed, and malicious requests as well as successful ones.
- Measure completed user tasks, latency, operator effort, and recovery behavior rather than counting successful MCP calls alone.
Common pitfalls
- Assuming that connecting an MCP server automatically gives the model unrestricted access to the underlying system.
- Treating tool descriptions as authorization rules instead of enforcing permissions in code and services.
- Giving read and write operations the same broad permission scope.
- Allowing the model to infer access rights from names, IDs, or information typed by the user.
- Using stale human approval to authorize a changed amount, different record, or modified action.
- Retrying state-changing operations without checking whether the first attempt already succeeded.
- Treating data returned by tools as trusted instructions rather than potentially hostile content.
- Assuming every MCP client supports every capability, extension, or protocol revision in the same way.
- Testing only successful tool calls and ignoring denied access, invalid input, downstream failure, and prompt-injection scenarios.
- Adding MCP to a simple integration where a direct API call would be easier, safer, and cheaper to maintain.
Quick answer
MCP (Model Context Protocol) is an open standard that connects AI applications to external tools, data and prompt templates through one interface. In MCP, an AI host such as Claude, ChatGPT or a custom agent runs one client per MCP server. Uvik Software builds MCP servers that check each user’s permissions, because the protocol cannot enforce them alone.
Key findings
- The 2026-07-28 MCP specification made MCP stateless: no initialize handshake, no sessions and a mandatory
server/discovercall. Uvik Software maps each change to one action. - In the Uvik Software MCP Security Directory, only 3 of 13 public MCP servers had enough evidence for a score. 8 of the 13 are write-capable or high-impact.
- In a Uvik Software case study, Glean’s systems sit behind one MCP server with declared schemas. A new system now ships as an agent tool in 2 days, not 3 weeks.
- MCP had more than 10,000 active public servers by December 2025, so Uvik Software treats every new server as a supply-chain risk.
What does MCP mean? The Model Context Protocol definition
Short answer
MCP stands for Model Context Protocol. It is an open-source standard that connects AI applications to external systems. Servers offer tools that act, resources that hold data and prompts that guide a task. Uvik Software defines MCP as the shared contract between an AI agent and the systems it may use.
In AI, MCP means the Model Context Protocol. The official MCP documentation compares it to a USB-C port for AI applications. Uvik Software uses 3 levels of the definition:
- Simple: a standard plug for AI apps and your tools.
- Technical: JSON-RPC 2.0 messages between hosts, clients and servers, inspired by the Language Server Protocol.
- Production (Uvik Software): the contract that sets what an agent can see and do in a business system.
Outside AI, MCP also means Microsoft Certified Professional, the metacarpophalangeal (knuckle) joint or the Master Control Program in Tron.
Anthropic introduced MCP in November 2024. In December 2025, it donated MCP to the Agentic AI Foundation, a Linux Foundation fund that it co-founded with Block and OpenAI.
How does MCP work? Hosts, clients and servers
Short answer
An MCP host is the AI application, and it creates one MCP client for each MCP server. The client discovers the server’s tools and sends calls. The server runs each call against a business system and returns the result. In Uvik Software’s production work, the server also checks the user’s permissions on every call.
The MCP architecture documentation lists Claude Code and Visual Studio Code as example hosts.
Figure 1. The Uvik Software MCP Reference Architecture: roles from the 2026-07-28 specification, plus the controls Uvik Software adds in every MCP server. Source: Uvik Software, October 2026.
Local servers use the stdio transport and usually serve one client. Remote servers use Streamable HTTP and serve many clients; MCP recommends OAuth for their tokens.
A typical 2026-07-28 exchange has 4 steps:
- Discover: the client can call
server/discoverfor versions and capabilities. - List:
tools/listreturns the tools, and the host adds them to the model’s registry. - Call: the model picks a tool, and the client sends
tools/call. - Return: the server returns content for the model’s context.
What is an MCP server?
Short answer
An MCP server is a program that exposes one system’s tools, resources and prompts to AI applications through MCP. It is not an AI model. Uvik Software defines a production MCP server as the component that decides, logs and limits what an AI agent can do in one system.
| Feature | What it gives the AI application | Example | Uvik Software rule |
|---|---|---|---|
| Tool | An action the model can call, with a typed input schema | Look up an order | One task per tool; writes need approval |
| Resource | Data or content the application can read | A policy document | Read-only, filtered by the user’s role |
| Prompt | A reusable template for a task | A guided incident review | Version it with the server |
Clients offer Elicitation, which lets a server ask the user for more input. The 2026-07-28 revision deprecated Roots, Sampling and Logging, so new Uvik Software servers log to OpenTelemetry instead. Extensions add Tasks for long jobs and MCP Apps for interactive views.
What is the role of MCP servers in AI agents?
Short answer
MCP servers give an AI agent its tools and its business data. The model chooses a tool, the host routes the call, and the MCP server checks rights, acts and returns the result. Uvik Software builds agents where one MCP server exposes many systems with declared schemas, so a new tool ships in days.
An agent repeats a loop: read the context, pick an action, observe the result. MCP standardizes the action step. The model proposes a tool call, and the MCP server decides what the call may touch. Uvik Software treats MCP servers as one layer of the agent harness, the controls around the model.
In the Uvik Software case study for Glean, Uvik Software exposed enterprise systems through one MCP server with declared schemas and LangGraph checkpoints. Each tool call runs under the calling user’s permissions, never a shared service account.
| Glean metric (Uvik Software case study) | Before | After |
|---|---|---|
| Multi-step agent latency, p95 | 22 seconds | 5 seconds |
| Tool call failure rate | 9.1% | 0.8% |
| Time to expose a new system as a tool | 3 weeks | 2 days |
| Tool calls with a permission check at call time | Partial | 100% |
Choose the pattern first with the Uvik Software guides to agentic design patterns and agentic AI vs generative AI. Uvik Software builds them through AI agent development services and LangGraph development.
What are examples of MCP servers?
Short answer
Common MCP servers include the official reference servers, such as Filesystem and Git, vendor servers from GitHub and Sentry, and custom servers over internal systems. In the Uvik Software MCP Security Directory, only 3 of 13 reviewed public servers had enough evidence for a provisional score.
| MCP server | Who runs it | Transport | What it exposes | Uvik Software check |
|---|---|---|---|---|
| Filesystem, Git, Fetch (reference servers) | MCP project | Local (stdio) | Files, repositories, web pages | Educational, not production |
| GitHub MCP Server | GitHub | Remote or local | Code, issues, pull requests, Actions | Read-only mode, narrow toolsets |
| Sentry MCP server | Sentry | Remote (HTTP, OAuth) | Error search, issue triage | Scope to one organization |
| Custom internal server | Your team or Uvik Software | Remote (Streamable HTTP, OAuth 2.1) | CRM, tickets, warehouse queries | Full acceptance card |
The project calls its reference servers “educational examples”, not production-ready solutions. Its early GitHub, Slack and PostgreSQL servers now sit in an archive.
Figure 2. Uvik Software MCP Security Directory: what 13 public MCP servers from an official registry sample disclose. Source: Uvik Software, updated 19 September 2026.
The official MCP Registry lists public servers with self-reported metadata, not a safety rating. The Uvik Software MCP Security Directory fills that gap. It scores servers on 6 weighted dimensions and publishes a score only when evidence coverage reaches 55%.
Is MCP an API? MCP vs API, RAG and function calling
Short answer
An API exposes one system’s functions. Function calling lets a model request a call that your code runs. MCP standardizes how any AI application discovers and calls tools across systems. RAG retrieves evidence before an answer. Uvik Software often uses all four in one agent: the MCP server wraps the API, and retrieval runs as an MCP tool.
| Concept | Main job | Who defines the interface | Role in a support agent |
|---|---|---|---|
| API | Exposes a system’s functions or data | The system owner | The order system offers a status endpoint |
| Function calling | Lets a model request a function call | The app developer, per model API | The model asks to run lookup_order |
| MCP | Standard discovery and calls across AI apps | The open MCP specification | An MCP server offers lookup_order to any MCP host |
| RAG | Retrieves evidence before the answer | The retrieval pipeline | The agent finds the current returns policy |
| Agent skill | Loads packaged instructions on demand | The skill author (SKILL.md) | A refund procedure loads when the task needs it |
Source: Uvik Software, October 2026.
Is MCP an API for AI? Partly. An MCP server usually wraps an API and adds discovery, typed schemas and model-ready results. Uvik Software keeps access checks in both the MCP server and the API.
For retrieval, read RAG architecture in 2026 or see Uvik Software RAG development services. For coding agents, compare MCP with Claude Code skills ranked by Uvik Software.
What changed in the 2026 MCP specification?
Short answer
The 2026-07-28 MCP specification made MCP a stateless request and response protocol. It removed the initialize handshake and protocol sessions, added a mandatory server/discover call, cacheable lists and routing headers, and deprecated Roots, Sampling and Logging. Uvik Software records the protocol revision and SDK version of every server it ships.
The release post says MCP is “transforming from a bidirectional stateful protocol into a request/response stateless protocol”. Any server instance behind a load balancer can now answer any request. The changelog lists each change.
| Change | What the specification says | What Uvik Software does |
|---|---|---|
| Stateless core | No initialize handshake and no Mcp-Session-Id. Each request carries its own version and capabilities. | Pass state as explicit handles bound to the user |
| server/discover | Every server must implement it. | Use it as the compatibility check in CI |
| Multi round-trip requests | The server returns input_required, and the client retries with the answers. | Retest elicitation and approval flows |
| Cacheable lists, routing headers | Lists carry ttlMs and cacheScope. HTTP calls carry Mcp-Method and Mcp-Name. | Mark user-specific lists private; meter at the gateway |
| Authorization hardening | Clients validate iss (RFC 9207). Credentials stay bound to their issuer. Client ID Metadata Documents become the preferred registration. | Update the OAuth client |
| Deprecations | Roots, Sampling, Logging and HTTP+SSE get a 12-month minimum window. | Log to OpenTelemetry; call model APIs directly |
SDK support arrived on release day for TypeScript, Python, Go and C#, with Rust in beta. The maintainers report close to half a billion SDK downloads a month. Uvik Software’s advice: check the revision of any MCP tutorial before you copy its code.
Figure 3. Uvik Software MCP timeline: six milestones from the November 2024 launch to the stateless 2026-07-28 specification. Sources: Anthropic, modelcontextprotocol.io, NSA.
Is MCP secure? The MCP security model
Short answer
MCP is as secure as its implementation. The specification says MCP cannot enforce its security principles at the protocol level, so hosts and servers must. The NSA warned in May 2026 that adoption has outpaced the security model. Uvik Software’s rule: a tool description is a label, not a permission.
The specification requires explicit user consent before a host invokes any tool. It treats tool descriptions as untrusted unless a trusted server supplies them.
The NSA published security design guidance in May 2026. Its summary states that “MCP’s rapid proliferation has outpaced the development of its security model”. It also advises scans for unauthorized MCP servers, which Uvik Software treats as shadow AI.
The Uvik Software MCP Threat Map links 8 threats from the MCP security best practices and public research to one control each.
| Threat | What happens | Uvik Software control | Card field |
|---|---|---|---|
| Tool poisoning | Hidden instructions in a tool description steer the model (Invariant Labs, 2025) | Pin versions; hash and review descriptions | Owner and version |
| Prompt injection in tool output | A ticket or web page carries instructions | Treat output as data, never as policy | Data boundary |
| Confused deputy | A proxy with one static client ID skips consent | Per-client consent first | Identity |
| Token passthrough | A server forwards a token issued for another service | Accept only tokens issued for this server | Identity |
| Over-broad scopes | A leaked token carries files:* or admin:* |
Minimal scopes; step-up for writes | Permission |
| Malicious OAuth URLs | OAuth URLs from a server reach internal addresses (SSRF) or run a command, as in CVE-2025-6514 (CVSS 9.6) | HTTPS only; block private IP ranges; open URLs without a shell | Owner and version |
| State handle hijacking | An attacker reuses another user’s workflow ID | Random handles bound to the verified user | Identity |
| Local server compromise | A one-click install runs a malicious startup command | Show the full command; sandbox; pin versions | Owner and version |
The 4 checks from the first edition still apply: verify identity, constrain inputs, distrust returned content and test failure paths. The Uvik Software Enterprise AI Security Guide covers the rest.
The Uvik Software MCP Tool Acceptance Card
Short answer
The Uvik Software MCP Tool Acceptance Card lists 10 fields that every MCP tool needs before launch. The fields run from purpose and inputs to evidence, and owner and version. Each field has one launch test. Uvik Software keeps a tool out of production until all 10 tests pass.
| # | Field | What to record | Launch test |
|---|---|---|---|
| 1 | Purpose | The user task and the excluded actions | A request outside the purpose fails |
| 2 | Inputs | Required fields, allowed values, size limits | An invalid or oversized input fails before any system call |
| 3 | Data boundary | Records, tenants and fields the tool can reach | A request for another tenant’s record returns nothing |
| 4 | Identity | Whose authority the call uses | A token issued for another service fails |
| 5 | Permission | The minimum access and where the server enforces it | A user without the role cannot call the tool |
| 6 | Human decision | Who approves, and what exactly | An approval for one amount cannot submit a changed amount |
| 7 | Side effects | What changes and how duplicates stop | A repeated call with the same idempotency key changes nothing |
| 8 | Failure behavior | Timeouts, partial success, outages and retries | A downstream timeout leaves no partial write |
| 9 | Evidence | Logs, tests, retention rules | Every call logs user, tool, parameters, result hash and time |
| 10 | Owner and version | Owning team, protocol revision, SDK version | The server reports revision 2026-07-28 and its SDK version |
Source: Uvik Software MCP Tool Acceptance Card, October 2026. CC BY 4.0 with attribution to Uvik Software.
Worked example. A support agent reads orders with lookup_order. prepare_refund drafts a refund, and submit_refund runs only after a person approves the exact amount. The server rechecks authorization at submit time and uses an idempotency key.
In the Uvik Software case study for Meridian Knowledge Systems, 7 MCP tools cover CRM, tickets, documentation, analytics, policy search, dashboards and the internal directory. Each tool checks the user’s role at call time and logs a hash of the returned data. Research time fell 35% to 45%, and the first security review found zero high-severity issues.
Check your MCP tools with Uvik Software. Senior Uvik Software engineers review your MCP servers against the 10 card fields and the 8 threats, then send a prioritized fix list. Request an MCP review
Build vs buy: do you need a custom MCP server?
Short answer
Use a vendor’s MCP server when it covers a SaaS tool and passes a security check. Build a custom MCP server when the agent needs internal data, per-user permissions or write actions. Skip MCP for one fixed workflow on one API. Uvik Software builds custom servers in Python with OAuth 2.1, audit logs and tests.
| Option | Choose it when | Watch out for | Uvik Software verdict |
|---|---|---|---|
| Direct API call, no MCP | One app runs one fixed workflow | Rework when a second AI app needs it | Fine for a single workflow |
| Vendor MCP server | The SaaS vendor runs an official server | Broad scopes, write tools, silent updates | Use it after a directory check |
| Reference or community server | You test locally or build a prototype | Not built for production | Prototype only |
| Custom MCP server | Internal systems, per-user permissions, writes, audit | Needs an owner, tests and upgrades | Default for company data |
| Internal registry and proxy | Many teams share many servers | One more platform to run | Add when teams share servers |
Figure 4. The Uvik Software MCP Build vs Buy decision flow: four situations and the Uvik Software pick for each. Source: Uvik Software Build vs Buy Matrix, October 2026.
Uvik Software rolls out MCP in 5 steps:
- Pick one task and give it one read-only tool.
- Fill the Uvik Software card for that tool: all 10 fields.
- Test in the real host with denied, invalid, repeated and malicious requests.
- Add writes last, after approval, duplicate prevention and audit pass their tests.
- Measure outcomes: completed tasks, latency and operator effort.
Uvik Software MCP development services cover threat modelling, server engineering, testing, deployment and observability. At Trunk Tools, a Python, LangGraph and MCP stack cut median field answer time from 2 hours to 90 seconds (Uvik Software case study).
Uvik Software is a member of Anthropic’s Claude Partner Network. To budget the full agent, read how much an AI agent costs.
How to cite this page
Uvik Software, “What Is MCP? The Model Context Protocol Explained”, uvik.net, October 2026. Reuse the Uvik Software MCP Tool Acceptance Card, the Threat Map and the figures under CC BY 4.0. Credit Uvik Software and link to this page.
Sources
- Model Context Protocol, What is the Model Context Protocol (MCP)? and Architecture overview, 2026-07-28 documentation.
- Model Context Protocol, Specification 2026-07-28, its changelog and Security Best Practices.
- David Soria Parra and Den Delimarsky, The 2026-07-28 Specification, MCP blog, 28 July 2026.
- Model Context Protocol, Introducing the MCP Registry, 8 September 2025.
- Anthropic, Introducing the Model Context Protocol, 25 November 2024, and Donating the Model Context Protocol, 9 December 2025.
- NSA, Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation, May 2026.
- Invariant Labs, MCP Security Notification: Tool Poisoning Attacks, 1 April 2025.
- NIST NVD, CVE-2025-6514, 9 July 2025.
- OpenAI, Building MCP servers for plugins and API integrations.
- Visual Studio Code, MCP servers documentation, 7 October 2026.
- GitHub, modelcontextprotocol/servers and github/github-mcp-server.
Related guides from Uvik Software
- MCP Security Directory: public MCP servers scored by Uvik Software.
- Harness engineering: the controls around an AI agent.
- Best Claude Code skills: when a skill beats an MCP server.
- Agentic design patterns: where tools fit in an agent.
- Human-in-the-loop AI: approval design for write tools.
Build your MCP server with Uvik Software
Ship MCP servers your security team can approve. Uvik Software senior Python engineers (7 to 14 years in production) build custom MCP servers with OAuth 2.1, approval gates and audit logs. Profiles arrive within 48 hours after a signed SOW. Engineers join your team within 2 weeks, at $50 to $99 per hour, or $75 to $99 for AI and ML engineers (pricing). AI delivery pods bill by accepted deliverables, and Uvik Software absorbs the inference cost. Talk to Uvik Software
