Model Context Protocol
An open standard for connecting models to tools and data — solving a real integration problem, and a standards fight is a political event, not a technical one.
Reviewed July 12, 2026Stable
When not to use it
- For one integration. A protocol is overhead until you have several.
- As a security boundary. It standardises connection, not permission. Your authorisation lives in your code.
- When connecting untrusted data to a capable model. The protocol makes this easy, which is not the same as safe.
- When the ecosystem doesn't have what you need. Then it's a spec you're implementing alone.
Reach for something else instead
- Direct function calling — for a handful of tools you own, this is simpler.
- Provider-specific tool APIs — less portable, fewer moving parts.
- A plain HTTP API — if only your app calls it, the protocol buys you nothing.
Read more on the blog
- What is MCP? The standard that wired AI into everythingThe Model Context Protocol went from a November 2024 announcement to the connective tissue of the entire agent era in under two years. Here's what it actually is, the problem it solved, how it works under the hood, and why every major AI lab adopted it, explained plainly, without the sales pitch.
- Context engineering: the skill that replaced prompt engineeringPrompt engineering didn't die, it got absorbed. The bottleneck moved from how you phrase a request to what information surrounds it. Here's what context engineering actually is, why it took over in 2026, and the discipline underneath the buzzword.
- How AI agents actually work: the loop behind the hypeEveryone is building "agents" and almost nobody explains what makes one. Not the marketing, the actual machinery: the loop, the four components, and the single property that separates an agent from a chatbot with a fancy system prompt.
Further reading
- Anthropic (2024), Model Context Protocol specification — the primary source; read the spec rather than the coverage.
- Greshake et al. (2023), Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — why every connected data source is an injection surface.
- Microsoft (2016), Language Server Protocol — the precedent; the same M×N problem, solved the same way.
Primary sources, listed so you can check the claims on this page rather than take them on trust.
Where people go wrong
- Treating the protocol as a permission system. It isn't one and doesn't claim to be.
- Connecting a server that reads external content to a model with write capabilities, without thinking about injection.
- Installing servers from an ecosystem with the trust assumptions you'd apply to a signed release. It's a package ecosystem.
- Assuming standardisation implies safety. It implies convenience, on both sides.
At a glance
FieldAI Agents
ProblemM×N tool integrations
Shapehost, client, server; JSON-RPC over stdio or HTTP
Three primitivestools (model-controlled), resources (app-controlled), prompts (user-controlled)
Nota security model
PrecedentLSP
DifficultyIntermediate
Often compared with
MCP vs. provider tool APIs — one protocol many clients speak, versus a schema per vendor. The trade is portability against fewer moving parts.
Where this sits
A destination. 26 concepts lead here, and nothing in the corpus depends on it.
13Levelsteps in
26Needs firstconcepts
0Opens upnothing further
1Areastays here
Learn these firstTool Use
Computed from the prerequisite graph, not assigned. How this works