← Reference · Nestor G Pestelos Jr · Print this page
Artificial Intelligence · Protocols & Standards
Model Context Protocol
Reference entry · last updated August 30, 2026
The Model Context Protocol (MCP) is an open-source standard for connecting artificial intelligence models to external data sources, tools, and execution environments.[1] Introduced by Anthropic in November 2024, the specification provides a uniform JSON-RPC 2.0 communication layer between client applications and isolated server processes, replacing bespoke API integrations with a standard interface.[1][2]
Architectural roles
The Model Context Protocol establishes three explicit architectural participants:[2]
- Host: The root application or agent runtime (such as Claude Desktop, an IDE extension, or an autonomous CLI harness) that initiates sessions, evaluates user intentions, enforces permission policies, and coordinates model execution.
- Client: An internal protocol adapter within the host that establishes and maintains a direct 1:1 connection with a specific server instance.
- Server: An independent program that exposes domain tools, contextual resources, and prompt templates to connected clients through JSON-RPC 2.0 messages.
Core protocol primitives
The protocol defines five functional capabilities partitioned between client-controlled and server-controlled operations:[2][3]
| Primitive | Control Direction | Function | Lifecycle & Schema |
|---|---|---|---|
| Tools | Model-controlled | Executable operations callable by the LLM (file editing, database queries, terminal commands). | Exposed via tools/list with JSON Schema parameter definitions; invoked through tools/call. |
| Resources | Application-controlled | Read-only passive data attachments (files, documentation, database schemas, log streams). | Identified by uniform URIs (such as file:/// or postgres://). Clients read via resources/read and track changes via resources/subscribe. |
| Prompts | User-controlled | Parameterized interaction templates and operational recipes authored by the server. | Retrieved via prompts/list and populated through prompts/get with user-supplied arguments. |
| Sampling | Server-initiated | Nested LLM completion requests sent from the server back to the host client during tool execution. | Invoked through sampling/createMessage, giving the server bounded inference access without separate API credentials. |
| Roots | Client-controlled | Filesystem boundaries and workspace path declarations provided by the host to constrain server operations. | Queried through roots/list; updated via notifications/roots/list_changed. |
Transport layers and wire framing
MCP supports two official transport mechanisms for bidirectional JSON-RPC 2.0 message exchange:[3]
1. Standard input / output (stdio)
Used for local tools and command-line utilities. The host spawns the server as a child process and communicates directly over standard input and standard output streams. Messages are framed as newline-delimited JSON lines without HTTP overhead.
2. Server-Sent Events with HTTP POST (SSE)
Used for remote services and networked microservices. The client opens an HTTP GET stream using the Server-Sent Events protocol to receive real-time server messages, events, and notifications. The client sends outgoing JSON-RPC requests to an HTTP POST endpoint exposed by the server.
The Language Server Protocol comparison
The architectural pattern of MCP directly follows Microsoft's Language Server Protocol (LSP).[4] Prior to LSP, integrating $M$ code editors with $N$ programming language analyzers required $M imes N$ custom plugins. LSP established a shared protocol that reduced the engineering complexity to $M + N$.[4]
MCP applies the same reduction to foundation models: instead of authoring custom connectors for every model and tool pair, developers write one MCP server per data source that connects to any compliant host runtime.[1]
Security and isolation boundaries
Because MCP servers execute arbitrary code and read system data, the specification enforces strict security principles:[2]
- Process isolation: Local servers run in distinct operating system processes with user-level privileges rather than running inside the model runtime.
- Explicit permission gates: Tool calls with side effects require host-level confirmation before execution.
- Root containment: Servers must respect root URI boundaries provided during initialization, preventing arbitrary filesystem traversal.
- No credential leakage: When servers request model inference through sampling, the host processes the call using its existing model configuration without exposing underlying provider API keys to the server.
See also
References
- ↑ Anthropic. "Introducing the Model Context Protocol." Anthropic News & Announcements, November 25, 2024. https://www.anthropic.com/news/model-context-protocol
- ↑ Model Context Protocol Community. "Model Context Protocol Specification and Architecture." Model Context Protocol Documentation, 2024. https://modelcontextprotocol.io/
- ↑ Model Context Protocol Specification Working Group. "MCP Schema and Transport Specification (JSON-RPC 2.0)." Open Specification, 2024. https://spec.modelcontextprotocol.io/
- ↑ Microsoft Corporation. "Language Server Protocol Overview and Specification." Microsoft Open Source, 2016. https://microsoft.github.io/language-server-protocol/