Model Context Protocol · specification 2025-11-25
The Model Context Protocol is an open standard for connecting AI applications to external systems. One integration, written once, works in every client that speaks it. Below is a real interaction — the handshake, the discovery, the tool call, the result — with nothing hidden. Press play, or step through it yourself.
Use the controls after the diagram to play, pause, step and scrub the sequence. Focus any node or connection to read what it is responsible for.
Left and right arrow keys move one message at a time. Home and End jump to the start and end.
Lifecycle Discovery Interaction
Request
The message on the wire for the current step
Why it matters
The short version
Six things that make the rest of this site make sense. If you only read one panel, read the one about the three primitives — almost every confusion about MCP is a confusion between tools, resources and prompts.
MCP standardises one thing: how an AI application asks an external system what it can do, and then does it. It says nothing about which model you use, how you prompt it, or how you manage context. That narrowness is the point — it is why the same server works in Claude Code, VS Code, Cursor and a script you wrote yourself.
Think of it the way the docs do: a standard port, not a standard appliance.
The host is the application you use. Inside it, one client is created per connection, and each client maintains a dedicated, stateful link to one server. Four servers means four clients in the same application, each negotiated independently.
“Server” describes a role, not a location. A local filesystem server launched as a child process and a vendor’s HTTP endpoint on the other side of the world are both servers.
stdio: the client spawns the server as a child process and speaks JSON-RPC over its standard input and output. No port, no network, nothing to firewall.
Streamable HTTP: HTTP POST for client-to-server messages, with optional
Server-Sent Events for streaming, plus standard HTTP authentication. MCP recommends OAuth
for obtaining tokens. An older SSE-only transport still exists at many
/sse endpoints and is being deprecated.
The messages are identical either way. That is what lets a server move from your laptop to a vendor’s infrastructure without changing its data layer.
This is the distinction worth internalising. All three are things a server can offer, but they differ in who decides when they are used.
tools/list, tools/call
weather://forecast/{city} make whole families addressable.
The application decides what to attach.
resources/list, resources/read, resources/subscribe
prompts/list, prompts/get
Clients can expose primitives too. Sampling lets a server ask the host to run a model completion, so a server author needs no model key of their own. Elicitation lets a server ask you a question mid-operation. Logging sends diagnostics back to the client.
Every connection opens with an initialize exchange in which both sides
declare a protocol version and the capabilities they support. If no mutually compatible
version exists, the connection should be terminated rather than guessed at.
Discovery happens at runtime, not build time. A server that declares
listChanged: true can send notifications/tools/list_changed
later, and the client re-lists — so an agent’s capabilities can change mid-conversation
without a restart.
The directory labels every listing with one of three tiers, because
they carry genuinely different risk.
Reference servers live in
modelcontextprotocol/servers and are explicitly
educational examples rather than production products.
Vendor-maintained servers are built by the company
whose product they wrap — usually the safest default.
Community servers are everything else, and are
sometimes the only option, sometimes better than the official one,
and always worth reading before you hand over a credential.
A large star count is a popularity signal, not a security review — and where a repository is a whole platform rather than the server itself, this site says so next to the number.
An issue body, a web page, a calendar invite, a support ticket: these arrive in the model’s context looking exactly like legitimate content. If any of them contains “ignore previous instructions and …”, a naive agent may comply. This is prompt injection, and it is the central security problem of connecting agents to real systems.
The mitigations are boring and effective: least-privilege credentials, read-only modes, narrow toolsets, approval for writes, and never pairing broad read access to private data with an unrestricted outbound channel.
The directory
167 listings across 17 categories, each checked against its own repository or its vendor’s documentation. Star counts and last-commit dates come from the GitHub API. Where something is archived, beta, or riskier than it looks, the listing says so.
Practicalities
Four things nobody tells you until you have already pasted a token into a config file.
Almost every client uses the same idea with a different key name. Below is the identical server — the reference filesystem server, scoped to one directory — written for each of the four most common clients, so you can see exactly what differs.
npx and uvx need to be on the PATH that the client process sees, which is not always the one your shell sees.npx: use "command": "cmd" with "args": ["/c", "npx", …]. Leave uvx entries alone.npx @modelcontextprotocol/inspector connects directly to a server and lists its real tools, resources and prompts. It is the fastest way to find out whether the problem is the server or the client.The uncomfortable part. Connecting an agent to external systems creates a genuinely new risk surface, and most of it comes down to one sentence: tool output is untrusted input. The following is not paranoia, it is the ordinary cost of doing this well.
Issue bodies, PR comments, scraped pages, emails, calendar invites, support tickets, wiki pages and file contents are all written by someone who is not you. Hidden instructions in any of them can steer a model. Servers cannot fix this for you; hosts can only mitigate it.
Mail read plus mail send. Database read plus HTTP POST. Repository read plus a public gist tool. That pairing is the classic exfiltration shape, and it does not require anyone to attack you deliberately — a confused model is enough.
A surprising number of good servers ship an explicit read-only or restricted mode:
GitHub’s GITHUB_READ_ONLY, Postgres MCP Pro’s
--access-mode=restricted, MongoDB’s --readOnly,
ClickHouse’s write flag being off by default, Square’s DISALLOW_WRITES,
SonarQube’s SONARQUBE_READ_ONLY. Use them, then remove the training
wheels deliberately.
Every extra tool is context-window cost, a chance for the model to pick the wrong one, and one more thing an injected instruction could reach for. Toolsets, enabled-tool lists and per-tool disabling are the most underused features in this ecosystem.
The MCP security guidance describes the confused deputy problem in detail: a server that proxies a third-party API with a static client ID, allows dynamic client registration, and does not implement per-client consent can have an authorization code redirected to an attacker who is riding your existing consent cookie. If you build a proxying server, read that document properly.
Scanning, indexing and analysis servers usually offer both a local and a hosted path. The local one keeps your source and your data on your machine.
drop-database. pay_order. place_stock_order.
publish_entry. DeleteDatabaseTool. Filled trades, sent
emails and published pages do not have an undo. Require approval, or do not expose
them at all.
Several servers can run in HTTP mode locally. An unauthenticated local HTTP endpoint
is a DNS-rebinding target: any web page you visit can try to talk to it. That is why
servers such as Terraform’s and Vault’s ship MCP_ALLOWED_ORIGINS, and
why HashiCorp say to always set it.
Every term on this site, defined once.
Yours, kept locally
Shortlist servers as you browse and they collect here, saved in this browser only — no account, no sync, nothing sent anywhere. Then take the merged configuration for your client in one block.