Anthropic introduced MCP to reduce bespoke integrations
Anthropic released MCP in 2024 as an open protocol for connecting AI assistants to data and tools. Before a shared protocol, each host and integration could require its own discovery format, transport assumptions, and invocation code.
An MCP host manages the user-facing application. A client inside that host maintains a connection to a server, and the server advertises capabilities such as tools and resources through the protocol.
Protocol compatibility does not create a trust boundary
Tool calling describes how a model requests an operation. MCP can carry the tool descriptions and requests, but the host still decides which server to connect to, what credentials it receives, and whether a proposed action may run.
A REST API exposes application endpoints; MCP exposes model-oriented capabilities and discovery conventions.
A read-only repository server makes the boundary concrete
An IDE host can connect to an MCP server that exposes search_files and read_file. The host may approve that server for one repository and withhold write tools entirely.
The protocol describes the exchange, while operating-system permissions and host policy enforce the limit.
The MCP architecture guide explains the roles, and the practical MCP setup covers implementation and guardrails. The common misuse is calling MCP a universal security layer or assuming a compatible server is therefore trustworthy.
Resources and tools carry different risk
A resource supplies context for the host to read, while a tool asks the server to perform an operation. Reading can still expose sensitive data, but a tool may also mutate state or trigger an external side effect.
That distinction should shape consent, logging, and credential scope. A host that displays every capability as an equivalent menu item hides the most important fact about an integration: what can change when the model selects it.
Continue with these glossary entries: