# Model Context Protocol An open protocol for connecting AI applications to servers that expose context, tools, prompts, and related capabilities. technical-term · Multi-agent & protocols · maturing · Reviewed 2026-08-09 ## Definition Model Context Protocol standardizes how a host application creates clients, negotiates capabilities, and exchanges messages with servers that expose resources and actions. MCP improves interoperability; it does not determine whether a capability is trustworthy, whether a caller has business standing, or whether a proposed effect should be allowed. The protocol has broad adoption and continues to evolve, including enterprise authorization profiles and versioned extensions. ## Why it matters MCP separates an AI application from many capability implementations through shared contracts. Security still requires server trust, identity, authorization, input validation, output handling, network boundaries, and evidence. ## System anatomy - **Host:** The application that coordinates user intent, permissions, and one or more clients. - **Client:** A protocol connection maintained by the host for a server. - **Server:** A process or service exposing declared resources, tools, prompts, or capabilities. - **Transport & messages:** The negotiated communication and request-response layer. ## Important distinctions - **Tool calling:** Tool calling is a model interaction pattern; MCP is one protocol for capability discovery and exchange. - **Control plane:** MCP transports capability requests; it does not grant authority or replace policy enforcement. ## Implementation signals - Pin and govern protocol versions - Authenticate every principal and authorize every effect - Treat server descriptions and results as untrusted input - Register server ownership, purpose, data access, and incident path ## Failure modes - Protocol compatibility is mistaken for trust - A server expands capability after approval without recertification - Tool output injects new instructions into the agent ## Related knowledge - [Tools, skills & protocols](https://aisdlc.ai/agentic-engineering/tools-and-protocols) — The action and knowledge interfaces through which agents use tools, load procedural skills, access enterprise context, and collaborate with other agents. - [Tool calling](https://aisdlc.ai/agentic-engineering/tool-calling) — A model-mediated interface in which the system selects a named function and proposes structured arguments for software to validate and execute. - [Runtime policy enforcement](https://aisdlc.ai/agentic-engineering/runtime-policy-enforcement) — The pre-action decision and enforcement layer that evaluates identity, purpose, risk tier, tool, resource, data class, limits, approval state, and current evidence before allowing an agent action. - [Instruction–data trust boundary](https://aisdlc.ai/agentic-engineering/instruction-data-trust-boundary) — An architecture that distinguishes authoritative instructions from retrieved content, memory, tool results, and external data through provenance, trust labels, privilege separation, validation, and mediated action. ## Sources and further study - [Model Context Protocol — Model Context Protocol architecture overview](https://modelcontextprotocol.io/docs/2026-07-28/learn/architecture) — Documents the host, client, server, capability-negotiation, and message layers used to connect AI applications with context and tools. **Use:** Standard or protocol. **Limitation:** Protocol connectivity and capability discovery do not confer business authority, validate tool output, or make a server trustworthy. - [Model Context Protocol — Enterprise-Managed Authorization for MCP](https://blog.modelcontextprotocol.io/posts/enterprise-managed-auth/) — An emerging authorization pattern for enterprise-managed agent access to MCP servers. **Use:** Standard or protocol. **Limitation:** A specification defines an interface or control pattern; conformance alone does not establish authorization, security, or fitness for a use case. - [Model Context Protocol — Model Context Protocol 2026-07-28 release candidate](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/) — A current protocol release candidate illustrating that agent-tool interoperability, authorization, and extension surfaces continue to evolve and require explicit version governance. **Use:** Standard or protocol. **Limitation:** A specification defines an interface or control pattern; conformance alone does not establish authorization, security, or fitness for a use case. - [OWASP GenAI Security Project — OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) — A threat-oriented reference for goal hijacking, tool misuse, identity abuse, memory poisoning, and cascading agent failures. **Use:** Official guidance. **Limitation:** Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment. --- This library synthesizes cited research, standards, official documentation, and clearly attributed practitioner perspectives. Maturity describes the state of a concept—not vendor endorsement, production readiness, or permission to deploy. Benchmarks and demonstrations do not replace use-case evaluation, governed controls, independent verification, or named human release authority.