# Model Context Protocol (MCP)

AI Glossary · Agents & Automation
Canonical URL: https://aisat.uk/glossary/model-context-protocol
Author: Lucy Gilmore, Assistant General Counsel, Product, Privacy & AI at Sprinklr | Practical Privacy, Product & AI Governance & Defensible Risk Decisions (https://www.linkedin.com/in/lucy-gilmore/)
Breadcrumb: [Glossary](https://aisat.uk/glossary) > [Agents](https://aisat.uk/glossary?category=agents) > Model Context Protocol (MCP)

## TL;DR

> **The Model Context Protocol (MCP)** is an open standard introduced by Anthropic in November 2024 and donated to the Linux Foundation's Agentic AI Foundation in December 2025. It provides a universal interface for connecting language models and AI agents to external data sources, tools, and prompts.

## How Model Context Protocol (MCP) works in practice

Before MCP, every pairing of an AI application and an external system required a custom connector, creating an N-by-M integration bottleneck across chat clients, IDEs, databases, and SaaS APIs. MCP replaces bespoke glue code with a client-host-server architecture built on JSON-RPC 2.0 messages sent over standard input/output (stdio) for local processes or Streamable HTTP for remote deployments.

An MCP server exposes three core primitives to any compliant host application: Resources (read-only data streams such as database schemas, log files, or CRM records), Tools (executable functions with JSON Schema inputs that allow the model to query APIs or mutate state), and Prompts (reusable interaction templates). When a session starts, the client and server negotiate capabilities so the model discovers available tools dynamically.

In practice, a Manchester SaaS engineering team runs internal MCP servers for Postgres, Sentry, and Linear. Whether a developer works inside Claude Code, Cursor, or an internal incident-triage agent, the assistant uses the exact same MCP server definitions to inspect a failing production trace, check read-replica schema constraints, and draft a linked bug ticket.

## Why it matters and trade-offs

MCP has become the de facto USB-C port for enterprise AI tooling, backed by Anthropic, OpenAI, Google, Microsoft, and AWS under the Linux Foundation's Agentic AI Foundation. Writing one well-tested MCP server lets an organisation expose an internal platform to every approved coding agent and workflow orchestrator simultaneously, avoiding vendor lock-in when switching underlying models or developer tools.

However, MCP introduces security and context-window governance challenges. Loading dozens of verbose MCP tool definitions into a session consumes thousands of input tokens before the user types a word and degrades tool-selection accuracy. Furthermore, combining untrusted third-party MCP servers with internal write-capable tools creates severe indirect prompt-injection paths, requiring OAuth 2.1 scoping, container sandboxing, and human approval gates on destructive actions.

## Primary sources

- [Anthropic: Introducing the Model Context Protocol](https://www.anthropic.com/news/model-context-protocol)
- [Model Context Protocol Specification](https://modelcontextprotocol.io)

## Related AI concepts

- [Function Calling (Tool Use)](https://aisat.uk/glossary/function-calling): Function Calling (Tool Use) is a model capability in which a language model inspects declared tool schemas and emits a structured JSON invocation naming an external function and arguments for the host runtime to execute.
- [A2A (Agent2Agent Protocol)](https://aisat.uk/glossary/a2a-protocol): A2A (Agent2Agent Protocol) is an open interoperability standard launched by Google in April 2025 and donated to the Linux Foundation in June 2025 that enables AI agents across different vendors and frameworks to discover capabilities, delegate tasks and exchange artefacts.
- [AI Agent](https://aisat.uk/glossary/ai-agent): An AI Agent is a software system powered by a large language model that perceives environment context, maintains state, formulates multi-step plans and executes actions across external tools, APIs and databases to complete a delegated goal.
- [Prompt Injection](https://aisat.uk/glossary/prompt-injection): Prompt Injection is a security vulnerability in which adversarial instructions submitted directly by a user or hidden indirectly inside retrieved web pages, emails or documents override a language model's system prompt to hijack tool calls or exfiltrate data.