What is an MCP server? Model Context Protocol explained with one real example
An MCP server is a service that offers an AI assistant a list of tools it may call, such as "list my projects" or "publish this site", in a standard format any compatible assistant understands. The assistant reads the list, decides which tool fits your request, and calls it with your permission. You stay in charge of what it can reach because you sign in and choose what to allow.
The idea in one paragraph
To answer what is an MCP server, start with the problem it solves. Language models can only read and write text. To do anything in the world, an assistant needs tools, and before MCP each assistant had its own way of plugging them in. The Model Context Protocol is an open standard that fixes the plug: a service describes its tools once, as an MCP server, and any MCP client (Claude, ChatGPT, Cursor, VS Code and others) can use them. The project's own analogy is a USB-C port for AI applications.
The parts
- Host
- The app you talk to, such as Claude Desktop or an editor with an AI panel.
- Client
- The piece inside the host that speaks MCP to one server.
- Server
- The service's side. It publishes tools (actions the assistant can take), and can also offer resources (data to read) and prompts (ready-made instructions).
- Tool
- A named action with a description and typed inputs, for example
publish_sitetaking a project ID. The model reads the description to decide when to use it. - Transport
- How messages travel. Local servers run on your machine; remote servers are reached over HTTPS at an address such as
https://example.com/mcp.
A worked example: building a site from a chat
Anticode runs a remote MCP server at /mcp. Here's what happens when someone connects it to an assistant and types "Make me a one-page site for my pottery classes and show me before you publish":
- Connecting. The person adds the server's address in their assistant's connector settings. The assistant is sent to Anticode to sign in and approve the connection, then receives a token. The assistant never sees the password.
- Discovery. The assistant asks the server which tools exist. Anticode's include listing, getting and creating projects, quoting and starting builds, requesting changes, reading and updating project files, publishing and unpublishing, listing sites, analytics and form submissions.
- Choosing. The model reads the tool descriptions and picks the build tools for this request. It can ask for a quote first, so the cost against the person's allowance is visible before anything runs.
- Acting. It starts the build. Anticode does the work on its own servers, under the same design system and security checks as any other build.
- Showing. Clients that support MCP Apps can display an in-chat preview; the person looks at it in the conversation.
- Confirming. Only when the person says so does the assistant call the publish tool. The change also appears in Anticode's version history, labelled as made by an AI assistant.
Setup steps for each assistant are in editing a website with Claude through MCP and on the MCP server feature page.
How OAuth limits what it can do
Remote MCP servers that need sign-in use OAuth, as set out in the protocol's authorization specification, which builds on OAuth 2.1. In plain terms:
- You approve on the service's own page, not inside the chat, so the assistant can't type your password anywhere.
- The token is issued for that one server. The specification requires servers to accept only tokens issued for them, so a token for one service can't be replayed against another.
- Scopes narrow the grant. On Anticode's consent screen you choose Read and write (create and edit projects, run builds after showing the cost, publish) or Read-only (see projects, sites, analytics and form submissions).
- You can disconnect. Revoking the connection ends the assistant's access without changing your password.
MCP server or plain API?
An API is built for programmers who read its documentation and write code against it. An MCP server is built for a model: tool descriptions in plain language, inputs it can fill from a conversation, and results it can explain back. Many MCP servers are a thin layer over an existing API. If you're writing a script, use the API; if you want to work by talking to an assistant you already use, MCP is the bridge.
Risks and good habits
- Connect only servers you trust, from the service's own documented address. A malicious server can describe tools misleadingly.
- Prefer read-only when you only need answers, such as "how many visits did my site get?"
- Read before approving actions that publish, send or delete. Most hosts ask for confirmation; leave that on.
- Watch for instructions hidden in content. A web page or form submission an assistant reads can contain text aimed at the model. Treat surprising actions as a reason to stop and check.
Limits
An MCP server can only do what its tools allow; the assistant can't reach past them. Anticode's tools don't cover your password, billing or plan, so an assistant can't change them. The quality of the result still depends on the request and on checking what comes back, and not every assistant supports every MCP feature: in-chat previews, for instance, depend on the client.
Questions people ask
Is MCP only for Claude?
No. It was introduced by Anthropic as an open standard and is supported by many assistants and editors, including ChatGPT, Cursor and VS Code.
Does an MCP server see my conversations?
It sees the tool calls the assistant makes to it and their inputs, not the whole chat.
Do I need to install anything for a remote MCP server?
Usually not. You add its address in your assistant's settings and sign in. Local servers, by contrast, run as a program on your computer.