What is MCP (Model Context Protocol)?
Updated · DBShifts
Short answer
The Model Context Protocol (MCP) is an open standard for connecting AI applications to tools and data. An MCP client inside the AI app talks to MCP servers, which expose tools the model can call, resources it can read and prompts it can use. MCP standardises the connection; deciding what each agent may do is left to the server.
Key facts
- MCP was introduced by Anthropic in November 2024 as an open protocol for connecting AI applications to external tools and data.
- An MCP server exposes three kinds of capability: tools the model can call, resources it can read, and prompt templates.
- MCP messages are JSON-RPC 2.0, carried over standard input/output for a local server or over HTTP for a remote one.
- Remote MCP servers authorize clients with OAuth 2.1, but the protocol does not decide which tools or data a given agent may use.
- One MCP server works with any MCP-capable client — Claude Desktop, Cursor, Windsurf, Cline and others — without per-client code.
In the glossary:MCP (Model Context Protocol)
How MCP works
The AI application (the host) runs one MCP client per server it connects to. The client asks the server what it offers — tools/list for tools — and hands those descriptions to the model. When the model decides to use a tool, the client sends tools/call with the arguments the model chose, the server runs it, and the result goes back into the model's context.
That loop is the whole point: the model discovers capabilities at runtime instead of a developer wiring each integration by hand, so a single server is usable from every client that speaks the protocol.
What MCP standardises, and what it leaves to you
MCP standardises discovery, calling, transports and the authorization handshake. It does not decide which tables a token may read, mask personal data, cap how much an agent pulls, or check returned text for instructions aimed at the model. A server that exposes a tool which runs any SQL gives every connected agent everything its database user can do.
So the security of an MCP deployment lives in two places: the servers themselves, and anything placed in front of them that governs which agent may call which tool with which arguments.
MCP and databases
Most database MCP servers expose a query tool. The safer shape is a server that offers structured tools — list tables, read rows with filters, aggregate — and enforces allowlists and masking on its own side, so the model never composes raw SQL against production.
Checklist
- 1
Know which MCP servers each client in your company has configured
- 2
Prefer remote servers with OAuth sign-in over static keys in config files
- 3
Allow each agent only the tools its task needs
- 4
Treat tool descriptions and tool results as untrusted input
- 5
Log every tools/call with the agent and the person it acted for
- 6
Put a read-only database user behind any database MCP server
Common mistakes
Assuming MCP is a security layer
MCP is a protocol. It carries whatever a server allows; it does not narrow it. Governance has to be added by the server or a gateway in front of it.
Long-lived keys in client config files
A key pasted into mcp.json sits on laptops and in repositories, is shared between people, and is rarely rotated. Per-person sign-in avoids all three.
Trusting tool descriptions
The model reads a tool's description as guidance. A malicious or quietly changed description can instruct it — this is tool poisoning.
How DBShifts does it
- DBShifts Agent Gateway is an MCP server for your database with 26 structured tools; none of them accepts raw SQL.
- People can sign in from their MCP client with OAuth 2.1 and PKCE, and each token is bound to one gateway.
- DBShifts Agent Mesh sits between agents and other MCP servers: it filters the tool list each agent sees, refuses tools and arguments a rule does not allow, and scans tool descriptions for injected instructions.
Questions people also ask
Is MCP only for Claude?
No. Anthropic introduced it, but it is an open protocol with clients in many AI apps and editors. A server written once works with all of them.
What is the difference between an MCP server and an API?
An API is designed for developers who read its documentation. An MCP server describes its tools in a machine-readable way so a model can discover and call them at runtime. Many MCP servers wrap an existing API.
Related questions
Give AI agents data access you can defend
Scoped tokens, PII masked on the server, every request audited. Free to start.
Start free28 answers in this series. See all or browse the AI agent glossary.