MCP explained for normal people: what it is and where it can bite

The one-sentence version

MCP stands for Model Context Protocol. The project’s own docs call it “an open-source standard for connecting AI applications to external systems.” They compare it to a USB-C port: one plug shape that works across many devices.

Before a standard like this, each AI app needed custom code for each tool. With MCP, a tool maker builds one connector, and any app that speaks MCP can use it.

Who made it, and who runs it now

Anthropic introduced MCP. In a December 9, 2025 post, Anthropic said it had launched the standard “one year ago.”

In that same post, Anthropic said it donated MCP to the Agentic AI Foundation, a fund under the Linux Foundation. Anthropic, Block, and OpenAI co-founded the foundation. Anthropic says MCP’s governance model “will remain unchanged,” with maintainers still weighing community input.

So the short answer: Anthropic started it, and a neutral foundation hosts it now. As of Nov 12, 2026, that is what the official sources say.

Servers and clients, without the jargon

The architecture docs use three words:

• Host: the AI app you use, such as Claude Code or VS Code.
• Client: a piece inside the host that keeps one connection open to one server.
• Server: a program that offers things the AI can use. “Server” does not mean a big machine. It can run on your laptop.

Servers can offer three kinds of things. Tools are actions the AI can run, like searching a database. Resources are data it can read, like a file. Prompts are reusable instruction templates.

Local servers run on your machine. Remote servers run somewhere else, such as a vendor’s cloud, and talk over the web.

Real examples

The official intro lists a few. An agent can reach your Google Calendar and Notion. Claude Code can build a web app from a Figma design. The architecture page names a Sentry server and a local filesystem server as examples.

Anthropic’s Claude Code docs say it can use MCP to read design docs in Google Drive, update Jira tickets, or pull data from Slack.

Where it can bite

MCP gives an AI more reach. More reach means more ways for things to go wrong. Here are the two big ones.

Prompt injection through tool results. An AI reads whatever a tool sends back. If that text contains hidden instructions, the AI may follow them. Anthropic’s MCP docs put it plainly: servers that fetch outside content “can expose you to prompt injection risk.” OWASP lists prompt injection as risk number one in its LLM Top 10.

Over-broad permissions. The MCP security guide warns about tokens with wide scopes like “files:” or “admin:”. If one leaks, the damage reaches everything that token touches. It recommends starting with a small set of permissions and adding more only when needed.

Other points from the same guide:

• Local servers can run commands with your privileges. A bad startup command can run code or steal files, so clients should show you the exact command and ask first.
• Servers should never accept tokens that were not issued for them.

Anthropic also says in its Claude Code security page that it reviews connectors against listing criteria, but “does not security-audit or manage any MCP server.”

What to do next

1. Before adding an MCP server, find who publishes it and read what tools it offers. Prefer servers from vendors you already trust, or write your own.
2. Give each server the least access it needs. Use read-only where you can.
3. Keep approval prompts on for anything that writes, sends, or deletes. Try one harmless server first. Note what permissions it asks for.