In AI systems, MCP means Model Context Protocol: a contract for how a model calls tools. What it may see. What it may change. How the call is logged.
That is the whole definition. The rest is collision control.
Here MCP means the AI protocol, not Microsoft Certified Professional or the Burroughs Master Control Program.
Not a product, not a contact app, not an agent
MCP is not software you buy. It is not a CRM. It is not the worker. An AI agent still needs a charter. MCP is how that worker is allowed to touch the building.
The official split is host, client, and server. The host is the application (Claude Desktop, Claude Code, VS Code, and others). The host opens one client per server. The server is a program that offers context. It may run on the same machine over stdio, or remotely over Streamable HTTP. The protocol moves context. It does not tell the host how to use the model.
What a server actually does
A server exposes three primitives.
- Tools are actions, and they are model-controlled: the model decides when to call one. They can write. Send mail, edit a file, call an API, move money if you wired that.
- Resources are reads, and they are application-controlled: the host decides what to pull in. A schema, a file, a log, a customer record.
- Prompts are reusable templates, and they are user-controlled: a person invokes them. A template is not a permission.
The control column is the part people skip. It is the difference between “a human chose to do this” and “the model chose, and nobody was asked.”
The traffic is not one-way. Elicitation lets a server ask the client to collect more input from the user. Older MCP explainers also list roots and sampling. Both are deprecated as of protocol version 2026-07-28, and roots never enforced a security boundary. Do not build a new permission model around either.
That is the whole job. A “known MCP server” is just a program that speaks this contract for one slice of the world: files, git, the clock, a knowledge-graph memory. Not everything a model can call is an MCP server. A REST API with an OpenAPI file is an API, and wrapping it in a function definition does not make it MCP. The MCP Registry is where published servers are listed. It is a catalogue, not a safety review.
Reference servers, not a shopping list
The MCP project keeps a small set of reference implementations on GitHub to show the protocol and official SDKs. The README, read 2026-08-27, says they are educational, not production-ready. Evaluate your own ceiling.
Current reference servers in that repository:
- Filesystem. File operations inside a directory you allow. Read and write live here. Treat write as a gate.
- Fetch. Pull web content into something a model can read.
- Git. Read and change a repository.
- Memory. A small knowledge-graph store the model can persist into. A graph is not a ceiling.
- Time. Clock and timezone conversion.
- Sequential thinking. A scratchpad of steps. No files, still a tool.
- Everything. A test server that exposes all three primitives.
Other former reference servers in that repository are archived. A third-party successor elsewhere does not become an official reference. Use the registry for the catalogue, then evaluate the server yourself.
ReasonKit is first-party to this site, not an official reference. Same rule as any other server: visibility, mutation, log.
Three reads
Open the server. Official or homemade. Same card.
- Visibility. What can it see?
- Mutation. What can it change, send, spend, or delete?
- Log. Can you replay the call after it goes wrong?
Test the card: read one allowed file, attempt one denied read, make one dry-run write, then find all three attempts in the log. An unexpected success or a missing trace fails the review.
If the permission lives in a Slack thread, you do not have a contract. Local servers may rely on process, filesystem, and sandbox boundaries; remote servers add transport authorization. Either way, least privilege is your operating design, not a property of the acronym.
Two pages
MCP explained for founders is the longer operating note: blast radius, Tuesday’s log, the fifteen-minute review. Human in the loop meaning is who may approve the call once the contract allows it. This page is the dictionary entry plus what a server is.
STACK is where those contracts live in a repository humans and agents share. The Agentic Codebase is live. You do not need the hardcover to refuse an anonymous tool.