Your assistant can read a catalog in one app, but a second app needs a different integration. Could both discover and call the same capability? Model Context Protocol, or MCP, defines a common way for AI applications and servers to exchange these capabilities.
Before you begin: Understand tools and API requests. No MCP installation is needed for this lesson.
Separate the participants
The host is the AI application the person uses. A client is the protocol connection that the host maintains to a server. The server exposes capabilities and accesses the underlying data or service. The language model may help select a tool, but it is not itself the database or the authenticated network connection.
A “connector” is product language for an integration; it can include an MCP client, server, account connection, and user interface. Do not assume every product called a connector implements MCP or exposes the same features.
Imagine a host connected to a public workshop server. It discovers a tool named read_workshop, with an input schema describing workshop_id. The host can present this capability to a model. A proposed call is checked and sent through the client. The server performs the lookup and returns a result. Only then can the host use the evidence in an answer.
Discoverable does not mean permitted
Before connecting, decide what the server may access. Public fixtures require different controls from private bookings. A remote service must verify the caller and enforce resource access. The host should show meaningful connection permissions and control which actions may run.
An input schema tells you that an argument is a string. It cannot tell you that the signed-in person owns the record named by that string. That check belongs at the service boundary.
| Question | Where to look |
|---|---|
| What tools exist? | Server capability discovery |
| Are arguments well formed? | Schema and handler validation |
| May this user read this record? | Authenticated service authorization |
| Does the answer reflect the record? | Host response evaluation |
This division helps debugging. A model changing a record ID does not fix a failed login. A successful connection does not prove that a source is trustworthy.
Choose how the connection travels
MCP supports local process communication and network transports. With stdio, a client launches or connects to a process and exchanges protocol messages through standard input and output. With Streamable HTTP, messages travel through an HTTP endpoint. A local process inherits an operating environment; a remote endpoint introduces network identity and service deployment concerns.
The current specification reviewed on September 10, 2026 is the July 28, 2026 revision. Older tutorials may target earlier transports or SDK generations. Record both the protocol revision and SDK version when diagnosing compatibility. They are related but not interchangeable version numbers.
Trace a failure before fixing it
The host lists read_workshop, but a call returns “permission denied.” A developer proposes adding “You are authorized” to the prompt. Would that solve the problem?
Follow the missing evidence
No. Tool discovery describes an available interface, not authorization for every resource. Check the actual account connection, token audience and scope where applicable, and server resource policy. Prompt text cannot grant service permissions. Show the user a useful connection or access error instead of retrying with invented identity arguments.
For practice, draw the route of a request from a phone to a host, through its client, to a catalog server. Mark where the user signs in, where credentials stay, and where the returned record becomes model input. Then mark which components can fail independently. This drawing is more useful than treating MCP as a magic plug that makes any service safe.
Next, build a server exposing one intentionally small read-only contract.
Sources
MCP architecture explains the participants. The versioned specification is the normative reference for protocol behavior.