What Is the Model Context Protocol (MCP)?

MCP makes integrations reusable across compatible AI applications. A host uses clients to communicate with servers that expose capabilities. The protocol describes how those capabilities are discovered and used; the enterprise still decides which integrations are appropriate for its work.

A public server listing or tool description is a discovery signal. It does not establish an enterprise Owner, approved purpose, business authority or governance decision. Those require organizational context and evidence.

The official MCP architecture distinguishes three roles. A host can use multiple clients to access different servers, combining their capabilities within an AI application.

For example, an assistant could use one server to retrieve reference material and another to access a business service. The assistant application manages the interaction; the servers provide the integrations. An MCP server is not necessarily an autonomous AI agent.

• Host: the AI application that coordinates model use, context and user interaction, including consent and security decisions.
• Client: the protocol connector inside the host that communicates with a server.
• Server: a service that exposes supported capabilities to clients, such as tools, resources or prompts.

MCP tools are callable functions. A client can discover the available tools and their expected inputs, then request an invocation. A tool might search records, perform a calculation or change data. Its description explains the advertised operation; it does not prove that the implementation behaves safely.

MCP resources expose contextual content identified by a URI, such as a document or a dataset. The host decides how to incorporate that content into the application. Servers can also offer prompts: reusable templates for user interactions.

For a document assistant, a resource could supply a reference document while a tool searches a document collection. Whether either operation is permitted depends on the deployed access controls and the application’s handling of user consent.

Public metadata may identify a server, its published endpoint or package, and its advertised capabilities. Tool names, descriptions and input definitions can help explain what an integration offers. The tools visible to a particular caller can depend on authorization, so a public listing need not describe everything available in an authenticated deployment.

The MCP tools specification treats annotations as untrusted unless they come from a trusted server. Claims about behavior are not a substitute for implementation review or evidence from the relevant deployment.

Use AI Agent Lookup to inspect supported public Agent and MCP Server information as a starting point for discovery. A lookup result alone does not verify who owns an enterprise deployment, which data it accesses, who approved its use, or whether it meets an organization’s policies.

MCP includes an optional authorization framework for HTTP transports, based on OAuth standards. It allows clients to request access to protected servers on behalf of resource owners. Supported authorization flows and enforced permissions must be assessed in the actual implementation.

AI Agent Authorization explains permitted access and actions. A valid access token or discoverable tool does not, by itself, establish approval for an enterprise business purpose or permission to make a particular business decision.

AI Ownership identifies the accountable human. AI Agent Governance connects purpose, authority, access, oversight and lifecycle decisions. The enterprise must decide who approves an integration, what conditions apply, when human review is required and which evidence should be maintained.

Alterlayer governs the organizational context around enterprise AI use. Technical hosts, servers and access-control systems implement protocol interactions and enforce applicable permissions. This definition makes no claim that Alterlayer intercepts MCP traffic or enforces MCP tool calls.

Verified on 8 October 2026: the official latest specification points to revision 2026-07-28. Deployed clients and servers may support different revisions; check their documented compatibility rather than assuming every integration implements the latest release.

The official governance and stewardship document establishes MCP as a series of LF Projects, LLC. Maintainers, Core Maintainers and Lead Maintainers form the MCP Steering Group, with technical participation attached to individuals rather than reserved company seats.

Stewardship of the protocol concerns how the open project develops. It does not assign ownership or approve the use of an AI system inside an enterprise.