When to reach for it
- Tools and data sources need to be usable across different frameworks.
- Local or external systems must be connected.
- Context access should be standardized.
MCP.
Tools speak a shared protocol.
External resources and tools are made available via the Model Context Protocol as a standardized integration layer.
In practiceA coding assistant connects to a local filesystem server and a remote GitHub server through a single MCP transport layer, without custom integration code for each.
When it backfires
- Direct SDK integration is simpler and sufficient.
- The security model is unclear.
- Protocol operation introduces more complexity than value.
The tradeoff
Broad interoperability is gained at the cost of additional operational and permission management overhead.
A shape you can draw on a napkin.
Picture a universal power socket. Before MCP, every tool an agent wanted to use had its own plug — a different SDK, schema, and auth model. Wiring N agents to M tools meant N×M custom integrations.
MCP collapses that to N + M. A tool author writes one server; an agent runtime ships one client. Any tool that speaks the protocol plugs into any agent that speaks it — no custom wiring. It is, in Anthropic's phrase, "a USB-C port for AI applications."
What it actually does.
A standard protocol bridges host and tool server.
Three roles, one stateful connection.
MCP follows a client–server architecture borrowed from the Language Server Protocol. A host runs one or more clients; each client holds a dedicated connection to one server. Messages are JSON-RPC 2.0, carried over stdio for local servers or streamable HTTP for remote ones.
initialize → capability negotiation → discovery → operation
Host
The AI application the user actually touches — Claude Desktop, an IDE plugin, or your agent runtime. It owns the LLM, the conversation, and the decision to use a tool. It spins up clients as needed.
Client
A connector living inside the host that maintains a 1:1 stateful session with exactly one server. It handles the handshake, relays requests, and keeps capabilities in sync.
Server
A program — local or remote — that exposes capabilities over MCP. The tool author writes it once; any compliant client can then discover and invoke what it offers.
Three server primitives.
Tools
Model-controlledExecutable functions the model can choose to call to take an action or fetch live data. Discovered via tools/list, invoked via tools/call.
search_flights(from, to, date)
create_issue(repo, title, body)
Resources
Application-controlledRead-only context data identified by URI — files, rows, documents — that the host can pull into the model's context window without an action.
file:///logs/2026-05.txt
postgres://schema/tickets
Prompts
User-controlledReusable, parameterized templates the server offers — surfaced to the user as slash-commands or menu actions that pre-package a known workflow.
/summarize-pr pr=482
/triage-bug id=ENG-19
The connection runs both ways. A server can also call back into the host through sampling (ask the host's LLM to generate a completion), elicitation (ask the user for more input), and roots (learn which filesystem boundaries it's allowed to touch). That two-way capability is what separates MCP from a plain tool-calling API.
A real run, message by message.
TaskWhat were our top 3 support issues last week?
InitializeThe host's client opens a session and sends initialize. Client and server exchange protocol version and capabilities — the server announces it has tools and resources.
DiscoverClient calls tools/list. The Postgres server returns one tool — query_tickets(sql) — plus its JSON Schema, so the model now knows the tool exists and how to shape arguments.
ReasonThe model decides it needs aggregated counts and selects query_tickets, drafting SQL that groups tickets by category for the last 7 days.
tools/callquery_tickets(sql="SELECT category, COUNT(*) … WHERE created > now() - interval '7 days' GROUP BY 1 ORDER BY 2 DESC LIMIT 3")
ResultThe server runs the query against the database and returns structured content: Billing 142 · Login 98 · Sync 61.
AnswerTop 3 issues last week: Billing (142), Login problems (98), and Sync failures (61).
The point of the protocol: point the same agent at a GitHub MCP server instead and it answers questions about pull requests — with zero new integration code. Discovery, schemas, and invocation are identical because they ride one standard.
The protocol in practice.
Server · Pythonpython
# server.py — expose a database as an MCP server
from mcp.server.fastmcp import FastMCP
mcp = FastMCP("support-tickets")
@mcp.tool()
def query_tickets(sql: str) -> list[dict]:
"""Run a read-only SQL query against the tickets database."""
return db.execute(sql).fetchall()
@mcp.resource("postgres://schema/tickets")
def schema() -> str:
"""The tickets table schema, so the model can read column names."""
return open("schema.sql").read()
if __name__ == "__main__":
# stdio for local; switch to transport="streamable-http" for remote
mcp.run(transport="stdio")MCP and A2A are complementary, not rivals.
Two open protocols cross the boundary out of any single framework. MCP standardizes how an agent talks to a tool; A2A standardizes how an agent talks to another agent. You will often run both.
Dimension
MCP
A2A
Scope
Agent ↔ tool / data
Agent ↔ agent
Standardizes
Tool discovery, invocation, structured I/O
Agent discovery, task lifecycle, artifact exchange
Core artifacts
Resources, Tools, Prompts
Agent Cards, Tasks, Artifacts
Initiator
Agent (client) calls MCP server
Either agent can initiate; tasks have a defined lifecycle
Governing body
Anthropic (open spec)
Linux Foundation (initiated by Google, April 2025)
Privacy model
Tool exposes capability surface; agent owns reasoning
Agents are opaque to each other; internal state stays private
Three ways this pattern will hurt you.
Treating MCP as a network primitive
Teams expose internal databases via MCP without auth checks, treating the protocol layer as a security boundary.
Fix · Enforce auth at the MCP server layer, not just the transport. Audit every exposed resource for least-privilege access.
Brittle schemas on rapid iteration
The MCP server changes its schema weekly. Client agents break because they pin to an outdated tool definition.
Fix · Version MCP schemas and support a compatibility window. Reject clients that don't declare a version header.
Tool-surface overload
One client mounts a dozen servers; the model now sees 80 tools and picks the wrong one — or stalls choosing.
Fix · Mount only the servers a task needs. Scope tools per route and keep names and descriptions unambiguous.
Where MCP is native.
Microsoft Agent FrameworkMicrosoft backs MCP; A2A co-sponsorNative
Claude DesktopReference host — local stdio serversNative
Next pattern