Model Context Protocol (MCP) is a shared protocol for connecting AI applications to tools and information. An MCP server exposes capabilities that a client can discover and use, such as searching articles or retrieving an order.
Understand the connection roles.
A host application provides the user experience and can manage clients that connect to servers. A server exposes supported capabilities, which can include tools, resources, or reusable prompts. The client and server exchange structured messages so the application can discover and request those capabilities.
A tool describes an operation the application may invoke. A resource supplies information. A prompt can provide a reusable interaction pattern. Support differs by client and server, so discovery does not mean every capability is usable or approved in every host.
Keep connection and authorization separate.
Authentication establishes an identity at a connection boundary; authorization determines what that identity may do. A successful connection must not be interpreted as permission for every record or action behind the server. Downstream systems still need to enforce their own access requirements.
Review whether a server uses delegated user access, an application identity, or another supported mechanism. Avoid broad shared credentials that hide who requested an operation. Server operators, permissions, and tool changes should be visible to the application owner.
Example: searching and updating an order.
A server could offer one tool for retrieving order status and another for updating a delivery address. Both use the same protocol, but the second has different consequences. Its implementation should validate the target record, permitted fields, and the requester's authority before applying a change.
Returned text also remains untrusted information. An order note instructing the assistant to ignore policy or disclose other records should not override application instructions. The host needs to distinguish tool output from authority to perform a new action.
Design for change and failure.
Confirm supported transports, authentication behavior, timeouts, and error handling for the chosen client and server. Test unavailable tools, malformed arguments, denied access, and changed schemas. Record relevant calls without unnecessarily retaining sensitive payloads. A reviewed server version is a starting point; changes in its tools, hosting, or downstream permissions can change the application's effective reach.
Further reading
Read the MCP architecture overview for protocol roles. The AI Security perspective covers server trust, permissions, tool validation, and testing.