What Is MCP (Model Context Protocol)? How It Works, What Changed in the 2026-07-28 Spec, App Setup and Security

MCP (Model Context Protocol) is an open specification that lets AI apps (Claude Code, ChatGPT, VS Code and others) use external tools and data (GitHub, databases, internal systems and so on) in one standard way. Build a tool once as an "MCP server," and every app that supports MCP can use it. Because it works like a single cable that fits any device, it is often called "the USB-C of AI."

Anthropic released it on November 25, 2024, and in December 2025 donated it to the Agentic AI Foundation (AAIF) under the Linux Foundation. The current version of the spec is 2026-07-28, and with it MCP became stateless: there is no longer a per-connection "session." This article covers how MCP works, what changed in the current spec, how to register servers in the main apps, a 10-minute hands-on, and the official security rules, based on the MCP specification and each vendor's official documentation (checked on November 12, 2026).

Inside your own machine the transport is stdio; over the network it is Streamable HTTP. The AI decides which tool to use and when, and the host gets the user's approval before calling it.

1. What MCP is: one shared contract between AI and tools

Before MCP, every AI app connected to tools in its own way. To use a "post to Slack" tool from three apps, you built it three times. MCP turned that connection layer into a single specification. With M apps and N tools, what used to be M×N integrations becomes M+N implementations. The spec itself says it takes inspiration from the Language Server Protocol (LSP), which standardized language support across editors.

The three things a server can expose

In the other direction, the client (the app side) can offer servers Elicitation, which lets a server ask the user for additional information. Roots (telling a server which folders it may work in) and Sampling (letting a server ask the app's model to generate text), which existed in earlier versions, are deprecated in the current version (section 4).

2. What happened in the two years since launch

MCP spec versions are named after "the last date backwards-incompatible changes were made." Here are the main events alongside those versions.

• November 25, 2024Anthropic published the spec and SDKs. The first version was 2024-11-05.
• March 26, 2025Version 2025-03-26 added Streamable HTTP for remote servers and OAuth-based authorization, and deprecated the older HTTP+SSE transport. The same day (US time), OpenAI's Sam Altman said OpenAI would support MCP across its products (TechCrunch report).
• June 18, 2025Version 2025-06-18 added structured (typed) tool output and Elicitation.
• November 25, 2025Version 2025-11-25 added Tasks for long-running work (experimental) and Client ID Metadata Documents, which let a client identify itself by a URL.
• December 9, 2025Anthropic donated MCP to the AAIF, co-founded by Anthropic, Block and OpenAI and supported by Google, Microsoft, AWS, Cloudflare and Bloomberg. The announcement that day cited more than 10,000 active public MCP servers and 97M+ monthly SDK downloads across Python and TypeScript, and named ChatGPT, Cursor, Gemini, Microsoft Copilot and VS Code as adopters.
• July 28, 2026The current version, 2026-07-28, removed the handshake (initialize) and sessions and made MCP stateless (section 4).

MCP spread because the spec is a thin layer on top of JSON-RPC 2.0 and JSON Schema that is easy to implement, because it was published as an open spec early, and because the donation meant it no longer belonged to any one company. With competing vendors on the same spec, tool builders only have to build once.

3. How it works: host, client, server, and two transports

The spec has three roles. The host is the AI app the user works in, a client is the connector the host runs for each server (one per server), and the server is the side that exposes tools and data. Messages use JSON-RPC 2.0: the client receives the list of tools (tools/list), calls the tool the AI chose with arguments (tools/call), and gets the result back.

4. What changed in the current spec, 2026-07-28

According to the spec's versioning page, the current version is 2026-07-28. Compared with the previous version, 2025-11-25, the way connections work changed significantly. The main differences, per the changelog:

Under the spec's feature lifecycle policy, deprecated features stay for at least twelve months before they can be removed (or as little as 90 days when there is an active security risk, such as a published vulnerability or in-the-wild exploitation that can't be mitigated in place). The spec also describes a backward-compatible way to talk to peers that still use the pre-2026 handshake (2025-11-25 and earlier).

What it means for users and builders

• Users

  If your app supports it, there is nothing to do

  Claude Code supports 2026-07-28 through its "v2 runtime," built on MCP TypeScript SDK 2.0. It asks each server whether it supports the newer version and uses it if so; otherwise it connects with the older handshake. The v2 runtime is the default from v2.1.232 in sessions that fetch feature flags, and from v2.1.274 in sessions that don't. To stay on the older protocol, set the environment variable MCP_PROTOCOL_NEGOTIATION=legacy (Claude Code MCP documentation).

• Builders

  Move to the 2.x SDKs and don't adopt deprecated features

  The Python SDK is on 2.x (mcp 2.3.0 on PyPI, released October 2, 2026), and the TypeScript SDK 2.x supports 2026-07-28. In 2.x the TypeScript packages are split into @modelcontextprotocol/server and @modelcontextprotocol/client (2.4.0 on npm), while the older @modelcontextprotocol/sdk stays on 1.x (1.32.2). In new servers, pass folders through tool arguments or configuration instead of Roots, and log to standard error or OpenTelemetry instead of Logging. For state that spans several calls, mint unguessable IDs and bind them to the user (section 9).

• Extensions

  Opt-in "extensions" now sit outside the core

  The spec overview lists notable extensions: Tasks for long-running work, MCP Apps for interactive UI such as charts and forms inside a conversation, and Skills over MCP for delivering agent instructions through MCP (under discussion in a working group). An extension is used only when both client and server support it.

5. How to register servers in the main apps, and where the config lives

The same MCP server is registered differently, and stored in a different file, in each app. Here is what each vendor's official documentation says (checked November 12, 2026).

Sources: the MCP documentation for Claude Code, Codex, Gemini CLI and VS Code. Connectors (remote MCP servers) you add in claude.ai also show up in Claude Code's /mcp, but they are not loaded when you are signed in with an API key (what to do when connectors are disabled).

6. Servers you can use today, and where to find more

To find servers, start from the MCP Registry, the list of public servers, and the Anthropic Directory of connectors Anthropic has reviewed. The official repository now keeps seven reference servers (Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking, Time); its README describes them as educational examples for developers building their own servers and asks you to evaluate your own security requirements. The GitHub, PostgreSQL, Slack and other servers that used to live there moved to servers-archived (GitHub's now lives with GitHub itself, and Slack's is maintained by Zencoder). Don't follow old tutorials as-is.

7. Try it in 10 minutes: let Claude Code read a folder

Using the official filesystem server, you let Claude Code read only one folder you choose. This assumes Node.js (npx) is installed.

1. Create a test folder. Make an empty folder with nothing important in it (for example ~/mcp-test) and put one short README.md in it. The server can touch only this folder.
2. Register the server. On macOS and Linux, run the following. Everything after -- is passed as the server's start command.

   claude mcp add --transport stdio files -- npx -y @modelcontextprotocol/server-filesystem ~/mcp-test

   On native Windows (not WSL) you can register it the same way, writing the folder as C:\mcp-test. If npx fails to start, wrap it in cmd /c, as the reference server's README shows for Windows.

   claude mcp add --transport stdio files -- cmd /c npx -y @modelcontextprotocol/server-filesystem C:\mcp-test

   Adjust the folder path to your own environment.
3. Check the connection. Start Claude Code, open /mcp, and check that files shows connected. If it shows failed, see how to fix MCP server connection errors.
4. Use it. Ask "Summarize the README in mcp-test." Claude Code asks for permission before using the tool; look at the tool name and arguments before you allow it.
5. Clean up. When you're done, remove it with claude mcp remove files.

Remote servers are registered by URL (for example claude mcp add --transport http notion https://mcp.notion.com/mcp); after registering, finish authentication from /mcp. There are three scopes: the default local is just you in that project, --scope project writes to .mcp.json in the project root to share with your team, and --scope user makes it available in all your projects. Keep servers whose credentials you don't want in version control in local.

8. Build your own MCP server: a minimal example

Using servers is useful on its own, but MCP really pays off when you open your own in-house tools to AI. With the Python SDK (2.x), a dozen or so lines are enough. The example is a server that "returns current stock levels."

Install the SDK with uv add "mcp[cli]" (or pip install "mcp[cli]"). The [cli] extra adds the mcp dev and mcp run commands used below.

from mcp.server import MCPServer

mcp = MCPServer("inventory-server")

@mcp.tool()
def get_stock(sku: str) -> int:
    """Return the current stock level for a SKU"""
    # Query your internal inventory DB here
    return query_internal_db(sku)

if __name__ == "__main__":
    mcp.run(transport="stdio")

• Test

  uv run mcp dev server.py, from the SDK README, opens the official testing UI (MCP Inspector) so you can check the tool list and call results without an AI in the loop.

• Register

  In Claude Code: claude mcp add --transport stdio inventory -- python server.py. The function's docstring becomes the tool description the AI sees, so say concretely what it returns.

• Share

  To share it inside your company, uv run mcp run server.py --transport streamable-http turns it into an HTTP server. In that case, follow the authorization and token rules in section 9.

The official SDKs are TypeScript, Python, C#, Go, Rust and Ruby (Tier 1), Java (Tier 2), and Swift, PHP and Kotlin (Tier 3). Tiers reflect feature completeness and maintenance commitment, and each SDK adopts new spec versions on its own schedule.

9. Security: the key points of the official Security Best Practices

The spec treats tools as "arbitrary code execution" and states that hosts must obtain explicit user consent before invoking any tool. Tool descriptions and annotations are to be treated as untrusted unless they come from a trusted server. On top of that, the official Security Best Practices list attacks specific to MCP and their mitigations.

Five things users should check before installing a server

If a string returned by a server says "ignore your previous instructions and…," the AI can be hijacked. Treat server output as data, and have a person confirm irreversible actions such as sending, deleting or paying every time. We cover the thinking behind this in precautions for what you feed into AI prompts. If you build agents yourself, the design side (how to give tools, minimizing permissions, separating dangerous operations) is covered step by step in the MCP and tool connections chapter of our AI agent development course.

10. MCP vs. API vs. Skills vs. A2A

These four aren't mutually exclusive. For example: fetch fresh data through MCP, shape it with a Skill's procedure, and hand it to another department's agent via A2A. MCP servers can also be bundled into Claude Code plugins and distributed to your team together with skills and hooks.

11. Don't install or build too much

• Context

  Tool results consume context

  Claude Code uses tool search by default: at session start it loads only tool names and server instructions, and loads definitions when they are needed. Tool results still use context, though: Claude Code warns when one output exceeds 10,000 tokens and caps it at 25,000 tokens by default (adjustable with MAX_MCP_OUTPUT_TOKENS).

• Design

  Don't turn everything into MCP

  The more tools one request calls, the more time and money it costs. If the AI doesn't need to choose, an ordinary program or API call is faster and more reliable.

• Spec

  Build expecting the spec to change

  Some versions, like 2026-07-28, change how connections work. Deprecated features normally stay for at least twelve months (as little as 90 days for an active security risk), but review your own servers as the SDKs update.

• Revenue

  Can your server make money?

  MCP itself has no billing mechanism. We compare sales channels and fees in can MCP servers be monetized.

Summary

• MCP is an open specification that connects AI apps to external tools and data. Anthropic released it in November 2024 and donated it to the AAIF under the Linux Foundation in December 2025.
• The roles are host, client and server. Servers expose Tools, Resources and Prompts, over stdio or Streamable HTTP.
• The current version is 2026-07-28. It removed the handshake and sessions to become stateless, and deprecated Roots, Sampling and Logging.
• Claude Code, Codex and Gemini CLI register servers with an mcp add command, Claude Desktop with a config file, and VS Code from the Command Palette.
• Start by trying the filesystem reference server on an empty folder and confirm the connection with /mcp.
• A custom server takes a dozen or so lines with the Python SDK. Test it in MCP Inspector before registering it.
• The official Security Best Practices call for showing the full start command and getting approval, rejecting tokens not issued for the server, unguessable IDs, and minimal scopes.

FAQ

Q1. Do I need special training to use MCP?

Not to use it. In Claude Code it's one claude mcp add line, and in Claude Desktop a few lines in a config file. Even building your own, the SDK takes care of the JSON-RPC details, so you can start by writing a function and adding a decorator.

Q2. Can I use MCP in ChatGPT?

Yes. According to OpenAI's help page, checked on November 12, 2026, connecting your own MCP servers to ChatGPT (full MCP support including write actions) is available on ChatGPT Business, Enterprise and Edu, on the web. You add the server's public HTTPS endpoint (or a Secure MCP Tunnel) from Plugins with "Add custom MCP server" and acknowledge the risk warning; you don't need to turn on developer mode first. In Business only admins and owners can connect servers; in Enterprise and Edu, admins can also grant that permission to selected members through role-based access control (RBAC). Only admins and owners can publish to the workspace, and connecting from mobile isn't supported. See OpenAI Help for details.

Q3. Will older servers stop working with the 2026-07-28 version?

Not right away. The spec includes a backward-compatible procedure for talking to peers that use the handshake from 2025-11-25 and earlier, and Claude Code connects to servers that don't support the newer version using the older protocol. Deprecated features also normally stay in the spec for at least twelve months (as little as 90 days only when there is an active security risk). For your own servers, check whether they rely on Roots, Sampling or Logging when you move to the 2.x SDK.

Q4. Is it safe to open an internal database to AI via MCP?

It depends on how you design permissions. If you use a read-only connection and expose only fixed queries with strictly validated arguments as tools, it's far safer than letting the AI write raw SQL. A tool that "can run any SQL" is dangerous. If you share it over HTTP, accept only tokens issued for your server, keep scopes minimal and keep logs, as described in section 9.

Q5. Are MCP and function calling (tool calling) different things?

They sit at different layers. Function calling is the format inside a model API for saying "I want to call this function with these arguments," while MCP is the communication contract between an app and external servers. An MCP-capable app passes the tool list it received from servers to the model in its tool-calling format, then sends the call the model chose to the server over MCP.