What Is an MCP Server? A Plain-English Guide (2026)

Bottom line: MCP servers are the standard way to give an AI app access to your tools and data. Use them, but only from providers you trust, and keep a human approving actions.

An MCP server is a small program that gives an AI app access to a tool or data source through the Model Context Protocol (MCP). The server exposes a few actions or pieces of data, such as "search my GitHub issues" or "read this database table". Any app that speaks MCP, including Claude, ChatGPT, Codex, Cursor and VS Code, can then use them without custom code for each one.

The official docs compare MCP to "a USB-C port for AI applications". One plug shape, many devices. Build a server once, and every MCP-compatible app can use it.

How we researched this: the MCP specification (version 2026-07-28), the official SDKs and registry, Anthropic's announcements, and the MCP docs for Claude Code, Codex and Cursor, checked October 28, 2026.

What is an MCP server, in plain English?

Think of three parts. The host is the AI app you use, like Claude Desktop or Cursor. Inside it, a client handles the connection. The server is the program on the other end that does the actual work.

When you ask Claude to "find the open bugs assigned to me", the model sees that a connected GitHub server offers a tool for listing issues. It asks to call that tool. The server talks to GitHub's API and sends the results back to the model as text.

The server doesn't contain any AI. It's a translator between a standard format the model understands and whatever system sits behind it.

What can an MCP server provide?

The spec defines three things a server can offer, and who controls each one:

Primitive	Controlled by	What it is	Example
Tools	The model	Actions the AI can take	Create a Jira ticket, run a SQL query, click a button in a browser
Resources	The app	Data the app attaches as context	A file's contents, a database schema, git history
Prompts	You	Ready-made templates you pick	A "review this pull request" slash command

Tools are what most people mean when they talk about MCP. They're also the risky part, because a tool can change things. The spec says "tools represent arbitrary code execution and must be treated with appropriate caution."

How does an MCP server connect?

There are two standard ways, called transports:

Local (stdio). Your AI app starts the server as a program on your own computer and talks to it directly. Good for files, local databases and dev tools. Credentials come from your environment.
Remote (Streamable HTTP). The server runs on the web, and your app sends it HTTPS requests. This is how vendors such as Notion, Figma and GitHub offer hosted servers. Sign-in uses OAuth 2.1, so you log in through your browser instead of pasting a password.

The older SSE transport is deprecated. If a guide tells you to use --transport sse, look for a newer setup.

Real examples of MCP servers

A few widely used servers, all from official sources:

Server	What it does	Where
GitHub MCP server	Connects AI apps to your repos, issues and pull requests	github/github-mcp-server
Playwright MCP	Lets the AI drive a real browser: open pages, click, fill forms	microsoft/playwright-mcp
Filesystem, Git, Fetch, Memory, Time	Small reference servers from the MCP project	modelcontextprotocol/servers
Notion, Figma, Sentry	Hosted servers from the vendors	Remote URLs in each vendor's docs

The reference servers are labeled "educational examples", not production tools. Older reference servers for GitHub, Slack, Postgres and others were archived, so if a tutorial points you to modelcontextprotocol/servers for GitHub, use GitHub's own server instead.

To find more, the official MCP Registry lists public servers. It's still in preview, and it lists servers without security-checking them.

How to add an MCP server

In Claude Code

Remote server, the recommended option:

claude mcp add --transport http notion https://mcp.notion.com/mcp

Local server, with an API key passed in. The -- separates Claude's options from the command that starts the server:

claude mcp add --env AIRTABLE_API_KEY=YOUR_KEY --transport stdio airtable -- npx -y airtable-mcp-server

Add --scope project to share a server with your team through a .mcp.json file in the repo, or --scope user to use it in all your projects. Inside a session, /mcp shows connected servers and handles OAuth sign-in. Details are in the Claude Code MCP docs.

In the Claude apps, MCP servers are called connectors. Ones you add on claude.ai also show up in Claude Code.

In Codex

codex mcp add context7 -- npx -y @upstash/context7-mcp

Codex stores servers in ~/.codex/config.toml. Our Codex pricing guide covers which plans include the Codex CLI.

In Cursor

Add a mcpServers entry to .cursor/mcp.json in your project, or ~/.cursor/mcp.json for every project, per Cursor's MCP docs. The format is a server name with a command and args for local servers, or a url for remote ones.

How to build a simple MCP server

You can write a working server in about ten lines. This is the example from the official Python SDK README, with one tool and one resource:

from mcp.server import MCPServer

mcp = MCPServer("Demo")

@mcp.tool()
def add(a: int, b: int) -> int:
    """Add two numbers."""
    return a + b

@mcp.resource("greeting://{name}")
def greeting(name: str) -> str:
    """Greet someone by name."""
    return f"Hello, {name}!"

Install the SDK with pip install "mcp[cli]", then run mcp dev server.py to test it in the MCP Inspector before connecting a real app. The docstrings matter: the model reads them to decide when to call each tool.

There's an official TypeScript SDK too, and the build-a-server tutorial walks through a fuller example.

What changed in MCP in 2026?

Much of what you'll read about MCP describes the 2025 version. The current spec, dated July 28, 2026, made real changes, per the official changelog:

The protocol is now stateless. The opening handshake and session IDs are gone, which makes remote servers easier to scale.
Sampling, roots and logging are deprecated. Older guides list them as core client features.
Extensions are now official, including MCP Apps (interactive UI inside a chat) and long-running Tasks.
Dynamic client registration for OAuth is deprecated in favor of client metadata documents.

Deprecated features stay supported for at least 12 months, so existing servers keep working.

MCP also changed hands. Anthropic created it and announced it on November 25, 2024. On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation, a Linux Foundation fund co-founded with Block and OpenAI. At the time, Anthropic counted over 10,000 active servers and 97 million monthly SDK downloads.

Are MCP servers safe?

They're as safe as the server you install and the permissions you give it. Anthropic's security docs say it "does not security-audit or manage any MCP server", and OpenAI says the same about custom servers in ChatGPT.

The risks to know:

Prompt injection. A server that fetches web pages, emails or tickets can pass along hidden instructions. Claude Code's docs warn that such servers "can expose you to prompt injection risk."
Malicious local servers. A local server runs as a program on your machine. The spec's security best practices give the example of an install command that also copies your SSH keys.
Untrusted tool descriptions. The spec says clients must treat tool descriptions as untrusted unless the server is trusted. A bad server can describe a tool one way and behave another.
Token misuse. Servers must only accept tokens issued for them, never pass your tokens through to other services.

Before installing an MCP server, we'd check five things:

Who publishes it? Prefer the vendor's own server, such as GitHub's or Notion's.
What does it need? Read the tools list and scopes. A docs-search server shouldn't need write access.
Is it local or remote? A local server runs code on your machine, so check the exact command.
Does it read outside content? Web, email and ticket servers carry more injection risk.
Do you approve each tool call? The spec says there should always be a human able to deny a call. Keep that on for anything that writes.

If you use Claude Code with broad permissions, our guide to --dangerously-skip-permissions explains why MCP tools plus no approvals is a risky mix.

MCP server vs API: what's the difference?

An API is how one program talks to a specific service. An MCP server usually wraps an API in a standard shape that any AI app understands, with descriptions the model can read. Without MCP, every AI app would need its own integration for every service. With it, one server works everywhere.

MCP gives Claude access to a system. Skills teach it how to use that access; our guide to what Claude skills are explains the difference.

FAQ

What is an MCP server in AI?

It's a program that exposes tools, data or prompts to AI apps through the Model Context Protocol, so a model can take actions or read information in another system, such as GitHub or a database.

Who created MCP?

Anthropic created the Model Context Protocol and released it as an open standard in November 2024. Since December 2025 it's governed under the Agentic AI Foundation at the Linux Foundation.

Do MCP servers cost money?

The protocol and the official SDKs are free and open source. Many servers are free too, but the service behind them may not be, and every tool call uses tokens from your AI plan or API budget.

Which apps support MCP servers?

Claude (web, desktop, Claude Code), ChatGPT, OpenAI Codex, Cursor and VS Code all support MCP servers, among many others. Our roundup of the best AI for coding compares the main coding tools.