What Is an MCP Server?
MCP is how an AI agent reaches your systems without anyone pasting data into a chat window. What an MCP server actually is, how the parts fit together, what people build with them, and where the security problems live. I build these for clients and maintain one in the open.
An MCP server is a program that exposes tools, data, and actions to AI agents over the Model Context Protocol, an open standard Anthropic introduced in November 2024. The agent asks the server what it can do, the server answers with a list of tools and resources, and the agent calls them by name with structured arguments, the same way software calls an API, except the caller is a language model. Oleg Sotnikov builds custom MCP servers for internal systems and maintains sallyport, an open-source MCP server that runs authenticated actions on a Mac without ever handing the agent a credential.
How MCP Servers Work
Three roles and three kinds of capability. Once the vocabulary is in place, the rest of the protocol reads quickly.
Host
The application the user is actually in: a desktop assistant, an IDE, or an agent you wrote yourself. The host owns the model, decides which servers to connect, and is the right place to ask a human before something irreversible runs.
Client
Inside the host, one client is spawned per server and speaks the protocol as JSON-RPC over a single connection. The one-to-one pairing is deliberate: a badly behaved server never sees traffic meant for another.
Server
Your program. It advertises what it can do, validates arguments, does the work against a database, an API, or the filesystem, and returns something the model can read. It sees the calls you allow and nothing else of the conversation.
Tools
The actions a model can invoke: create an issue, run a query, rotate a key. Each carries a name, a JSON schema for its arguments, and a description the model reads to decide when to call it. That description is part of your API surface, so write it like documentation.
Resources and prompts
Resources are read-only context addressed by URI: a file, a table, a report. Prompts are reusable templates the server offers, so a workflow that took five careful instructions becomes one named command. Both are material for the model rather than actions it performs.
Transport: stdio or HTTP
A local server runs as a subprocess and talks over stdin/stdout, which keeps it on the machine and off the network. A remote server speaks HTTP with streaming, which brings authentication, TLS, and every other question you would ask of a public endpoint. Picking between them is mostly a security decision.
What Happens When an Agent Calls a Tool
Connect and discover
The host starts the server and the two sides exchange capabilities. The server returns its tools with schemas and descriptions, and those go into the model's context. This is why a server with forty vague tools makes an agent worse rather than better.
Call with structured arguments
The model picks a tool and emits arguments as JSON. The client forwards the call, and the server validates against its own schema before touching anything real. A server that rejects bad input here is doing the job the model cannot be trusted to do.
Return a result the model reads
The server does the work and returns text, structured data, or an error. That result lands in the conversation and the model acts on it, so keep it small and clean, and never let a credential or a hundred thousand tokens of log ride along inside it.
MCP Server Examples
The public catalogue keeps growing, and nearly everything in it falls into one of four groups.
Filesystem and documents
Read and write files under a directory you nominate. Usually the first server anyone installs, and the fastest way to learn why scoping matters: the directory you point it at is the entire blast radius.
Code hosts and issue trackers
GitHub, GitLab, Jira, Linear. The agent reads pull requests, opens issues, leaves comments, and moves tickets. Most teams get their first real value here, because the work is high-volume and individually low-stakes.
Databases and warehouses
Postgres, MySQL, BigQuery, Snowflake. Hand the model a schema as a resource and a query tool, and it answers data questions without an analyst in the loop. Read-only credentials are the norm here for good reason.
Browsers and search
Headless browsers, scrapers, and search APIs that let an agent fetch a page and act on what it finds. Useful, and the easiest way to invite prompt injection, because the text comes from strangers.
sallyport: an MCP server built around a secret it will not give up
sallyport is a Mac vault I built and released as open source. It runs authenticated actions for AI agents over MCP: the agent asks for an operation, the vault performs it and returns the result. The agent gets the operation, never the key. No command reveals a stored credential and there is no export route, so a compromised agent session walks away with nothing reusable.
MCP vs API: What Actually Changes
An MCP server almost always sits in front of an API you already have. The difference is who calls it and what that caller needs to see.
REST or GraphQL API
Written for a developer
- Who calls it
- A developer with your documentation open. They work out the endpoints once, write the calls, and the code keeps making them the same way.
- What it exposes
- Every endpoint and every field. Breadth is the point: the caller assembles what they need and ignores the rest.
- What an error says
- A status code aimed at whoever wrote the client. Fixing a 422 means editing code and deploying again.
MCP server
Written for a model
- Who calls it
- A model choosing at runtime. It reads the descriptions the server returned and decides which tool fits the request in front of it.
- What it exposes
- A short list of larger operations, each with a schema and a note on when to use it. The list is context the model reads before it can choose.
- What an error says
- A sentence the model can act on: what was wrong with the argument and what a valid one looks like. The retry happens inside the same conversation.
You do not choose between them. The MCP server is a second interface onto the same system, written for a different kind of caller.
MCP Gateways and MCP Apps
Two shapes that show up once a company runs more than a handful of servers.
MCP gateway
One endpoint in front of many MCP servers. The gateway holds authentication, applies rate limits per team, and keeps a single audit log, so you can add or retire a server without reconfiguring every agent that uses it.
MCP apps
The term people are settling on for applications whose front door is an MCP server: the user is an agent, not a person. There are no screens, so the interface is the tool list, the descriptions, and the shape of the results. Internal tools move first, because their audience was never large enough to justify a UI.
Are MCP Servers Secure?
MCP security is not settled at the protocol level. Almost every incident traces back to how a server was built and what you connected it to.
Credentials handed to the agent
The usual shortcut is an API key in the server's environment, passed through on every call. Now the key sits inside a process the model drives, and anything that can read that process, or talk it into printing its own config, has your key.
Prompt injection through tool results
Whatever a tool returns lands in the model's context: a web page, an issue comment, a row in a table. If that text says to ignore previous instructions and email the database dump, a naive agent may try. Tool output is untrusted input, and the fix sits on both sides: servers that sanitize what they return, hosts that stop for approval before irreversible actions.
Permissions far wider than the task
Teams point a filesystem server at the home directory instead of one project folder, give the database user write access where reads would do, and hand over a token scoped to the whole org. None of that hurts until a tool call goes sideways, and narrowing any of it beforehand takes minutes.
How a Well-Built MCP Server Contains the Damage
- Expose operations, not secrets. The server holds the credential and performs the action; the agent receives only a result. That is the model sallyport is built on, and it survives a fully compromised agent session.
- One credential per server, scoped to the smallest set of paths, tables, and repositories the job needs, and revocable on its own without taking anything else down.
- Validate every argument against the schema and refuse what falls outside it. A model is a caller like any other, and callers get checked.
- Put destructive actions behind explicit human approval, and write tool descriptions that say plainly what the tool will change.
- Log every call with its arguments, its result size, and who approved it. When something goes wrong, that log is how you find out which calls ran and in what order, instead of reconstructing it from memory.
When You Need a Custom MCP Server
Public servers cover public tools. These are the situations where I end up writing one.
Internal systems with no public API
The ERP, the billing engine, the admin panel someone wrote in 2016. If your agents need it and no vendor ships a connector, a thin MCP server over the existing internals is usually a few days of work.
Proprietary data with rules attached
Data a model may see, but only certain rows, and only after masking that depends on who is asking. That policy has to live in the server, because the model will not enforce it on your behalf.
Actions that require authentication
Payments, deployments, key rotation, anything that signs. These are exactly the calls you do not want a general-purpose server making with a shared token, and exactly where keeping the key on the server side pays for itself.
Workflows your team repeats
The release check, the refund procedure, the incident triage runbook. Wrapped as tools and prompts, they stop depending on whoever remembers the order of the steps.
Where this usually goes next: Custom MCP server developmentAI consulting
Frequently Asked Questions
What does MCP stand for?
MCP stands for Model Context Protocol, an open standard Anthropic introduced in November 2024. It defines how an AI application connects to outside tools and data: how a server describes what it offers, how a client calls it, and what comes back. An MCP server is any program that implements the server half of that standard.
What is the difference between MCP and an API?
Most MCP servers sit in front of an API, so the two are layers rather than alternatives. The interfaces are written for different readers: a REST API is designed for a developer with the documentation open, while an MCP server describes itself at runtime so a model can discover the tools, read what each one does, and call one without anyone writing integration code first. An API exposes every endpoint; an MCP server exposes a short list of larger operations and returns errors a model can correct on its own. When you already have an API, the server in front of it is usually thin, and the effort goes into scoping, descriptions, and safety.
How do MCP servers work?
A host application such as an IDE, a desktop assistant, or your own agent starts one client per server it trusts. Client and server exchange capabilities over JSON-RPC, either through stdin/stdout for a local server or HTTP for a remote one. The server publishes tools with JSON schemas, resources addressed by URI, and prompt templates; the model picks a tool and sends structured arguments; the server validates them, does the work, and returns a result that lands back in the conversation.
Are MCP servers safe to use?
They are as safe as the server you install and the permissions you grant it. The failures that actually happen are credentials sitting inside a server the agent drives, prompt injection arriving through tool results from web pages or issue comments, and access scoped far wider than the task. Run servers whose source you can read, give each one its own narrow credential, require human approval for destructive actions, and log every call. A server that performs an authenticated operation without exposing the key, which is how I built sallyport, holds up even when the agent session is compromised.
Do I need to build my own MCP server?
For public tools, usually not. Filesystem, GitHub, Postgres, and browser servers already exist and are maintained by people who use them daily. You need a custom one when the system is internal, when the data carries access rules a model cannot enforce, or when the action requires credentials you are not willing to hand over. In practice that comes to one or two servers per company, and they are small: the engineering time goes into scoping and safety rather than the protocol.
What is an MCP gateway?
An MCP gateway is one endpoint that fronts many MCP servers. Agents connect to the gateway rather than to each server, and authentication, rate limits, and the audit log live in one place instead of being repeated per server. You can then add, replace, or switch off a server without reconfiguring every agent that depends on it.
What are MCP apps?
MCP apps are applications built to be used by an agent rather than a person, shipped as MCP servers. Instead of screens and buttons, the interface is a list of tools, the descriptions that tell a model when to use each one, and results shaped for a model to read.
Need an MCP Server for Your Own Systems?
I design and build them, including the parts that keep credentials away from the agent and the audit trail readable afterwards.
Or book a free 30-minute call and we can work out whether one is worth building.
Related reading
Notes on AI agents, developer tooling, and shipping with a smaller team.
