What Is an MCP Server? A Plain-English Guide for 2026

An MCP server is a small piece of software that lets an AI tool reach something outside its own chat window — your files, your database, your GitHub account, your calendar. MCP stands for Model Context Protocol. Think of it as a standard plug shape: once everyone agreed on the shape, any AI tool could connect to any outside service without a custom adapter built for every single pair.

If you’ve watched Claude Code suddenly read your database or open a browser and click through your own app, an MCP server was probably doing that part. The AI supplied the thinking. The MCP server supplied the hands.

Where MCP came from

Anthropic built MCP and gave it away free on November 25, 2024. Anyone could read the spec, write a server, and ship it.

That giveaway is why it stuck. OpenAI adopted MCP in March 2025, and Google shipped support later that year, so a server written for one tool generally works in the others too. In December 2025 Anthropic handed the standard to the Agentic AI Foundation — a nonprofit under the Linux Foundation, co-founded with OpenAI and Block — so no single company owns it now. The current version of the spec is dated July 28, 2026.

Developers took it up fast. The official registry at registry.modelcontextprotocol.io lists thousands of servers, and plenty more live on GitHub without ever being registered.

How an MCP server actually works

Three parts. The third is what happens when the first two meet:

1. The server — a small program that sits in front of one service (Stripe, GitHub, your Postgres database) and publishes a menu of things it can do: “read a file,” “create an issue,” “run this query.”
2. The client — the AI tool you’re already using. Claude Code, Cursor, ChatGPT, and GitHub Copilot are all MCP clients.
3. The handshake — when the tool starts, it asks each connected server for its menu and shows that menu to the AI model.

From there the loop is short. You ask for something in plain English. The model looks at the menu, picks the item it needs, and asks your tool to run it. Your tool asks for your OK — most tools let you choose which actions need it — then calls the server and hands the answer back to the model.

Most servers run one of two ways. A local server runs as a program on your own computer, which is how most file and database servers work. A remote server lives on the internet and you connect over HTTPS, which is how the hosted ones from GitHub and Cloudflare work.

What you’d actually use one for

The useful ones for a founder building a product are boring and specific:

• A database server so your AI tool can look at your real tables instead of guessing at the shape of your data.
• A GitHub server so it can read issues, open pull requests, and check what broke.
• A browser server so it can open your app, click through a signup flow, and tell you what’s broken before a customer finds it.
• A docs server so it reads the current documentation for a tool instead of remembering an old version.
• A Stripe or analytics server so you can ask “how many people signed up last week?” and get a real number.

Every one of those replaces a task you’d otherwise do by hand: copying an error message, pasting a schema, screenshotting a dashboard. If you want the wider picture of what to plug in, we keep a running list on the tool stack page.

What an MCP server is not

Four honest edges:

• It isn’t an AI. The server has no intelligence in it at all. It exposes actions; the model decides which to call.
• It isn’t something you open and use. You never look at an MCP server. You install it once, and your AI tool uses it on your behalf.
• It isn’t the same as a Claude Skill. A skill teaches the model how to do a job well. A server gives it access to a system it otherwise couldn’t touch.
• It isn’t required. You can build and ship a real app using Claude Code or Cursor and never install a single MCP server. They make a good workflow faster; the ability to build is already there without them.

The part you should be careful about

An MCP server runs with whatever permissions you hand it, and the AI calls it without a human reading each request. Attackers have already exploited that combination.

In September 2025 security researchers at Koi found a package called postmark-mcp on npm that impersonated a legitimate email integration. It worked exactly as advertised for several clean releases, then quietly started blind-copying every email the AI sent to an address the attacker controlled. Researchers have also demonstrated hidden instructions buried in a server’s own tool descriptions, which the model reads and obeys.

Three rules keep you out of trouble:

1. Install few, and only from makers you recognize. Nobody audits the code in a public directory; a listing only means someone published it.
2. Give each server the narrowest access that works. A server that only needs to read your issues should never hold a key that can delete a repository.
3. Approve writes yourself. Reading data is low-stakes. Sending, deleting, paying, and posting deserve a human clicking yes every time.

The bottom line

An MCP server is plumbing — the standard connection that lets an AI tool touch your real files, data, and accounts instead of working blind. Install two or three that match what you’re building, keep their permissions tight, and your AI tool works from your real setup instead of a guess. The harder part is still choosing what to build and getting people to pay for it. That’s what Software Secrets 2.0 covers, and the whole book is free.