What is MCP Server?
Also called Model Context Protocol server.
An MCP server is a program that exposes tools, data resources, or prompt templates to AI applications using the Model Context Protocol. It wraps an underlying system such as a database, file store, or web service, describes what it can do in machine readable form, and executes the requests that a connected client sends to it.
A server declares its capabilities during the connection handshake, then waits for requests. Tools are actions a model can choose to invoke, resources are addressable pieces of context that the host application decides to include, and prompts are reusable templates a user can select. Each is published with a name and a human readable description, and tools additionally carry a schema describing their inputs.
Servers run in two common shapes. A local server is launched as a subprocess on the same machine and communicates over standard input and output, which suits file system and developer tooling access. A remote server is reached over HTTP and normally requires authorization, which suits shared, multi-user deployments. The same server code can often support both transports.
The most common design error is exposing a thin wrapper around every endpoint of an underlying API. Long tool lists crowd the model's context and make selection unreliable. Well designed servers offer a small number of task shaped tools with careful descriptions. The second common error is trusting the caller, since a server must enforce its own authorization rather than assuming the client already did.
A server is a security boundary. Whatever credentials it holds define the blast radius of any mistake or injected instruction, so scoping those credentials narrowly matters more than any prompt level control. Content the server returns should be treated as untrusted data, because a document or ticket it fetches may itself contain text written to steer the model that reads it.
Key points
- Exposes tools, resources, and prompts over the Model Context Protocol.
- Runs locally as a subprocess or remotely as an HTTP service.
- Must enforce its own authorization, never assuming the client did.
- A few well described tools beat many thin endpoint wrappers.
- Its credentials define the blast radius of any mistake.
In practice
A company runs an MCP server in front of its analytics warehouse. It exposes one tool called run_saved_report, which takes a report name and a date range and returns rows. The server holds a read only database credential and rejects any report name outside an approved list. An assistant connected to it can pull last week's numbers, but cannot write to the warehouse or invent a new query.