MCP (the Model Context Protocol) is the standard way an AI application connects to tools and data: Claude, ChatGPT, Cursor and VS Code speak it, and any company can publish a server. MCP explained in plain terms: the parts, what a server exposes, the two transports, how authorization works since the 2026 spec, where the security risks are, and when building a server is worth it.
Before MCP, every AI application needed its own integration with every tool: a GitHub plugin for one assistant, a different one for the next. MCP replaces that with one protocol. A tool is wrapped once as an MCP server, and any application that speaks MCP can use it. Anthropic introduced it in November 2024; it is now an open standard that the major AI assistants and coding tools support.
Host
The application the person uses. It decides which servers to connect and asks the user before sensitive actions.
Client
Speaks the protocol: discovers what the server offers and calls it.
Server
Wraps one product or system: GitHub, a database, your API.
Your systems
The server calls these with the user's or its own credentials.
The parts of an MCP connection
Hosts can offer capabilities back to servers too: asking the user for missing input mid-task, and letting a server request a model completion through the host rather than holding its own model key.
The client calls the server and gets told it needs authorization, with a pointer to the server's protected-resource metadata (RFC 9728).
From that metadata, the client finds the authorization server and its endpoints.
The client identifies itself. Since the 2026-07-28 revision of the spec, the preferred way is a Client ID Metadata Document: the client's ID is a URL describing it. Dynamic client registration still works but is deprecated.
The user signs in through OAuth 2.1 with PKCE in a browser, and the client receives a token bound to your server.
Every call carries the token, and your server checks it like any API would.
We'll go through what to expose, how customers will sign in, and what it takes to run safely. 30 minutes, free.
Prompt injection: text a tool returns (an email, a web page, a ticket) can contain instructions the model follows. Treat every tool result as untrusted.
Tools that do too much: a single run_sql tool with write access turns any injection into a data change. Prefer narrow tools, read-only by default.
Over-broad tokens: a server holding an admin key acts as admin for every user. Use the user's own permissions where you can.
Untrusted servers: a server can describe its tools misleadingly. Install servers from sources you trust, and review what each tool does.
Confirmation: anything that spends money, deletes data or sends messages should ask the person first. Hosts support this; servers should mark which tools need it.
On AWS, a server can run as a Lambda function or a container behind your usual API edge, and Amazon Bedrock AgentCore Gateway can turn existing APIs and Lambda functions into MCP tools without writing a server. Our posts on MCP authorization and on running MCP servers in production on AWS go further on both.
We design the tools, the sign-in and the safeguards, and deploy it in your AWS account. 30 minutes, free.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
EKS and AI Agents: Running Agents on Kubernetes, and Letting Agents Operate Your Clusters
Two different problems. Running agents on EKS is about long-lived workers, GPUs, sandboxes for code they write, and tight egress. Letting an agent operate EKS, through the EKS MCP server or kubectl, is about read-only by default, separate roles for writes, and approvals. The setups that are safe enough to use.
Read
Agent or Workflow? The LLM Patterns That Survive Production in 2026
Most LLM systems that work in production are workflows with a model in a few steps, not open-ended agents. The five workflow patterns, when a real agent loop earns its cost, and how to tell which one a problem needs before building either.
Read
As of November 9, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.