00 / 06Toolkit

MCP: the plug every AI app now shares

The Model Context Protocol is the reason one integration can work in Claude, ChatGPT, Cursor, VS Code, and dozens of other apps.

If you want AI to touch your real files, tools, and accounts, this is the layer that makes it happen.

9 min
04 figures
05 links
In depth
Updated Oct 2026

Fig 01The plug every app shares: the same socket on every device, one cord from the thing you want to connect.

Inside

01How it worksFigureList
02Who runs it
03What changed in 2026FigureList
04A starter setTable
05Adding oneCode
06Stay safeFigureListNote

01 / 06

How it works

An AI app acts as the client.

Fig 02One plug, many apps. A server exposes tools, resources and prompts; any MCP client can use it.

Local serversrun on your computer and talk to the app directly. Good for files, local apps, and anything private.

Remote serversrun online and connect over HTTP, usually with a sign-in. This is how most company connectors work.

Notes

A small program called an MCP server exposes capabilities to it: tools the model can call, resources it can read, and prompt templates. The app discovers what a server offers, and the model decides when to use it.

02 / 06

Who runs it

Anthropic introduced MCP in November 2024.

Notes

On December 9, 2025 it donated the protocol to the Agentic AI Foundation, a fund under the Linux Foundation co-founded with Block and OpenAI. No single company controls the standard, which is a big reason competitors adopted it.

03 / 06

What changed in 2026

Stateless servers are easier to host, scale, and cache.

Fig 03The 2026-07-28 revision: no handshake, no session. Each request carries its own version and capabilities.

MCP Apps, January 26The first official extension. A tool can return an interactive interface that renders inside the conversation, not only text.

The 2026-07-28 specificationThe largest revision since launch. MCP became stateless: the opening handshake and protocol sessions were removed, every request carries its own version and capabilities, servers describe themselves through a new server/discover call, long-running tasks moved into an official extension, and a formal policy guarantees at least twelve months of deprecation before a feature is removed.

Notes

In practice you will notice faster, more dependable connectors.

04 / 06

A starter set

Table9 rows

Server	Maintainer	What it gives your assistant
Filesystem	MCP project	Read, write, and search folders you allow
Fetch	MCP project	Pull web pages in as clean text
Git	MCP project	History, diffs, and branches of a local repo
Memory	MCP project	A local knowledge graph that persists across sessions
GitHub	GitHub	Repos, issues, pull requests, code search
Playwright	Microsoft	A real browser for testing and research
Context7	Upstash	Current, version-specific library docs for coding
Notion	Notion	Search and update pages and databases
Firecrawl	Firecrawl	Crawl sites and extract structured data

05 / 06

Adding one

Many apps now offer a connector directory with one-click installs.

For a local server, desktop apps such as Claude Desktop and Cursor read a JSON config like this one, which gives the assistant access to a single folder:

JSON

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/you/Projects/my-show"
      ]
    }
  }
}

06 / 06

Stay safe

Every server you add is code with access to something you care about.

Fig 04Staying safe: every server is code running with your permissions. Scope it, start read-only, review before you widen.

Prefer official servers from the company that owns the product.

Scope access tightly: one folder, one repo, read-only where possible.

Be careful with "always allow." Approve anything that writes, sends, or deletes.

Remove servers you are not using.

Do this today

Add the Filesystem server scoped to one messy project folder. Ask your assistant to propose a folder structure and rename files to match, and approve each change.

Notes

Security became a mainstream MCP topic in 2026. One industry tally counted more than 30 MCP-related vulnerabilities filed in January and February alone, and a class of attack called tool poisoning, where hidden instructions inside a tool's description steer the model, got wide attention.

05 links

Resources

Every link this breakdown leans on, in one place.