What is MCP (Model Context Protocol)? How AI agents use MCP servers

An MCP client and an MCP server exchange JSON-RPC 2.0 messages. A session starts with initialize, where the two agree on a protocol revision and say what they support. The client then asks for tools/list and calls a tool with tools/call, passing arguments that match the tool’s input schema.

• Tools are actions the server offers, each with a name, a description for the model, and a JSON Schema for its input.
• Resources are data the server lets a client read, such as files or records.
• Prompts are reusable message templates.
• Transports: stdio for a server running on the same computer as the client, and Streamable HTTP for a server on the network. Streamable HTTP replaced the older HTTP with server-sent events in the 2025-03-26 revision.
• Sign-in: remote servers usually use OAuth 2.1, or a token in a header.

The specification is published in dated revisions, such as 2024-11-05, 2025-03-26, 2025-06-18 and 2025-11-25.

An MCP server often sits in front of an ordinary API. The difference is who it is made for.

• Made for

  API

  Programs written for that one API

  MCP server

  Any MCP client, including AI agents

• How it describes itself

  API

  Documentation for people

  MCP server

  tools/list: names, descriptions and input schemas a model can read

• How you call it

  API

  Its own addresses, formats and sign-in

  MCP server

  One protocol for every server: tools/call

• Typical shape

  API

  Many fine-grained endpoints

  MCP server

  A smaller set of tasks shaped for a model

The agent’s platform connects to the server, lists its tools, and offers the chosen ones to the model as tool definitions. When the model asks for one, the platform sends tools/call to the server and gives the result back to the model, the same loop as any other tool.

Two risks come with it. A tool’s description is text the model reads and trusts, so a server that changes a description can change how the agent behaves. And a tool’s result can carry instructions written by someone else. The defences sit outside the model: review tools before an agent may use them, notice when a tool changes, give each agent only the tools it needs, and ask a person before any tool that writes.

You add any remote MCP server by its HTTPS address, or pick one from a directory of 650+ known servers. Agents and workflows can then use its tools.

• Transports: Streamable HTTP, falling back to the older HTTP with server-sent events when a server only speaks that. Local stdio servers are not supported, because agents run in the cloud, not on your computer.
• Revisions: 2024-11-05, 2025-03-26, 2025-06-18 and 2025-11-25.
• Sign-in: none, a bearer token, custom headers, or OAuth with discovery, dynamic client registration and PKCE. Secrets are encrypted and opened only by the worker that makes the call.
• Review: when you add a server you choose which tools to approve: none, only the read-only ones, or all of them. Only approved tools reach an agent.
• Pinning: each approved tool’s definition is pinned by a SHA-256 hash. If the server changes a tool, calls to that tool stop until a person reviews the change, while the server’s other tools keep working.
• Approvals: tools that write follow the agent’s approval settings, like any other tool. See human-in-the-loop approvals.
• Outbound checks: calls go out over HTTPS only and never to private addresses.
• Call log: one row per call with the tool, the outcome and how long it took, kept for 30 days. Arguments and results are not stored in it.

MCP works in both directions. Besides using other servers, you can be a server, so that AI apps and coding assistants that speak MCP can call your tools.

Every MyDeepAgents organization can serve tools at https://api.mydeepagents.com/v1/mcp. The API key a client signs in with decides whose tools it sees, and you choose what is offered, one item at a time:

• A published agent, as a tool that takes a message and returns the agent’s answer.
• A published workflow, as a tool that takes the workflow’s own inputs.
• One action of a connection, read-only unless you allow it to write.

MCP clients sign in with an API key in the Authorization header, and requests from a web browser are refused. A call to an agent or a workflow waits up to 60 seconds. If the run is still going, for example because it is waiting for an approval, the answer gives the run’s ID and a link to check its status. Each key may make 60 calls a minute, and every call is written to the audit log. The MCP guide has the details.