Start here: how MCP connects an AI app to a tool

By mcp-guide · 0 stars

As of September 2026. Menus and endpoints in the other notes follow this date.

- MCP (Model Context Protocol) is an open standard. One MCP server per service works in any MCP host: Claude, ChatGPT, Cursor, VS Code and many others.
- Messages are JSON-RPC 2.0. The client sends `tools/list` or `tools/call`; the server replies.
- Tool descriptions and results go straight into the model's context. That is also the prompt-injection risk (see the security checklist).

| Term | Meaning |
|---|---|
| Host | Your AI app (Claude Desktop, ChatGPT, Cursor, VS Code) |
| Client | Connection inside the host to exactly one server |
| Server | Program exposing tools, resources and prompts |
| Tool | Function the model decides to call, e.g. `create_issue` |
| Resource | Data by URI that the app or user attaches |
| Prompt | Template the user picks, often shown as a slash command |

### Remote or local

| | Local (stdio) | Remote (Streamable HTTP) |
|---|---|---|
| Runs | Subprocess the host launches | HTTPS URL |
| Setup | Command + args; needs Node, Python/uv or Docker | Paste URL, sign in |
| Auth | Env-var credentials | OAuth 2.1 or bearer token header |
| Hosts | Desktop only (Claude Desktop, Claude Code, Cursor, VS Code) | Desktop, web and mobile, incl. claude.ai and ChatGPT |
| Local files | Yes, with your user's permissions | Only what the service reaches |

- Pick remote when the vendor hosts an endpoint or you need claude.ai or ChatGPT.
- Pick local when the server needs your filesystem, a local database or browser, or data must stay on your machine.
- claude.ai and ChatGPT call servers from their cloud, so `localhost` and private-network servers are unreachable. Deploy publicly or use a tunnel.
- The old HTTP+SSE transport (separate `/sse` endpoint) is deprecated. If an `/sse` URL breaks, try the vendor's `/mcp` URL.

### Spec version

- Latest: 2026-07-28. Stateless (no `initialize` handshake), adds Multi Round-Trip Requests for mid-call user input, and formalizes extensions such as MCP Apps and Tasks.
- Deprecated in 2026-07-28: Roots, Sampling, Logging, HTTP+SSE.
- Versions are negotiated; 2025-06-18 and 2025-11-25 servers mostly still work.
- Official catalog: registry.modelcontextprotocol.io.

### Next

1. Your host's setup note (Claude apps, Claude Code, ChatGPT, or Cursor and VS Code).
2. Endpoints for common servers.
3. The security checklist before you connect anything that can write.

### Sources

- https://modelcontextprotocol.io/specification/latest
- https://blog.modelcontextprotocol.io/posts/2026-07-28/
- https://modelcontextprotocol.io/specification/2026-07-28/basic/transports