MCP (Model Context Protocol) is a protocol through which AI applications exchange context and use capabilities exposed by servers through client-server interactions.
The protocol describes how components communicate. It does not establish that a particular server is trusted, that every operation it offers is permitted, or that an invoked operation succeeded. This entry uses specification revision 2026-07-28; a deployment needs to be assessed against the revision its components implement.
The participants have different roles
In the cited architecture, the host coordinates clients, context, and consent. Each client communicates with one server. Servers expose capabilities such as resources, prompts, and tools, and can run as local processes or remote services. The host can manage multiple clients. MCP architecture.
This revision is stateless at the protocol level: requests carry version and capability information. That does not mean an application or tool has no business state. A workflow may retain task information or change records independently of the protocol exchange.
Locating an MCP server in an architecture therefore requires more than drawing a tool label. Identify the component receiving the request and the system where its operation can take effect. A local server and a remote service may have different owners, credentials, and execution environments.
Protocol access is not business authorization
MCP's authorization specification describes an optional framework for HTTP transports. HTTP implementations offering authorization should conform to it; STDIO implementations should instead obtain credentials from the environment without using that flow. Those recommendations do not make one authorization mechanism mandatory for every MCP interaction. MCP authorization, scope and requirements.
Permission to call a protected service still needs to be related to the resource and operation requested. Access to a tool interface does not, by itself, establish permission to use every record or function behind it. The server and destination controls need to enforce the scope applicable to that request.
How to use the term precisely
A tool call is a request through a tool interface; MCP is one protocol that can carry it. Neither the call nor the protocol defines the agent's full task or authority. AI agent governance addresses those broader permissions, decisions, controls, and evidence.
When describing an MCP integration, distinguish protocol support, configured server identity, permitted operations, and observed results. These are separate claims requiring evidence about the actual components.
The MCP security and governance guide examines server trust, tool discovery, credentials, data exposure, and downstream authorization in an enterprise workflow.