‹ learn
MCP concepts

MCP server

An MCP server is a service that exposes capabilities — tools, resources and prompts — to an AI agent over the Model Context Protocol (MCP), an open JSON-RPC standard introduced by Anthropic. It lets a model call external functions, read data and reuse prompt templates through one uniform interface instead of a bespoke integration per app.

What the Model Context Protocol is

MCP is an open protocol that standardizes how an AI application (the client/host) talks to external capabilities (the server). Instead of every app inventing its own plugin format, a client speaks MCP and can connect to any compliant server — the USB-C of agent tooling. Messages are JSON-RPC 2.0.

The host (e.g. Claude Desktop, an IDE assistant, or your own agent) starts an MCP client per server, performs a capability handshake, then discovers and calls what the server offers.

What a server exposes

An MCP server can expose three primitives: tools (callable functions the model can invoke, each with a name, description and JSON-Schema for its inputs and outputs), resources (readable data the model can pull into context, addressed by URI), and prompts (reusable, parameterized prompt templates).

Tools are the most common and the highest-leverage — and the highest-risk — surface, because their descriptions and schemas are fed straight into the model's context and their outputs are read back as data.

How servers connect

MCP defines several transports: stdio (a local subprocess, common for desktop tools) and HTTP-based remote transports — modern Streamable HTTP and the legacy HTTP+SSE pairing. Remote servers may sit behind OAuth 2.1.

Because the same protocol covers local and remote servers, an agent can mix first-party and third-party MCP servers — which is exactly why auditing an unknown server before trusting it matters.

How CheckMCP handles it

CheckMCP audits any live MCP server — Streamable HTTP or legacy HTTP+SSE, with optional Bearer/OAuth — by probing its real endpoint, inspecting its tools, resources and prompts, and producing an explainable MCP Score /100 across seven pillars (security, tool design, schemas, reliability, context-cost, compliance and coverage). You paste a URL at checkmcp.dev or run the CLI; no registry or SDK is required.

MCP server — FAQ

What is the Model Context Protocol (MCP)?+
An open standard from Anthropic that lets AI applications connect to external tools, data and prompts over JSON-RPC. A client speaks MCP once and can talk to any compliant server, replacing per-app custom integrations.
What does an MCP server expose?+
Up to three primitives: tools (callable functions with input/output schemas), resources (readable data addressed by URI), and prompts (reusable templates). Most servers are tool-centric.
How does an agent connect to an MCP server?+
Through an MCP client that performs a capability handshake and then discovers and calls the server's primitives. Transports include local stdio and remote Streamable HTTP / legacy HTTP+SSE, optionally behind OAuth 2.1.
How do I know if an MCP server is safe and well-built?+
Audit it. CheckMCP probes a live MCP server and scores its security (OWASP MCP Top 10), tool design, schema quality, compliance, coverage and context-cost — an explainable /100 with the reason for every deduction.

Related