What is MCP, and what is an MCP server?

What an MCP server offers#

The specification gives servers three kinds of thing to offer. The difference that matters is who decides when each one is used.

Tools are the part most people meet. The app shows the model each tool’s name and description, and the model chooses whether to call one. The examples and the “who decides” column come from the protocol’s guide to servers.

A real exchange with a server#

Under the hood, the app and the server trade small JSON messages (JSON-RPC). To show what that looks like, an AI started the protocol’s “everything” reference server on a Mac (npx -y @modelcontextprotocol/server-everything) and talked to it over its standard input and output, the way Claude Desktop talks to a local server. These are the messages it captured on November 9, trimmed where marked with “…”.

The app says hello and names the protocol version it speaks:

{"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {"protocolVersion": "2025-06-18", "capabilities": {}, "clientInfo": {"name": "probe", "version": "0"}}}

The server answers with what it offers:

{"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{"listChanged":true},"prompts":{"listChanged":true},"resources":{"subscribe":true,"listChanged":true}, …},"serverInfo":{"name":"mcp-servers/everything","title":"Everything Reference Server","version":"1.0.0"},"instructions":"# Everything Server – Server Instructions …"},"jsonrpc":"2.0","id":1}

Asked for its lists, it returned 13 tools, 4 prompts and 7 resources. One tool is echo, described as “Echoes back the input string”. Calling it:

{"jsonrpc": "2.0", "id": 4, "method": "tools/call", "params": {"name": "echo", "arguments": {"message": "hello from the what-is-mcp page"}}}

{"result":{"content":[{"type":"text","text":"Echo: hello from the what-is-mcp page"}]},"jsonrpc":"2.0","id":4}

In a real chat the model writes the tools/call (Claude or ChatGPT picks the tool and its arguments), the app sends it, and the text that comes back goes into the conversation for the model to read.

Two caveats on versions. This machine runs Node 20, and npm quietly installed an older release of the server; the newest releases need Node 24. And the newest revision of the protocol, dated 2026-07-28, drops the initialize hello: each request carries its own version, and servers must answer a new server/discover request, which an app can send first to learn which versions a server speaks. Sent to this older server, it came back “Method not found”, which is how an app tells it needs the older handshake. Both kinds are in use. Claude Code’s docs say its newer client asks HTTP, stdio and claude.ai connector servers whether they support the newer revision, and uses it with those that do.

Local and remote servers#

One detail matters for claude.ai: Anthropic connects to a remote server “from Anthropic’s cloud infrastructure, rather than from your local device”, on every Claude client, the desktop and mobile apps included. A server on your home network or behind a company VPN won’t connect unless it’s reachable from the public internet. Local servers in Claude Desktop’s config file are a separate mechanism, and Anthropic says they “aren’t available in Cowork or claude.ai”.

How to add one, app by app#

These steps come from each company’s own docs, read on November 9, 2026. No person has run them for this page.

claude.ai and the Claude apps (remote servers). Go to Customize › Connectors, click “+ Add”, then “Add custom connector”. Enter a name and the server’s URL, click Continue, check the sign-in settings Claude detected and click Continue, leave the remaining settings unless your server needs something different, then click Add. Turn it on for a chat with the “+” button at the lower left of the chat box, then Connectors. Custom connectors work on every plan, but “Free users are limited to one custom connector”. On Team and Enterprise plans an owner adds the connector for the organization first, and each member then connects it under Customize › Connectors.

Claude Desktop (local servers). A remote connector added in claude.ai appears in Desktop too. For a server that runs on your computer, either:

1. Install a desktop extension: Settings › Desktop app, select Manage next to Extensions, then Browse extensions and click Install. Claude Desktop includes its own Node.js, so you don’t need to install it for an extension.
2. Or add the server to the config file. On a Mac it’s ~/Library/Application Support/Claude/claude_desktop_config.json; on Windows, %APPDATA%\Claude\claude_desktop_config.json. The protocol’s own tutorial uses the filesystem server, with the folders it may read and change at the end (the tutorial’s advice: only list folders you’re comfortable with Claude reading and modifying; the server runs with your account’s permissions):

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/username/Desktop",
        "/Users/username/Downloads"
      ]
    }
  }
}

This route runs the server with npx, so it needs Node.js on your computer: check with node --version in a terminal, or get the LTS version from nodejs.org. Replace username with yours, quit Claude Desktop completely and reopen it. The server shows under the “+” button in the chat box, then Connectors. The protocol’s tutorial opens this file from Settings › Developer › Edit Config; Anthropic now lists local servers on the Extensions page (Settings › Desktop app, Manage next to Extensions), with Settings › Developer in the older layout.

Claude Code. One command each, then /mcp inside Claude Code to check it connected:

claude mcp add --transport http <name> <url>
claude mcp add <name> -- <command> [args...]

The first is for a remote server, the second for a local one (for example claude mcp add example -- npx -y @example/mcp-server). If you sign in to Claude Code with a claude.ai account, connectors you added in claude.ai come along too.

ChatGPT (remote servers). OpenAI’s developer docs give these steps: go to chatgpt.com/plugins, select the plus button, then “Add custom MCP server”. Enter a name and description, the server’s URL “including the /mcp path”, and how it signs in. Review the risk warning, select “I understand and want to continue”, then “Create as a plugin”. Install it, start a new chat, type @ and pick it. OpenAI says “Account and workspace policies apply”; its help article on developer mode and full MCP connectors refused our download, so which plans allow it isn’t confirmed here. The ChatGPT desktop app has its own list for its Codex host, shared with the Codex CLI and IDE extension: Settings › MCP servers › Add server, which also takes local (STDIO) servers; save, then Restart.

Try one: the AI Phone#

One way to watch MCP do something real, end to end, is to connect a remote server you can sign up for. The AI Phone, which we make, is one: it gives your AI an address like counterparts.ai/u/yourname/ where people, and their AIs, can leave it messages. It’s a remote MCP server at https://counterparts.ai/phone/mcp/, open to sign up, and free for now.

From the live setup guide:

1. Go to counterparts.ai/phone/login, enter your email, open the link we send, and pick a name: 6 to 30 characters, lowercase letters, digits and underscores. It’s for people 18 and over.
2. On your number’s page, under Set up your AI, pick the AI you use.
3. Connect it. In claude.ai, add https://counterparts.ai/phone/mcp/ as a custom connector as above, leave the other settings as they are, press Add, log in with your email and press Allow. In ChatGPT, add it at chatgpt.com/plugins as a custom MCP server, choose OAuth, log in and press Allow. In Claude Code, press Make setup text and paste it into Claude Code.
4. Ask “Check my messages.” or “Send Sam a message saying I’ll be ten minutes late.”

Your AI gets these tools: check_messages, read_inbox, read_thread, read_message, list_contacts and send_message, plus open_message, ignore_message, delete_message, block_number and save_contact, which it’s told to use only on your word. Every letter reaches the model labelled as an untrusted letter from someone else, and by default a stranger’s letter stays sealed until you say to open it.

What an app sees before you sign in. An AI sent the Phone’s server the same initialize hello as above, with no sign-in, on November 9. The server refused and pointed to where sign-in starts:

HTTP/2 401
www-authenticate: Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://counterparts.ai/phone/.well-known/oauth-protected-resource/"
…

That address returned {"resource":"https://counterparts.ai/phone/mcp/","authorization_servers":["https://counterparts.ai/phone"],"scopes_supported":["phone"], …}, and the sign-in server’s own metadata listed its authorize, token and register addresses. This is the discovery the MCP specification lays out for remote servers: the app reads these, sends you to the login page, and after you press Allow it holds a token for every later request. claude.ai and ChatGPT do all of it when you add the connector.

What MCP doesn’t do#

It doesn’t give the AI memory by itself. The protocol moves context between an app and a server, and its docs say it “does not dictate how AI applications use LLMs or manage the provided context”. The protocol itself doesn’t store anything for later; whatever a server remembers lives in its own storage. A memory server can keep notes, but the model has to call a tool to save or look anything up, and nothing comes into a new chat until it does. Our guide to memory MCP servers compares them by what brings memory in without a tool call.

Counterparts, the memory we make for Claude, is an MCP server plus hooks. In Claude Code, hooks load a briefing at the start of each session and bring up related memories as you talk, and a small MCP server gives Claude tools to save what it learned and look things up. It runs on a Mac or Linux, and on Windows, new, through npm (the Quickstart's On Windows section; tell us how it goes); free and open source, with no account or API key. On a Mac or Linux, in Claude Code:

/plugin marketplace add mlapeter/counterparts
/plugin install counterparts@counterparts

Then restart Claude Code. For Claude Desktop on a Mac, see the quickstart, and more is on Counterparts for Claude Code. For claude.ai, a hosted version is coming soon, in beta; sign up on the home page to hear when it opens, or read how it will work. If Claude forgetting you between chats is the real problem, why Claude forgets between chats covers what Claude keeps on its own.

In claude.ai and ChatGPT, by the docs we read, a server can’t start a chat or wake the model. Anthropic describes remote servers as giving Claude “tools it can invoke during your conversation”, and a connector’s tools run when the model calls them: when you ask, or when a scheduled task you set up runs. Our Phone’s guide says it plainly: “Nothing pushes a message into an open chat in claude.ai or ChatGPT: the AI finds it when it looks.” The protocol does let a server notify the app when its list of tools changes, and the app refreshes the list.

Claude Code is the exception. Anthropic’s docs describe channels, in research preview: “A channel is an MCP server that pushes events into your running Claude Code session”. You install a channel as a plugin and opt in with the --channels flag at startup; it needs a claude.ai sign-in or a Console API key, Team and Enterprise admins must turn it on, and events only arrive while that session is open. Channels run on the earlier handshake: the 2026-07-28 revision can’t carry them. How your AI hears about messages covers how the Phone handles this in each app.

Is it safe?#

An MCP server can act for you, so the risk sits with the servers you connect and the content they can reach. The specification says tools “represent arbitrary code execution and must be treated with appropriate caution”, and that hosts “must obtain explicit user consent before invoking any tool”.

• A local server runs as you. The protocol’s security guide says “The stdio transport is not a sandbox”: a server you install can do anything your account can.
• Tool descriptions are instructions the model reads. The same guide warns that a server “can hide directives in them that steer the agent”, including how it uses other servers’ tools, and can “quietly change them after you approved it”.
• Content the server returns can carry instructions too. Anthropic: “Malicious MCP servers may include hidden instructions that try to make Claude perform unintended actions.” OpenAI goes further: when a server can reach content an attacker wrote, such as a support ticket, “Trusting a MCP’s developer does not make this safe.”

What the vendors advise: connect only servers from people you trust, keep the list short (every server shares the model’s context), review what each tool call will do before you allow it, and click “Allow always” only for a server and tool you’d trust to run unsupervised. For local servers, give each one only the folders and keys it needs, run third-party ones in a container or VM, and use a remote server instead when it needs nothing from your machine.

Questions people ask#

Questions? Ask in r/AIMemorySystems.