Tool Use and the Model Context Protocol
Tool Use and the Model Context Protocol
Fact-check status
Key jargon
| Term | Plain-language meaning |
|---|---|
| Model Context Protocol (MCP) | A protocol for connecting AI hosts and clients to servers exposing tools, resources, and prompts. S1 |
| Host | The application coordinating model interaction and MCP clients. S1 |
| MCP server | A process that advertises capabilities and responds to protocol requests. S1 |
| Capability negotiation | The client and server declaration of features they support. S1 |
Key concepts
- MCP standardizes discovery and message exchange; it does not decide whether a requested action is safe. S1
- The host remains responsible for trust, authentication, authorization, consent, and result handling. S1
Concept map
flowchart LR
A["Host discovers server capabilities"] --> B["Model proposes tool use"]
B --> C["Host authorizes protocol call"]
C --> D["Server returns observed result"]Diagram semantics verified against S1 and S2 on 2026-09-02.
Models can emit structured requests that a host interprets as tool calls. MCP standardizes interactions among hosts, clients, and servers for capabilities such as tools, resources, and prompts. The protocol improves interoperability; the host still owns identity, authorization, consent, isolation, and audit. S1
Trust boundaries
flowchart LR
U[User] --> H[Host application]
H --> C[MCP client]
C --> S[MCP server]
S --> X[Local or external system]Diagram semantics verified against S1 and S2 on 2026-09-02.
Ask at every boundary: who authenticated, what authority was delegated, which arguments are allowed, what data returns, and what effect can occur? S1
Security rules
- Treat tool descriptions and returned content as untrusted input. S1
- Authorize each action against current user/resource state. S1
- Do not pass ambient host credentials to arbitrary servers. S1
- Make external effects visible and auditable. S1
- Pin and review server packages/configuration. S1
Exercise
Design an MCP server exposing one read-only resource and one reversible tool. Write the host-side authorization and approval rules separately from the protocol schema.