Dev Chroniclesby Thinnd
Engineering

What Is MCP? Explained with a Power Socket

MCP is a shared standard for AI apps to plug into tools and data, like one power socket for many appliances. This article explains it with the socket picture: the problem before MCP, the three things an MCP server offers, how it runs, the security risks and a checklist before plugging in.

Nhu Duy Thin (Thinnd)8 min read
  • #MCP
  • #AI agent
  • #protocol
  • #tools
  • #security
  • #architecture

Slide deck

Click the slides, then use the arrow keys to move. Press L to change language and F for full screen.

Open full screen

For people who have just heard of MCP, including non-engineers. Every technical term gets a short explanation.

The description of the standard relies on the official documentation and public announcements listed at the end. The standard changes between versions, so check against the one you use. The "failed orders" example is rebuilt to be easy to picture. The power-socket picture is my own comparison, not an official name.

Quick summary#

  • MCP (Model Context Protocol) is an open standard that lets AI applications connect to outside tools and data in one common way.
  • Picture a shared power socket: an appliance only needs a plug of the right standard, and the house does not need custom wiring for each one.
  • An MCP server offers three things: tools (things it can do), resources (things to read), prompts (ready-made questions).
  • Plugging in more means giving the AI more power. You need a fuse: least privilege, approval for sensitive actions, no unknown servers.
  • You do not always need it: one fixed API call is still simpler to write directly.

Hard words, plain meaning#

Term Plain meaning
Protocol A set of rules so two sides understand each other, like the shape and voltage of a socket.
AI application (host) The app you use to chat with AI or let it work. The "appliance" that needs power.
Client The part inside the AI app that connects to one server. The "plug".
MCP server A program wrapping a tool or data source that speaks MCP. The "socket".
Tool A job the AI can ask the server to do, like looking up an order or creating a note.
Resource Data to read, like a file or a table.
API A doorway for one program to call another.

1. The problem before a shared socket#

Imagine every appliance in your home used its own kind of plug. Buy a new dryer and you call an electrician to wire a new outlet. AI apps were once in that position.

  • There are many AI apps (chat assistants, code editors, automation tools).
  • There are many tools and data sources (calendars, code repositories, databases, ticket systems).
  • Each pairing of app and tool needs its own connector.

With 5 apps and 8 tools you could need 5 × 8 = 40 connectors, each written and maintained by someone. With a shared standard each app learns MCP once (5 jobs) and each tool gets one MCP server (8 jobs), 13 in total. This is an illustrative calculation, and real effort varies by case.

According to Anthropic, MCP was introduced in late 2024 to solve exactly this. The official docs also use another familiar picture, a USB-C port for AI. I chose the power socket because it adds one more important idea: the fuse, covered in section 6.

2. Socket, plug and appliance#

In your home In the MCP world
Wall socket MCP server: one doorway to get service from a tool
The appliance's plug MCP client, inside the AI app
Appliance (fan, lamp) AI application (host), needs power to work
Standard shape and voltage The MCP protocol
Electricity Data and abilities from the tool
Switches and buttons Tools the AI can switch on
Electricity meter Resources, read-only
Preset buttons on a washer Prompts
Fuse, circuit breaker Permission limits, human approval
Cheap charger of unknown origin A stranger's server

One neat match: an appliance can plug into several sockets, and per the architecture docs, one AI app runs several clients, each connected to exactly one server.

3. An MCP server offers three things#

1. Tools: things it can do. Like switches. For example: "look up an order", "create a note", "send a message". The AI picks a tool and fills in parameters, and the server carries it out. This part has side effects, so it is the riskiest.

2. Resources: data to read. Like an electricity meter: look only, no switching. For example: the contents of a file, a row in a database.

3. Prompts: ready-made questions. Like preset buttons on a washer: a template with blanks for the user to pick quickly, such as "summarize today's failed orders".

This distinction helps you set trust: a read-only resource is safer than a tool that writes. Start with reading.

4. How one plug-in runs#

An illustrative example, rebuilt to be easy to picture.

Ms. Ha runs an online shop. She installs an MCP server wrapping her order system and asks her AI assistant: "Were there any failed payments yesterday?"

  1. The AI app asks the server: "What tools do you have?" The server answers: "lookup_order and list_failures."
  2. The AI reads the tool descriptions and picks list_failures with the parameter "yesterday".
  3. The client sends the request to the server. The server runs the query and returns the result.
  4. The AI reads the result and answers Ms. Ha in plain words.

According to the docs, the parties exchange messages in JSON-RPC form (a structured way to send requests and get results). A server can run right on your machine (talking through standard input and output, called stdio) or remotely over HTTP. Like a plug in your own room versus power brought in from far away.

5. Why it spread quickly#

  • Less repeated work. A tool builds one server and it works with many AI apps.
  • Switching apps does not mean rewiring. The socket stays when you change appliances.
  • Community. According to Anthropic, by December 2025 there were more than 10,000 active public MCP servers and many products supporting it. That figure is published by the developer itself, so read it with care.
  • Shared governance. In December 2025 Anthropic announced it was donating MCP to the Agentic AI Foundation, a fund under the Linux Foundation, and said the project's governance would not change.

6. The fuse: security risks#

A socket is handy, but a faulty socket or careless wiring starts fires. Security write-ups on MCP, mostly from vendors and third-party research groups and so to be read with care, usually name these risks.

Risk Socket picture Plain meaning
Tool description poisoning A cheap charger with hidden wiring Malicious instructions hidden in a description the AI reads, unseen by the user, steering the AI to do what it should not.
Injection through data Lightning on the line Data the AI reads (an email, a file) contains commands disguised as requests.
Over-broad permissions Industrial power for a fan A server holds a master key, so one bad instruction can do a lot.
A stranger's server A socket picked up from the street A third-party server is unverified code and may read or send data away.

The common thread: the AI cannot tell your command from a command sitting in data. The post Why you should not trust AI blindly explains why models are so easily led, and A handbook for AI reminds us that words in a text do not replace real permissions.

7. A checklist before plugging in a server#

  1. Who wrote it, can you see the code? An unknown server is unverified code. Prefer clear sources with active maintainers.
  2. What can it do? Read the tool list. Are there tools that write, delete or send?
  3. Start read-only. Give read access first, add write access when truly needed.
  4. Least privilege. A key or token that covers only the job, not an admin key.
  5. A person approves sensitive actions. Sending money, deleting data, sending mail: someone must click agree.
  6. A separate environment. Try it on test data, not customers' real data.
  7. Keep a log. Know which tool the AI called, when, with what parameters.
  8. Watch for changes. A tool description that changes silently is a sign to look again.

8. A balanced view#

  • You do not always need it. An app that calls one fixed API is usually simpler to write directly. MCP pays off when several AI apps share many tools.
  • The standard is still changing. Versions of the documentation describe some points differently (for example whether a session keeps state), so check the version you use.
  • The standard does not guarantee safety. It defines how to talk. Granting the right permissions is the deployer's job.
  • The socket picture has limits. A real socket supplies power passively, while an MCP server can do work for you, so the risks differ.

9. Conclusion#

MCP gives AI apps a shared socket to plug into tools and data, so each side builds one end instead of wiring every pair. But plugging in more gives the AI more power. Plug in with a fuse: start read-only, grant least privilege, let a person approve sensitive work, and never plug in a server of unknown origin.

Try it now: list three tools you want the AI to use, and mark which are read-only and which can write or delete.

References#

Frequently asked questions

What is MCP, simply?
An open standard, introduced by Anthropic in late 2024, for AI apps to talk to tools and data in one shared way. Picture a power socket: an appliance maker does not need to know how your house is wired, only to ship a plug of the right standard.
What problem does MCP solve?
Before it, each AI app had to write its own connection to each tool, so the number of connections grew as apps times tools. With a shared standard each side builds one end, so the work roughly adds up instead of multiplying.
Is MCP safe?
The standard defines how to talk, not safety by itself. Security write-ups name risks such as malicious instructions hidden in tool descriptions, overly broad permissions and unvetted third-party servers. You reduce them with least privilege, starting read-only, requiring a person to approve sensitive actions and using only trusted servers.
When do you not need MCP?
When one app only needs to call one fixed API, writing the call directly is usually simpler. MCP pays off when several AI apps share many tools, or when you want to switch apps without rewriting connections.