What Are MCP Servers and How Do They Work?

Short answer: An MCP server is software that exposes tools, data, or reusable prompts to an AI application through the Model Context Protocol (MCP). MCP standardizes how the application discovers capabilities and exchanges JSON-RPC 2.0 messages; it does not provide an AI model or decide how the model uses the result.

The AI application is the host. A host creates one client connection for each MCP server. The server provides capabilities such as an API action, a database query, or file content. The host decides when to call a capability and how to show the result to the model or user.

What MCP stands for

MCP means Model Context Protocol. It is a protocol for connecting AI applications to external context and capabilities. The official architecture documentation describes MCP as a way to exchange context between a host and servers rather than a model or agent framework.

That distinction matters: an MCP server can call an API, read an approved file, or return database records, but MCP itself does not generate the final answer. The host and its model determine how the returned data is interpreted.

Host, client, and server: the three roles

Role	What it does	Typical example
Host	AI application that coordinates conversations, models, permissions, and server connections	Claude Desktop, Cursor, or another MCP-enabled application
Client	Connection component inside the host; maintains one protocol session with one server	A client object created by the host for a configured server
Server	Program that exposes tools, resources, and prompts	A service that queries a database or captures a web page

A host can connect to many servers, but each server gets its own client connection. Do not confuse an MCP server with the AI model: the model runs in the host, while the server supplies capabilities or context.

What an MCP server can expose

Tools

Tools are executable functions. A server might expose query_database, create_ticket, or take_screenshot. A tool has a name, description, input schema, and result. The host can list tools, then send a tool call with structured arguments.

Resources

Resources are context data. Examples include a file, database schema, API response, or generated report. Resources let a host retrieve information without treating every read as an action.

Prompts

Prompts are reusable interaction templates. A server might provide a template that asks the model to review a schema or summarize a repository. Prompts structure an interaction; they are separate from executable tools and data resources.

A server may provide one, two, or all three primitives. The protocol does not require every server to implement every primitive.

How an MCP request works

1. Configuration: The host loads a server definition, including its command or remote URL and any credentials.
2. Connection: The host creates a client for that server using STDIO or Streamable HTTP.
3. Initialization: Client and server exchange JSON-RPC messages, including supported protocol versions and capabilities.
4. Discovery: The client lists available tools, resources, and prompts.
5. Selection: The host or model chooses a relevant capability based on its name, description, and schema.
6. Invocation: The client sends a JSON-RPC request such as tools/call with arguments.
7. Result handling: The server returns structured content or an error. The host decides how to present or use it.

The protocol data layer uses JSON-RPC 2.0. A simplified tool call looks like this:

{
  "jsonrpc": "2.0",
  "id": 7,
  "method": "tools/call",
  "params": {
    "name": "lookup_customer",
    "arguments": {"customer_id": "cus_123"}
  }
}

The exact tool names and argument schemas come from the server’s discovery response; never assume that two servers implement the same names.

STDIO versus Streamable HTTP

Transport	Where it runs	Connection shape	Operational considerations
STDIO	Usually a local subprocess started by the host	Messages flow over the process’s standard input and output	Simple local boundary; the process has the privileges and filesystem/network access of its environment
Streamable HTTP	Remote or separately deployed service	HTTP POST carries protocol messages; Server-Sent Events can support streaming	Needs deployment, authentication, network controls, and monitoring; can serve multiple clients

The architecture guide documents both transports. The specification’s HTTP guidance says HTTP implementations should use MCP’s authorization framework. Transport choice is an operational decision, not a universal security ranking.

A minimal remote MCP call

The following examples show the JSON-RPC shape. Replace https://example.com/mcp with a real server endpoint and supply the authentication method required by that server.

cURL

curl -X POST "https://example.com/mcp" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MCP_TOKEN" \
  --data '{
    "jsonrpc":"2.0",
    "id":1,
    "method":"tools/list",
    "params":{}
  }'

Python

import os
import requests

endpoint = "https://example.com/mcp"
headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {os.environ['MCP_TOKEN']}",
}
payload = {
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list",
    "params": {},
}
response = requests.post(endpoint, headers=headers, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Node.js

const endpoint = 'https://example.com/mcp';
const response = await fetch(endpoint, {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    'authorization': `Bearer ${process.env.MCP_TOKEN}`
  },
  body: JSON.stringify({
    jsonrpc: '2.0',
    id: 1,
    method: 'tools/list',
    params: {}
  })
});
if (!response.ok) throw new Error(`${response.status} ${await response.text()}`);
console.log(await response.json());

Production clients should implement the server’s initialization sequence, negotiated protocol version, session headers, streaming behavior, pagination, and error handling. A raw HTTP request is useful for inspecting the wire format, but an official SDK usually handles those details.

Are MCP servers safe?

MCP standardizes communication; it does not certify that a server is trustworthy. The project’s security guidance says clients trust the servers they configure, and servers can access resources available in their execution environment.

• Review the server source, package provenance, configuration, and requested capabilities.
• Run local STDIO servers with a dedicated user, restricted working directory, and least-privilege credentials.
• Allow only the files, databases, network destinations, and system commands the use case requires.
• For HTTP servers, require authenticated connections, validate certificates, rotate tokens, and apply network and rate limits.
• Treat tool descriptions as untrusted input. Confirm destructive actions and validate arguments on the server.
• Log calls and results without recording secrets or sensitive payloads.

An MCP SDK transport is not a sandbox. Isolation requires operating-system, container, network, or hosting controls outside the protocol.

Version and compatibility considerations

The MCP project announced specification revision 2026-07-28 on July 28, 2026. Its release announcement describes a stateless protocol core, request metadata, optional discovery, authorization changes, caching, routing, extensions, and deprecations. Roots, Sampling, and Logging remain supported for at least twelve months but new implementations should not adopt them.

Clients and servers may support different revisions. Record the negotiated version, test the exact client/server pair, and read the implementation’s compatibility notes before enabling newer features.

Building and operating an MCP server

1. Define a narrow capability boundary. Write down which data and actions the server must access.
2. Choose STDIO for a local integration or Streamable HTTP for an independently deployed service.
3. Give every tool a precise description and strict input schema. Reject unknown fields and invalid values.
4. Return structured, bounded results. Paginate large resources and avoid placing secrets in tool output.
5. Implement initialization, capability discovery, cancellation, timeouts, and protocol errors.
6. Add authorization and audit logging before exposing an HTTP endpoint.
7. Exercise failures: unavailable dependencies, malformed arguments, expired credentials, partial results, and client disconnects.

Performance, reliability, and cost

• Latency: Total time includes model reasoning, connection setup, authorization, the tool’s dependency calls, and result parsing. Reuse connections where the client supports it.
• Payload size: Return only the fields needed for the task. Large resources increase transfer time and model context usage.
• Timeouts: Set separate connection, tool, and overall request deadlines. Make long operations cancellable or asynchronous.
• Retries: Retry only transient failures and use exponential backoff with jitter. Do not blindly retry non-idempotent actions.
• Availability: Health-check remote dependencies, preserve request IDs in logs, and return actionable error codes.
• Cost: MCP has no single usage price. Your costs come from model tokens, server compute, hosted dependencies, network transfer, and any API called by a tool.

Common errors and fixes

Symptom	Likely cause	Fix
Connection closes immediately	Wrong command, path, permissions, or STDIO output contaminated by logs	Run the command directly, send logs to stderr, and verify executable permissions.
HTTP 401 or 403	Missing, expired, or insufficient authorization	Check the server’s auth scheme, token scope, clock, and required headers.
Protocol version mismatch	Client and server support incompatible revisions	Upgrade one side or configure a mutually supported version; inspect initialization responses.
Tool not found	Discovery was skipped, pagination was ignored, or the name is wrong	Call tools/list, follow pagination, and use the returned exact name.
Invalid arguments	Arguments do not match the server’s JSON schema	Read the discovered schema and validate before calling.
Request hangs	Blocked dependency, missing stream handling, or no timeout	Set deadlines, inspect server logs, and implement Streamable HTTP/SSE handling as documented.
Unexpected data exposure	Server has broader filesystem, database, or network privileges than intended	Reduce credentials and execution permissions; isolate the process and review configuration.

ScreenshotNeo: an MCP server for web screenshots

ScreenshotNeo provides an MCP server for AI agents. Its tools include take_screenshot, get_page_info, and capture_pdf, so an MCP-enabled client can request a page image or PDF without building browser automation into the host.

ScreenshotNeo also exposes a direct API. See the ScreenshotNeo documentation for request options.

Or skip the browser setup

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp

import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);

Cookie and consent banners, newsletter popups, and chat widgets are removed before the shot. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers identify the page verdict and billing result. An MCP server lets AI agents take screenshots. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.

FAQ

Is MCP an API?

It is a protocol specification for exchanging context and capabilities. An individual MCP server may wrap an API, database, filesystem, or custom service.

Can one host use multiple MCP servers?

Yes. The host maintains a separate client connection for each configured server and can combine their discovered capabilities.

Do all MCP servers run locally?

No. STDIO is commonly local, while Streamable HTTP supports remote servers.

Does MCP automatically make tool calls safe?

No. Safety depends on server code, credentials, execution boundaries, authentication, validation, and the host’s approval policy.

Do tools, resources, and prompts mean the same thing?

No. Tools execute actions, resources provide data, and prompts provide reusable interaction templates.