Model Context Protocol (MCP) The common plug that lets AI apps reach tools and data.
Short answer. The Model Context Protocol (MCP) is an open standard for connecting AI applications to external systems. The AI application, called the host, opens one client connection for each MCP server, and each server offers tools (actions the model can request), resources (data) and prompts (reusable templates) as JSON-RPC 2.0 messages. The MCP site compares it to a USB-C port for AI. In an office, one MCP server might expose “find invoice” and “create task” from an accounting tool, so any MCP-aware assistant can use them. The specification says hosts must get explicit user consent before invoking any tool, and that tool descriptions are untrusted unless the server is.
01
How MCP works
MCP has a client-server design. The host is the AI application, such as an assistant or an editor. For each server it connects to, the host creates one client that keeps a dedicated connection. A server is a program that provides context, and it can run on the same machine or elsewhere.
There are two layers. The data layer uses JSON-RPC 2.0 messages and defines the primitives below. The transport layer carries them: stdio for a local process on the same machine, and Streamable HTTP for remote servers, which supports bearer tokens, API keys and custom headers, with OAuth recommended. The 28 July 2026 version of the specification, current in October 2026, describes a stateless protocol in which every request carries the protocol version and the capabilities it needs.
Primitive
What it is
Office example
Tools
Executable functions the model can request
Create a task, or find invoice 4471
Resources
Data that gives the model context
This year’s fee schedule, a client record
Prompts
Reusable templates that structure an interaction
A standard layout for board minutes
02
Local or remote server
The word server only means the program that serves context. Where it runs decides where your data goes and what can go wrong.
Kind
How it connects
Where your data goes
Main risk
Local server
stdio: a program started on the same machine as the host
Stays on that machine unless the program sends it elsewhere
You run downloaded code. The security guide warns of malicious startup commands, and says a client that offers one-click setup must show the exact command and get explicit approval first
Remote server
Streamable HTTP: run by a provider and shared by many clients
To the provider that runs the server
Tokens and scopes: broad scopes raise the damage if a token leaks
03
What the specification says about security
Hosts must obtain explicit user consent before invoking any tool, and users should understand what a tool does before authorising it.
Tools represent arbitrary code execution. Descriptions of tool behaviour, such as annotations, are untrusted unless they come from a trusted server.
For trust and safety there should always be a human in the loop with the ability to deny tool invocations.
Token passthrough, where a server accepts a token that was not issued to it and forwards it to another service, is forbidden by the authorisation specification.
Scopes should be minimal. The security guide describes a progressive, least-privilege scope model and logging of scope elevation events.
04
Before an administrator approves a connector
Who runs the server: your office, the tool vendor or a third party? A remote server receives whatever the model sends it.
Which tools does it expose, and which of them can change or delete data?
What scopes does it ask for? Prefer read-only.
Does it log each call, and can you see that log?
What happens when its tool list changes? The specification lets servers announce changes, so re-check a connector after an update.
Can you switch it off for one team without affecting the others?
05
Where ANVE stands
On ANVE, Zoho and other tools can connect through MCP connectors that an administrator approves. ANVE’s security page (/security) says a connector sends that service only what it is asked to fetch or send, every call is logged on the box, and ready-made Google Workspace and Zoho connectors are not on ANVE yet. The tools an agent can use must also be approved by an administrator, and a tool that changes is switched off.
06
Questions people ask
Who created MCP?
Anthropic introduced it, and its December 2024 engineering article calls MCP a recently released protocol. The project now describes itself as an open-source standard supported by many assistants and development tools.
Is MCP the same as an API?
No. An API is one system’s own interface. An MCP server describes tools, which can include API calls, in a standard format so that any MCP-aware application can find and use them.
Does MCP send my data to the cloud?
Only if the server or the model is in the cloud. A local server keeps its data on its machine, and a remote server receives what is sent to it. Check where both the server and the model run.
Does MCP need a particular AI model?
No. MCP covers the exchange of context between applications and servers. The architecture guide says it does not dictate how an AI application uses language models.
Who approves a connector on ANVE?
An administrator. ANVE’s published security page says connectors exist only if an administrator approves one, that a connector sends the service only what it is asked to fetch or send, and that every call is logged on the box.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
