MCP Explained Simply: Connecting Your AI Assistant to GitHub, Databases and Tools

Your AI assistant is brilliant inside its own bubble and helpless outside it. It can reason about your GitHub repo, but it cannot open a pull request. It can write a SQL query, but it cannot run it against your database. It can draft a Slack message, but it cannot send it. The Model Context Protocol (MCP) is the standard that closes that gap — a single, open way to plug an AI application into the tools and data it needs.

The official documentation puts it as an analogy: "Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect electronic devices, MCP provides a standardized way to connect AI applications to external systems." This explainer unpacks what that means in practice, using the protocol's own specification rather than secondhand descriptions.

What MCP is, and where it came from

MCP is an open-source standard for connecting AI applications to external systems — data sources like local files and databases, tools like search and APIs, and reusable workflows. Anthropic introduced and open-sourced it on 25 November 2024; it was built by engineers David Soria Parra and Justin Spahr-Summers. Before MCP, every AI app needed a bespoke integration for every tool — an N×M problem. MCP turns it into N+M: build one server for a tool, and any MCP-capable client can use it.

The point of a standard is that nobody owns the sockets. Because MCP is open, a database server you write works in Claude, in VS Code, in Cursor, and in ChatGPT without modification — the same plug fits every port.

The architecture: host, client, server

MCP has three participants, and the naming trips people up, so it is worth being precise (the definitions below are from the official architecture documentation):

• MCP Host — the AI application itself, such as Claude Desktop, Claude Code or VS Code. The host coordinates everything.
• MCP Client — a connector that lives inside the host and maintains a dedicated one-to-one connection to a single server. One client per server.
• MCP Server — a separate program that wraps a capability: GitHub, a Postgres database, your filesystem, Slack.

So when your assistant connects to three tools, the host spins up three clients, each holding its own connection to one server. The model never talks to GitHub directly; it asks the host, the host routes through the right client to the right server, and the structured result comes back into the conversation.

How they talk: JSON-RPC, stdio and HTTP

Underneath, MCP is a stateful protocol built on JSON-RPC 2.0 — the same request/result/error/notification message format used widely in tooling. There are two layers: a data layer (the JSON-RPC messages, plus lifecycle and capability negotiation on connect) and a transport layer that moves those messages.

Two transports matter:

• stdio — standard input/output, used when the server runs locally on the same machine as the host. No network, no overhead, no ports.
• Streamable HTTP — for remote servers, using HTTP POST from client to server with optional Server-Sent Events (SSE) for streaming responses. It supports bearer tokens and API keys, with OAuth recommended for auth.

A note that catches people out: older articles list "HTTP/SSE" as a separate transport. In the current spec, SSE is a streaming sub-feature within Streamable HTTP, not a transport of its own.

What a server actually exposes

A server advertises capabilities, and on the server side there are three main primitives:

• Tools — executable functions the AI can invoke: call an API, run a database query, create a file. Discovered via tools/list, executed via tools/call.
• Resources — data sources that provide context: the contents of a file, rows from a database, a document. Read-only context the model can pull in.
• Prompts — reusable interaction templates: a system prompt, a few-shot example set, a canned workflow.

There are also client-side primitives the spec defines, which is where MCP gets genuinely powerful: sampling lets a server ask the host's LLM for a completion (sampling/createMessage), so the server stays model-agnostic; roots let the server learn which filesystem or URI boundaries it may operate in; and elicitation lets the server ask the user for more information or confirmation mid-task (elicitation/create).

Connecting to GitHub, databases and other tools

The ecosystem is real, not theoretical. At launch Anthropic shipped reference servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer, plus SDKs in Python and TypeScript (and later C# and Java); the reference repository (github.com/modelcontextprotocol/servers) also includes a filesystem server.

For GitHub specifically, GitHub maintains its own official MCP server (github/github-mcp-server), offered both as a GitHub-hosted remote server and as a local Docker image (ghcr.io/github/github-mcp-server). Hosts with remote support include VS Code 1.101+, Claude Desktop, Cursor and Windsurf. Point your assistant at it and it can read issues, open pull requests and inspect repositories through the same standard interface it uses for everything else.

Who adopted it

MCP's early adopters in November 2024 included Block and Apollo, plus dev tools Zed, Replit, Codeium and Sourcegraph. Over the following year, adoption broadened dramatically: per the protocol's first-anniversary blog (25 November 2025), OpenAI brought MCP support across ChatGPT and its developer platform, Google Cloud and DeepMind shipped MCP servers (for Maps and databases) with Gemini support, Microsoft integrated it across Azure and Microsoft 365 via Foundry, and GitHub shipped its own server and a registry. IDEs including VS Code and Cursor support it natively. The MCP Registry grew to roughly 2,000 entries by that one-year mark. When competing vendors adopt the same standard, that is the signal it has become infrastructure rather than one company's bet.

A word on security

A standard that lets an AI run tools is also a standard that needs guardrails, and the spec's "Security and Trust & Safety" section is explicit about them: hosts must obtain explicit user consent before exposing data or invoking tools; tool descriptions and annotations should be treated as untrusted unless they come from a trusted server (the defence against tool poisoning and prompt injection hidden in tool metadata); and the user must approve sampling requests. The 2025-06-18 revision tightened authorization by classifying MCP servers as OAuth Resource Servers and requiring clients to implement Resource Indicators (RFC 8707), which stops a malicious server from stealing tokens meant for another.

Which version is current

The protocol is versioned by date. The current specification is revision 2025-11-25, released on MCP's first anniversary, which adds asynchronous Tasks, simplified OAuth/authorization, an extensions framework and sampling-with-tools. The prior revisions were 2025-06-18 (which added elicitation and the OAuth Resource Server model, and dropped JSON-RPC batching) and 2025-03-26. A 2026-07-28 release candidate exists but is not yet final. If you are reading a tutorial, check which revision it targets — auth and transport details have changed meaningfully between versions.

FAQ

Do I need to write code to use MCP? Usually not to use it. Many hosts (Claude Desktop, VS Code, Cursor) let you add an existing server with a small config entry. You only write code if you are building a new server to wrap a tool that does not have one yet — and the Python and TypeScript SDKs make that straightforward.

Is MCP tied to Anthropic or to Claude? No. Anthropic created and open-sourced it, but the protocol is vendor-neutral and now supported by OpenAI, Google, Microsoft and GitHub among others. A server you build works across all compliant clients.

What is the difference between a "tool" and a "resource"? A tool does something (it has side effects — sends a message, runs a query, opens a PR). A resource provides something (read-only context the model can pull in, like a file's contents). Same server can expose both.

How is MCP different from just giving the model an API key? An API key with a hand-written integration solves one tool for one app. MCP standardizes the connection so the same server works across every compliant client, and it adds a defined lifecycle, capability negotiation, consent model and auth story — none of which an ad-hoc integration gives you.

Bottom line

MCP is the USB-C of AI integrations: one open standard, defined by Anthropic in November 2024 and now adopted across the industry, that lets any AI application connect to any tool or data source through a consistent interface. A host runs clients, each client talks to one server over stdio or Streamable HTTP using JSON-RPC, and servers expose tools, resources and prompts. The payoff is that "connect my assistant to GitHub, my database and Slack" stops being three custom integrations and becomes three standard plugs.

Sources and further reading