An MCP server is one side of a standard connection between an AI application and an outside system. The application is the host, which runs a client; the server exposes capabilities over JSON-RPC. Servers can offer tools, which the model can invoke; resources, which the application can read; and prompts, which are reusable templates. The session starts with a capability negotiation, so both sides know what the other supports.
The protocol standardizes reach, not safety. Tool descriptions and annotations are written by the server and should be treated as untrusted unless the server is trusted. Authorization is optional at the protocol level, and the specification asks hosts to obtain explicit user consent before invoking a tool. The server is expected to validate inputs, apply access controls, and sanitize outputs; the client is expected to show tool inputs and validate results.
Connecting a server is therefore a permission decision. List its tools before you use it on real work, scope any credential to the task, and prefer a version you can pin. See MCP servers, skills, and plugins.