What is an MCP server, and how coding agents use them
What the Model Context Protocol is, what an MCP server exposes, how Claude Code, Cursor and Codex connect to one, what a tool call looks like on the wire, and how to use them safely.
Key Takeaways
- MCP is a standard plug between AI apps and outside systems. The official docs compare it to a USB-C port for AI applications: one protocol so an assistant can connect to files, databases, APIs and workflows without a custom integration for each.
- A server offers tools, resources and prompts. Tools are actions the model can call, resources are data it can read, and prompts are reusable templates. Most servers you will use are mainly tools.
- Local servers run on your machine; remote ones run as a web service. Local servers use the stdio transport. Remote servers use Streamable HTTP and, per the spec, should use OAuth for sign-in.
- Every major coding agent supports it. Claude Code adds servers with claude mcp add, Cursor reads mcp.json, and Codex uses config.toml or codex mcp add, with OAuth sign-in for remote servers.
- An agent with a server has your access. Connecting a platform’s server usually grants the agent the same rights as your account. Scope it, keep tool approval on, and be careful mixing servers that read untrusted content with servers that can change things.
Quick-Start Prioritization Framework
| Agent | Where servers are configured | Add a remote server | Sign in |
|---|---|---|---|
| Claude Code | ~/.claude.json (local and user scope), .mcp.json (project scope) | claude mcp add --transport http <name> <url> | /mcp in a session, or claude mcp login <name> |
| Cursor | .cursor/mcp.json or ~/.cursor/mcp.json | An entry under mcpServers with a url | “Needs login” prompt, OAuth with PKCE |
| Codex (CLI, IDE, ChatGPT desktop) | ~/.codex/config.toml, [mcp_servers.<name>] | codex mcp add <name> --url <url> | codex mcp login <name> |
| Claude and ChatGPT apps | Connector or app directory, or a custom connector | Install from the directory, or paste the server URL | OAuth in the browser |
Coding agents used to be limited to the files on your laptop and whatever you pasted into the chat. MCP changed that. With an MCP server connected, Claude Code can open a pull request, Cursor can read your production logs, and Codex can create a database table, all by calling tools a service exposes. This guide explains what MCP is, what a server actually provides, how the main coding agents connect to one, what happens during a tool call, and the security habits that keep an agent with real access from doing real damage.
MCP in plain terms
The Model Context Protocol is an open-source standard for connecting AI applications to external systems. Before it, every AI tool needed its own plug-in format for every service. With it, a service builds one MCP server and any MCP-capable client can use it: Claude, ChatGPT, Claude Code, Cursor, Codex, VS Code and many more.
Hosts, clients and servers
The docs name three roles. The host is the AI application you use, such as Claude Code. Inside it, the host creates one MCP client per connected server, and each client keeps a dedicated connection to its server. The server is the program that provides tools and data. If you connect GitHub and Stripe, your agent has two clients talking to two servers.
Local and remote servers
A local server runs on your machine as a child process and talks over standard input and output (stdio); a filesystem server is the classic example. A remote server runs on the provider’s infrastructure and talks over Streamable HTTP, which uses HTTP POST for messages and can stream responses. Remote servers can serve many users and handle sign-in in the browser.
The wire format
Messages are JSON-RPC 2.0. The current protocol version, dated 2026-07-28, is stateless: every request carries the protocol version and client capabilities in a _meta field, and a client can call server/discover to learn what a server supports before anything else.
What a server exposes
MCP defines three kinds of things a server can offer, called primitives.
Tools: things the model can do
A tool has a name, a description and a JSON Schema for its inputs. Examples: create_branch, run_sql, deploy_project. The description is what the model reads to decide when to call it, so good servers write them carefully.
Resources: things the model can read
Resources are data sources such as a file’s contents, a database schema or a record. The docs give the example of a database server that offers query tools, a resource holding the schema, and a prompt with worked examples.
Prompts: reusable templates
Prompts are prepared instructions the user can invoke, such as “review this migration”. They are the least used of the three in coding agents today.
Asking the user
Servers can also ask the user for input through elicitation, for example to confirm a destructive action. Sampling, which let servers request completions from the client’s model, is deprecated as of the 2026-07-28 version.
Worked example: one tool call, step by step
Say you ask Claude Code, connected to a database platform’s MCP server: “Add a status column to bookings and backfill it.” Here is roughly what happens.
- When the session starts, the client asks the server for its tool list with tools/list. The server returns names, descriptions and input schemas, for example list_tables, run_sql and apply_migration.
- The host adds those tools to the model’s available actions alongside its built-in ones, such as editing files.
- The model decides it first needs the current schema and emits a call to list_tables. Depending on your settings, the host shows you the call and waits for approval.
- The client sends a tools/call request with the tool name and arguments. The server checks your token, runs the action against your project, and returns the result as content, usually text.
- The model reads the result, writes a migration, and calls apply_migration. Again you can approve or reject it.
- The model reports what changed. If the server supports change notifications, the client can also learn when the tool list itself changes.
Connecting servers in Claude Code, Cursor and Codex
All three support local and remote servers. Remote servers with OAuth are the easiest to set up and keep secrets off your disk.
Claude Code
Run claude mcp add --transport http <name> <url>. The default scope is local (you, this project); --scope project writes a .mcp.json you can commit for your team; --scope user makes it available in all your projects. Start a session and type /mcp to sign in, or run claude mcp login <name> from the shell. Claude Code asks you to approve project-scoped servers before it uses them.
Cursor
Add servers to .cursor/mcp.json for one project or ~/.cursor/mcp.json for all of them, or install from Cursor’s own screens. Remote servers can sign in with OAuth (authorization code with PKCE). By default Cursor asks for approval before each MCP tool runs.
Codex
The Codex CLI, IDE extension and ChatGPT desktop app share one configuration in ~/.codex/config.toml, with one [mcp_servers.<name>] table per server. codex mcp add <name> --url <url> adds a remote server, and codex mcp login <name> signs in with OAuth. Options such as enabled_tools and disabled_tools limit what the agent can call.
Claude and ChatGPT in the browser
In the chat apps, servers appear as connectors or apps. You install them from a directory or add a custom one by URL, then sign in through the provider’s OAuth page.
What developers connect today
Most popular developer platforms now run an official remote server. A few documented examples:
| Server | Address | What its docs say it does |
|---|---|---|
| GitHub | api.githubcopilot.com/mcp/ | Repos, issues, pull requests, Actions and more, grouped into toolsets; read-only mode available |
| Stripe | mcp.stripe.com | Search and call Stripe API methods, search docs; some actions need human confirmation |
| Supabase | mcp.supabase.com/mcp | Tables, migrations, SQL, logs, Edge Functions; can be scoped to one project and read-only |
| Vercel | mcp.vercel.com | Docs search, projects and deployments, logs, analytics |
| Neon | mcp.neon.tech/mcp | Projects, branches, SQL and schema changes; recommended for development and testing |
Security: what can go wrong and how to limit it
MCP gives a model real reach. The protocol’s own security guide, and the providers’ docs, are blunt about the risks.
The agent acts as you
Vercel’s docs say connecting its server grants the AI system the same access as your Vercel account. That is typical. Treat a connected server like handing someone your laptop while signed in.
Prompt injection
If one server returns text from the outside world, such as an issue body, a web page or a log line, that text can contain instructions. A model that follows them could use another server to leak or change data. Claude Code’s docs warn that servers fetching external content can expose you to prompt injection; Supabase and Stripe both recommend keeping manual approval of tool calls switched on.
Scope everything you can
Use the narrowest option each provider offers: Supabase’s project_ref and read_only=true, Neon’s readonly and projectId parameters, GitHub’s toolsets and --read-only, Codex’s enabled_tools. Neon goes further and recommends its server for development and testing only, never production data.
Local servers run code on your machine
A local server is a program you download and execute. The MCP security guide describes malicious startup commands and payloads, and says clients should show the exact command and require consent before running one. Install local servers only from sources you trust.
Common mistakes
These come up most when people first wire agents to real services.
Auto-approving every tool
Auto-run is convenient for reads. For writes such as SQL, deploys, refunds or deletes, keep approval on until you trust the workflow.
Pasting long-lived API keys into config files
Prefer OAuth where the server supports it, and keep any tokens in environment variables, not in a committed .mcp.json. Stripe, for example, documents OAuth and agent-specific API keys, and is retiring full-access secret keys for its MCP server.
Connecting too many servers
Each server adds tool descriptions the model has to read. Ten servers with dozens of tools each make the model slower to pick the right one and widen the attack surface. Connect what the current task needs.
Pointing an agent at production first
Start against a development project or branch. Supabase and Neon both suggest testing changes on branches before they reach production.
If you want one server for the whole app
If you’d rather not connect and coordinate a separate server for your database, sign-in, functions and hosting, Floot’s MCP server lets ChatGPT, Claude, Claude Code, Codex or Cursor build and publish a full-stack app in one project. It is listed in the Claude connector directory, the ChatGPT app directory and the Cursor Marketplace.
Frequently Asked Questions
Is MCP only for Claude?
No. Anthropic introduced it, but it is an open protocol. ChatGPT, Codex, Cursor, VS Code, Gemini CLI and many other clients support it.
What is the difference between an MCP server and an API?
An API is designed for programs written by developers. An MCP server wraps actions in a standard format with descriptions and input schemas that an AI model can discover and call on its own. Many MCP servers call the provider’s API underneath.
Do I need to run anything to use a remote MCP server?
No. You add its URL to your agent and sign in. Local servers, by contrast, run as a program on your machine, often through npx or Docker.
Can an MCP server see my code?
Only what the agent sends it in tool arguments, and what the server itself can access. A filesystem server can read the folders you allow; a remote platform server sees the data in your account on that platform.
Are MCP servers free?
Most official servers cost nothing extra; you pay for the underlying service as usual. Actions you take through them, like creating a database or deploying, are billed by the provider.
How do I build my own MCP server?
Use one of the official SDKs listed on modelcontextprotocol.io, define your tools with clear descriptions and input schemas, and test it with the MCP Inspector before connecting it to an agent.
Sources
- Model Context Protocol, What is the Model Context Protocol (MCP)?, 2026 https://modelcontextprotocol.io/docs/getting-started/intro
- Model Context Protocol, Architecture overview, 2026 https://modelcontextprotocol.io/docs/learn/architecture
- Model Context Protocol, Security Best Practices, 2026 https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices
- Anthropic, Connect Claude Code to tools via MCP, 2026 https://code.claude.com/docs/en/mcp
- Cursor, Model Context Protocol (MCP), 2026 https://cursor.com/docs/context/mcp
- OpenAI, Model Context Protocol (Codex), 2026 https://learn.chatgpt.com/docs/extend/mcp
- Vercel, Use Vercel MCP, 2026 https://vercel.com/docs/mcp/vercel-mcp
- Supabase, Model context protocol (MCP), 2026 https://supabase.com/docs/guides/getting-started/mcp