Model Context Protocol (MCP) Explained, With a Minimal Python Server

The problem MCP solves

Before a shared protocol, every AI application needed its own connector for every system. A team that wanted its assistant to read Jira tickets, query Postgres and search Google Drive wrote three integrations, and then wrote them again for the next assistant. The Model Context Protocol (MCP) is an open protocol that standardises how AI applications connect to external data and tools. The specification says it takes inspiration from the Language Server Protocol, which did the same job for programming language support in editors.

The practical result is that you can write one MCP server for your company's order system and use it from any MCP capable client. Many frameworks in this course can consume MCP servers. Microsoft Agent Framework 1.0 supports MCP, the OpenAI Agents SDK lists MCP server tool calling among its features, every language version of Google's ADK includes an MCP client, and the Claude Agent SDK connects to external tools through MCP.

Hosts, clients, servers and the three server features

MCP uses JSON-RPC 2.0 messages between three roles. The host is the LLM application the user works in, such as an IDE or chat app. Inside the host, a client is the connector that holds a connection to one server. A server is the service that provides context and capabilities, for example a server that wraps your inventory database. One host can run many clients, each talking to a different server.

Servers can offer three kinds of feature. The current specification, version 2026-07-28, describes them as resources, which are context and data for the user or model to use; prompts, which are templated messages and workflows for users; and tools, which are functions for the model to execute. Clients can also offer features to servers; the current specification lists elicitation, which lets a server ask the user for more information. Optional extensions, such as Tasks for long running operations, must be negotiated by both sides.

• Tools: the model calls them, for example create_ticket or get_stock_level.
• Resources: data the application can read, for example a policy document.
• Prompts: reusable templates a user can pick, for example summarise this incident.
• Transports in the Python SDK: stdio, Streamable HTTP and SSE.

A minimal MCP server in Python

The official Python SDK documentation describes v2 as the current stable release line and requires Python 3.11 or later. Install it with pip install "mcp[cli]" or uv add "mcp[cli]"; the cli extra gives you the mcp command. The example below follows the SDK documentation: create an MCPServer, then decorate functions as tools or resources. The type hints and docstring become the schema that clients see, so the add tool takes two integers and returns an integer.

To try it, save the file as server.py and run uv run mcp dev server.py, which starts the MCP Inspector so you can call the tool by hand and see the exact inputs and outputs. The Inspector needs npx on your PATH. Older tutorials use a class called FastMCP from the v1 line; if you see that name, check the SDK's migration guide before copying code, because v2 includes breaking changes.

# Illustrative, check the official docs for the current API
# Based on the MCP Python SDK v2 docs: py.sdk.modelcontextprotocol.io
from mcp.server import MCPServer

mcp = MCPServer("Demo")


@mcp.tool()
def add(a: int, b: int) -> int:
    """Add two numbers."""
    return a + b


@mcp.resource("greeting://{name}")
def greeting(name: str) -> str:
    """Greet someone by name."""
    return f"Hello, {name}"

# Run with the Inspector: uv run mcp dev server.py

Security rules you must design for

The MCP specification is direct about risk: tools represent arbitrary code execution and must be treated with caution. It sets out principles for implementers. Users must consent to and understand data access and operations. Hosts must obtain explicit user consent before invoking any tool and before exposing user data to servers. Descriptions of tool behaviour, such as annotations, should be treated as untrusted unless they come from a trusted server.

The protocol cannot enforce these rules by itself, so your host and server code must. In practice, give each server the narrowest credentials it needs, keep write tools separate from read tools, log every tool call, and only install third party servers you have reviewed. A server that reads a Mumbai warehouse's stock levels should not hold credentials that can change prices.

Who governs MCP now

Anthropic created MCP and, on 9 December 2025, donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation. Anthropic, Block and OpenAI co-founded the foundation, with Google, Microsoft, Amazon Web Services, Cloudflare and Bloomberg listed as supporters. Its founding projects also include Block's goose and OpenAI's AGENTS.md. Anthropic stated that MCP's governance model stays the same, with maintainers continuing to prioritise community input and transparent decision making.

For a developer, neutral governance matters because it lowers the risk of building on the protocol. A tool server you write today is not tied to one model vendor, which is useful when a client in London prefers one model provider and a client in Riyadh another. Always check the specification's version date when reading tutorials, because the protocol has had several dated revisions.

Check your understanding