AI Stack Library · Tools and MCP
What is MCP, and which servers to install first
MCP, the Model Context Protocol, is an open-source standard that lets an AI agent use outside tools and data, such as your files, calendar or CRM, through small programs called MCP servers that any compatible agent can connect to. Start with two or three servers that match the first job you want done, each with the least access it needs, rather than a long list.
| If you are | Start with |
|---|---|
| An owner who wants the agent to read business documents | A dedicated always-on machine, then one file or notes server pointed at a single folder, read-only |
| A service business that lives in its CRM | A dedicated always-on machine, then your CRM vendor's own MCP server or connector, read-only first |
| A developer | A dedicated always-on machine, then your code host's server and a browser server for testing |
| A student trying it out (not a business) | One read-only file server on your laptop, pointed at a throwaway folder |
MCP in plain words
A model on its own can only read and write text. MCP is the standard way to connect it to your files, calendar, CRM or code, so it can look things up and take actions. Its own documentation compares it to a USB-C port: one plug shape that many devices share.
Three parts are involved. The host is the app the agent runs in, such as a coding agent or a chat app. The server is a small program that offers things to use. Inside the host, a client keeps one connection open to each server.
A server can offer three kinds of thing: tools the agent calls to take an action, resources it reads for context, and prompts, which are ready-made templates.
Because the standard is shared, one server works with every host that speaks MCP. Connect your CRM once, and any compatible agent you add later can reach it, so the connection outlives whichever agent you use today.
One MCP server in the centre offers tools, resources and prompts. Below it, three hosts connect to the same server: a coding agent, a chat app and an agent on a schedule.
- Tools
- Resources
- Prompts
Used by any host that speaks MCP
- Your coding agent
- Your chat app
- An agent on a schedule
Local and remote servers
A local server runs on the same machine as the agent. The host starts it and talks to it directly, through what the specification calls standard input and output, so nothing has to listen on the network.
A remote server runs at the vendor and is reached over the internet, through what the specification calls Streamable HTTP. You sign in to it in your browser, and MCP recommends OAuth for that sign-in, so the agent never needs your password.
A remote server sees what its sign-in allows. A local server can reach whatever the user account it runs under can reach, which on a dedicated machine is the agent's account, not yours.
Two panels. A local server runs on the owned machine next to the agent, is started by the agent's app and listens on no network. A remote server runs at the vendor, is reached over the internet, and signs in through the vendor's own page.
Local server
- Runs on your always-on machine, next to the agent
- Started by the agent's app
- Talks to the agent directly; nothing listens on the network
- Can reach what the agent's user account can reach
Remote server
- Runs on the vendor's computers
- Reached over the internet
- You sign in on the vendor's own page (OAuth)
- Sees what that sign-in allows
A tool list is a permission list
Once a server is connected, the agent can do anything its tools allow. A server with a send-email tool can send email. Read the tool list before you connect, the way you would check which doors a new key opens.
The security guidance on the MCP site warns that local servers run with the same privileges as the app that starts them. Claude Code's documentation tells you to check you trust each server before connecting it, because a server that fetches outside content can carry prompt injection.
A list of made-up tools, each marked by what it can do: read, write, send or delete.
| Tool | What it does | What it can do |
|---|---|---|
| read_file | Reads a file in the folder you allowed | Read |
| search_contacts | Looks up a contact in the CRM | Read |
| write_file | Creates or changes a file | Write |
| update_deal | Moves a deal to a new stage | Write |
| send_email | Sends an email from the connected account | Send |
| delete_event | Deletes a calendar event | Delete |
Example data, made up to show the idea. Not a measurement.
Where a server lets you, start read-only. GitHub's own MCP server, for example, has a read-only mode that skips every write tool, and lets you switch whole groups of tools on or off.
The first servers, by job
Pick by the first workflow you want the agent to run, never by what is popular this month. Start with the servers that one job needs, and stop there.
A table of first jobs, the kind of server each one needs, and the access to start with.
| Job | Server | Access to start with |
|---|---|---|
| Answer questions from business documents | A file or notes server, pointed at one folder | Read-only |
| Work from your CRM | The CRM vendor's own server or connector | Read-only first |
| Plan the week | Your calendar's server | Read-only first |
| Write and fix code | Your code host's server | Read-only, then write on one project |
| Test a website | A browser server | A separate browser profile with no saved passwords |
| Remember between sessions | Your memory store's server | Its own store only |
Where servers come from
- The official MCP Registry, at registry.modelcontextprotocol.io, lists published servers.
- The reference servers on GitHub show how servers are built. On 2026-10-22 seven were maintained there: Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking and Time. Older ones, including GitHub, Slack and Google Drive, have been archived. The project calls them reference implementations, not production-ready servers.
- Vendors' own servers, published by the company whose product they connect to. For a CRM, a code host or a calendar, look there first.
- Community lists, which are good for finding candidates. A listing never proves a server is safe or still maintained.
Connect them one at a time
Add one server, give the agent a small test task, and check what it actually reached before you add the next. If you cannot explain what a server is for, remove it.
A loop of four steps: connect one server, run a test task, check what it reached, then add the next one.
- Connect one serverread-only if it allows
- Run a test tasksomething small you can check
- Check what it reachedfiles, records, messages
- Add the next one
Then back to step 1 for the next one.
Claude Code, Cursor and Codex can each keep a server to one project. In Claude Code, a server added at project scope is saved in a .mcp.json file in the project, and Claude Code asks for approval before using one from that file. Cursor reads a project's servers from .cursor/mcp.json and lets you switch a server off without removing it. Codex reads a project's servers from .codex/config.toml, in projects you have marked as trusted.
What goes wrong
- Too many servers at once. Every tool's description takes up room in the agent's context before it has done any work.
- Write access a server never needed, left on because it was the default.
- A community server nobody has updated in months.
- A local server set up to listen on the network when it only had to talk to an agent on the same machine.
Questions
Is MCP only for Claude?
No. MCP's own site lists Claude, ChatGPT, Visual Studio Code and Cursor among the apps that support it.
Should you write your own MCP server?
Not first. Look for the vendor's own server and check the registry, and build only for a gap nothing else covers.
Terms on this page
Sources
- Model Context Protocol: What is MCP?, checked 2026-10-22
- Model Context Protocol: Architecture overview, checked 2026-10-22
- Model Context Protocol: Security best practices, checked 2026-10-22
- Official MCP Registry, checked 2026-10-22
- MCP reference servers, checked 2026-10-22
- GitHub MCP Server, checked 2026-10-22
- Claude Code: Connect Claude Code to tools via MCP, checked 2026-10-22
- Cursor: Model Context Protocol, checked 2026-10-22
- Codex: MCP, checked 2026-10-22