MCP Explained: The Easy Guide to Model Context Protocol

Why MCP exists

Before MCP, every AI application needed a custom integration for every tool it wanted to use. Ten apps × ten tools meant up to a hundred one-off integrations. MCP replaces that with one standard interface: a tool exposes itself once, and any MCP-capable client can use it.

Core MCP building blocks

Three architecture roles (indigo) carry the conversation, and three capability types (teal) are what servers offer.

What methods does MCP use?

MCP messages are JSON-RPC style: a method name, params, and a matching result. Methods come in groups — discovery, tools, resources, prompts — plus notifications for events like “the tool list changed”.

• Tools
• Resources
• Prompts
• Discovery

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "search_files",
    "arguments": { "query": "quarterly report" }
  }
}

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [
      { "type": "text", "text": "Found 3 matching files: …" }
    ],
    "isError": false
  }
}

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "resources/read",
  "params": {
    "uri": "file:///reports/q2-summary.md"
  }
}

{
  "jsonrpc": "2.0",
  "id": 3,
  "result": {
    "contents": [
      {
        "uri": "file:///reports/q2-summary.md",
        "mimeType": "text/markdown",
        "text": "# Q2 Summary\n…"
      }
    ]
  }
}

{
  "jsonrpc": "2.0",
  "id": 4,
  "method": "prompts/get",
  "params": {
    "name": "summarize_ticket",
    "arguments": { "ticketId": "T-1042" }
  }
}

{
  "jsonrpc": "2.0",
  "id": 4,
  "result": {
    "messages": [
      {
        "role": "user",
        "content": {
          "type": "text",
          "text": "Summarize ticket T-1042 for a customer update."
        }
      }
    ]
  }
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "server/discover",
  "params": {
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "example-client",
        "version": "1.0.0"
      }
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "serverInfo": { "name": "docs-server", "version": "2.1.0" },
    "capabilities": {
      "tools": { "listChanged": true },
      "resources": { "listChanged": false },
      "prompts": { "listChanged": false }
    },
    "_meta": {
      "io.modelcontextprotocol/cache": {
        "ttlMs": 300000,
        "cacheScope": "server"
      }
    }
  }
}

Transport mechanisms

MCP defines the message format — but messages still need a way to travel between client and server. That carrier is the transport.

Old MCP vs new MCP 2026-07-28

The 2026-07-28 release candidate introduces a stateless-first protocol core and several production-oriented changes. This is the most important shift since MCP launched — it changes how clients connect, how requests are routed, and where session state lives.

Details below reflect the release candidate and may change before final release. Support will vary by SDK, client, and server.

// 1. Client must open a session first
POST /mcp
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-06-18",
    "clientInfo": { "name": "example-client", "version": "1.0.0" },
    "capabilities": { }
  }
}

// 2. Server responds and assigns a session
HTTP/1.1 200 OK
Mcp-Session-Id: 8f3c-a1d2-77b9

// 3. Client confirms, then must echo the session ID forever after
POST /mcp
Mcp-Session-Id: 8f3c-a1d2-77b9
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "search_files",
    "arguments": { "query": "roadmap" }
  }
}

// No handshake. No session. Headers tell gateways everything.
POST /mcp
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search_files

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "search_files",
    "arguments": { "query": "roadmap" },
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "example-client",
        "version": "1.0.0"
      },
      "io.modelcontextprotocol/clientCapabilities": {
        "elicitation": { }
      }
    }
  }
}

Why stateless MCP matters

When every request is self-contained, the server doesn’t need to remember who you are between requests. That one property simplifies almost everything about running MCP in production.

The MCP gateway view

In larger deployments, a gateway sits between AI clients and many MCP servers. The stateless core and routing headers in 2026-07-28 are designed to make this layer practical.

Security and authorization

MCP can expose powerful actions — deleting files, writing to databases, sending messages. Remote servers should use strong authentication; OAuth/OIDC enables delegated access with explicit scopes; and the 2026-07-28 spec hardens authorization behavior. Sensitive tools may require stricter scopes or step-up approval.

Never expose dangerous tools without authentication, input validation, logging, and user consent.

Practical examples

Pick a use case to see what an MCP server for it might expose — and what to watch out for.

• File search
• Database query
• Code & project tracker
• Customer support
• Hosting / cloud

{
  "result": {
    "tools": [
      {
        "name": "search_files",
        "description": "Search names and contents in allowed folders",
        "inputSchema": {
          "type": "object",
          "properties": {
            "query": { "type": "string" }
          },
          "required": ["query"]
        }
      },
      {
        "name": "read_file",
        "description": "Read one file by path",
        "inputSchema": {
          "type": "object",
          "properties": {
            "path": { "type": "string" }
          },
          "required": ["path"]
        }
      }
    ]
  }
}

{
  "result": {
    "tools": [
      {
        "name": "run_query",
        "description": "Run a read-only SQL query (SELECT only)",
        "inputSchema": {
          "type": "object",
          "properties": {
            "sql": { "type": "string" },
            "limit": { "type": "number" }
          },
          "required": ["sql"]
        }
      }
    ]
  }
}

{
  "result": {
    "tools": [
      {
        "name": "create_issue",
        "description": "Create an issue in a project",
        "inputSchema": {
          "type": "object",
          "properties": {
            "title": { "type": "string" },
            "body": { "type": "string" },
            "labels": {
              "type": "array",
              "items": { "type": "string" }
            }
          },
          "required": ["title"]
        }
      }
    ]
  }
}

{
  "result": {
    "tools": [
      {
        "name": "search_tickets",
        "description": "Search support tickets by text and status",
        "inputSchema": {
          "type": "object",
          "properties": {
            "query": { "type": "string" },
            "status": {
              "type": "string",
              "enum": ["open", "pending", "solved"]
            }
          },
          "required": ["query"]
        }
      }
    ]
  }
}

{
  "result": {
    "tools": [
      {
        "name": "restart_service",
        "description": "Restart a service (requires approval)",
        "inputSchema": {
          "type": "object",
          "properties": {
            "serviceId": { "type": "string" },
            "reason": { "type": "string" }
          },
          "required": ["serviceId", "reason"]
        }
      }
    ]
  }
}

Quick glossary

Migration checklist: older MCP → 2026-07-28

If you maintain an MCP client, server, or gateway, this is the rough order of operations. Tick items off as you plan.