What is an MCP server?

The MCP specification describes three roles: hosts are the AI applications that start connections, clients are the connectors inside them, and servers provide context and capabilities. A server can offer resources (data), prompts (templates) and tools (functions the model can call). Servers run either locally, talking to the host over stdio, or remotely over HTTP. Tools are model-controlled: the model decides when to call them based on the conversation. That is why the specification says there should always be a human in the loop able to deny tool invocations, and why servers must validate inputs, apply access controls and rate-limit calls.

You add a server to a host such as Claude Code, Cursor, Codex or Claude Desktop with a URL and credential, or a command to run. The host lists its tools to the model. For a payment server, the tools might be get_budget to read remaining allowance and create_payment to request a payment; the server, not the model, decides whether each payment goes through. Before you trust a server, list its tools and read their descriptions and input schemas: that is everything the model will be able to ask it to do.

• An MCP server is not an AI model. It's the thing the model calls.
• Connecting a server doesn't grant it access to everything in your chat; it receives the tool calls the host sends it.
• Tool annotations a server publishes are hints. The spec says clients must treat them as untrusted unless the server is trusted.

• Model Context Protocol specification
• MCP specification: Tools (human in the loop, security considerations)
• MCP specification: Transports

• How to give Claude or ChatGPT a payment tool via MCPAdd a remote MCP payment server to Claude Desktop, Claude on the web or ChatGPT: which auth each host supports and what to check before it can spend.
• How to add a payment tool to Claude CodeAdd a remote MCP payment server to Claude Code with claude mcp add, choose a scope, and keep a coding agent from paying for things you didn't intend.
• Can prompt injection make an AI agent spend money?Yes, if the agent has a payment tool and nothing outside the model checks it. How injected instructions reach a payment and which controls still hold.

• Payment intentA payment intent is an object representing a payment that has been requested but not necessarily completed, which moves through defined states such as awaiting approval, submitted, confirmed or cancelled.
• Idempotency keyAn idempotency key is a unique value a client attaches to a request so that, if the same request is sent again with the same key, the server returns the original result instead of performing the action a second time.

Full glossary →