Is MCP only for Claude?

No. Anthropic created and open-sourced the specification, but MCP is an open standard with independent client and server implementations across the industry. That cross-vendor reach is exactly why an MCP server approved for one tool ends up reachable from tools nobody reviewed it for.

Does MCP send my data to the model provider?

MCP itself defines only the host-to-server channel. Whether data crosses a network boundary depends on where the server runs and what the host does with the result. A stdio server runs locally, but anything it returns is placed into the model's context and therefore goes wherever that inference request goes.

What is the difference between an MCP server and an MCP client?

The server exposes capability — tools, resources, prompts. The client, embedded in a host application, consumes it. One host typically runs many clients, one per connected server.

Protocol

Model Context Protocol (MCP)

definition

The Model Context Protocol (MCP) is an open standard, introduced by Anthropic in November 2024, that defines how AI applications connect to external tools and data sources over a JSON-RPC interface.

In depth

Before MCP, every pairing of an AI application and an external system needed its own bespoke integration. MCP replaces that N×M problem with one protocol: a *host* application (Claude Code, Claude.ai, an IDE assistant) runs one or more *clients*, and each client maintains a session with a *server* that exposes some capability — a database, a ticket tracker, a filesystem, an internal API.

Servers offer three primitives. Tools are functions the model can decide to call, each with a name, a natural-language description, and a JSON Schema for its arguments. Resources are readable data the host can pull into context, addressed by URI. Prompts are reusable templates a user can invoke deliberately. Clients can also offer capabilities back to servers, including sampling (letting a server ask the host's model for a completion) and elicitation (letting a server ask the user a question mid-operation).

Transport is either stdio, where the host launches the server as a local subprocess and speaks over standard input and output, or Streamable HTTP for remote servers. The stdio case is the one that surprises security teams: installing a local MCP server means running somebody else's executable on an engineer's laptop with that engineer's full privileges.

The protocol's adoption is what makes it a governance problem rather than a curiosity. MCP is no longer Anthropic-specific — it is implemented across multiple major AI vendors' clients, which means one malicious or over-permissioned server can be reachable from every AI surface in a company at once.

Why it matters for governance

MCP is a package manager for agent capability, but it shipped without the ecosystem controls package managers took twenty years to grow: no signing requirement, no capability manifest a policy engine can read, no revocation channel. A tool description is untrusted input that the model treats as instruction, which makes the description field itself an injection surface. Governing MCP means deciding which servers may be reached, from which surface, with which credentials — and being able to answer that question retroactively during an incident.

Frequently asked

Is MCP only for Claude?: No. Anthropic created and open-sourced the specification, but MCP is an open standard with independent client and server implementations across the industry. That cross-vendor reach is exactly why an MCP server approved for one tool ends up reachable from tools nobody reviewed it for.
Does MCP send my data to the model provider?: MCP itself defines only the host-to-server channel. Whether data crosses a network boundary depends on where the server runs and what the host does with the result. A stdio server runs locally, but anything it returns is placed into the model's context and therefore goes wherever that inference request goes.
What is the difference between an MCP server and an MCP client?: The server exposes capability — tools, resources, prompts. The client, embedded in a host application, consumes it. One host typically runs many clients, one per connected server.

Sources

Primary sources for the claims on this page. Specifications and vendor documentation change — verify against the source if a detail is load-bearing for a decision you are making.