What Is an MCP Server? A Plain English Guide
An MCP server gives an AI application a standard way to discover and use outside data, reusable prompts, and actions. This guide explains the architecture, local and remote servers, authentication, and security without assuming an engineering background.
What is an MCP server in plain English?
An MCP server is a program that presents data or actions to an AI application in a standard format. It might let an assistant search a document library, read a repository, query a business system, or create and update records. MCP stands for Model Context Protocol.
Anthropic introduced MCP as an open standard in November 2024. The goal was to reduce the need for a separate custom integration between every AI application and every outside system. A provider can implement the protocol once, while compatible applications can use the same basic method to discover what that provider offers.
A useful analogy
An API is like the machinery behind a service. MCP is a standard control panel that tells a compatible AI application which controls exist, what information each control needs, and what kind of result to expect.
MCP is not an AI model, a database, or an autonomous agent. It is the protocol used for the connection. The quality and safety of the result still depend on the AI application, the MCP server, the underlying service, and the permissions granted by the user.
How MCP works: host, client, and server
A plain explanation often says MCP has a client and a server. The official architecture is a little more precise:
- Host: the AI application or development environment the person uses, such as a supported chat product or coding tool.
- Client: the protocol component inside the host that maintains a connection to one MCP server.
- Server: the program that exposes selected capabilities and returns results.
| Part | Job | Example |
|---|---|---|
| Host | Runs the user experience and coordinates connections | An AI chat product or coding environment |
| Client | Speaks MCP to one server on the host's behalf | The connection managed inside the host |
| Server | Describes and delivers approved capabilities | GitHub, a database service, or PolicyForge |
When you make a request, the host can inspect the capabilities available through its connected servers. The model may choose a relevant tool, the client sends the structured request, and the server performs the work or returns data. The host then presents the result or asks for any confirmation required by the application.
MCP servers can expose more than tools
Articles often describe an MCP server as a list of actions. Tools are important, but the core protocol also defines resources and prompts:
- Tools are functions the model can select, such as creating an issue, retrieving account usage, or generating a document.
- Resources provide structured context that the host can read or attach, such as a file, a record, or repository history.
- Prompts are reusable interaction templates that a person can choose in a compatible host.
A server does not have to implement all three. A focused server may expose only a small set of tools. A documentation server might emphasize resources. What matters is that the server declares supported capabilities rather than leaving the host to guess.
MCP server vs API
An API and an MCP server solve related but different problems. Developers call an API using code written for specific endpoints. An MCP server publishes machine readable capability descriptions that a compatible AI host can use at runtime. Many MCP servers are adapters over an existing API, so the API still handles the underlying business operation, account rules, and data storage.
PolicyForge follows this pattern. Its MCP tools map to the same controlled policy operations documented in the PolicyForge API documentation.
Local and remote MCP servers
The word server does not mean the program must run in a data center. MCP servers commonly use one of two deployment patterns:
| Pattern | How it connects | Typical use |
|---|---|---|
| Local server | Runs as a local process, commonly over stdio | Local files, developer workflows, installed packages |
| Remote server | Runs online, commonly over Streamable HTTP | Hosted SaaS products and shared business systems |
Transport and authentication are separate questions. A protected remote server may use the MCP authorization flow based on OAuth, while some providers also support bearer API keys. A local process may receive a credential through an environment variable. Avoid copying secrets into prompts, committed configuration files, screenshots, or shared documents.
How to connect an MCP server
- Confirm client support. Check the current documentation for your AI application, plan, and workspace.
- Use the provider's official endpoint or package. Avoid copied configuration from an unknown directory or post.
- Review capabilities. Identify which tools read data, which write data, and which can delete or publish.
- Authenticate safely. Prefer the provider's browser based OAuth flow when it is supported. Otherwise protect the API key as a secret.
- Test a low risk request. Start with listing or reading before allowing a write action.
- Know how to revoke access. Confirm where tokens, grants, or API keys can be disabled.
Setup differs across ChatGPT, Claude, Cursor, Windsurf, VS Code, and other hosts. Product support also changes quickly. Use current vendor instructions instead of assuming that a configuration for one client will work in another.
Is MCP safe? Use this security checklist
MCP standardizes communication. It does not certify that a server is trustworthy or that an exposed tool is implemented safely. A tool description and its annotations help a host reason about an action, but they are not a substitute for access control, validation, and user review.
- Trust the provider. Connect the official server from an organization you have assessed.
- Use least privilege. Grant only the accounts, scopes, repositories, and environments needed for the task.
- Separate reading from writing. Treat create, update, send, publish, purchase, and delete tools as higher risk.
- Require confirmation. Review the exact target and payload before a consequential action runs.
- Protect credentials. Use OAuth or secret storage where available, rotate keys, and revoke unused grants.
- Plan for prompt injection. Untrusted documents and tool results can contain instructions designed to mislead the model.
- Check data handling. Data sent to a remote server is also governed by that provider's retention, privacy, and security practices.
- Use test environments. Validate unfamiliar write tools against nonproduction data first.
If an MCP server handles personal information, compare its behavior with your published disclosures. PolicyForge's privacy policy generator can help structure that disclosure, but the finished policy must match the systems you actually connect and the data they process.
A real example: the PolicyForge MCP server
PolicyForge operates both a remote MCP endpoint and a local package. The remote endpoint uses Streamable HTTP at https://policyforge.co/api/mcp. Compatible clients can use a browser based OAuth flow with PKCE, while clients that cannot complete that flow can send a PolicyForge API key. The local option runs through @policyforge/mcp and reads the key from an environment variable.
The current server exposes tools that can:
- generate and regenerate supported policies while preserving the hosted policy URL;
- list, retrieve, update, version, restore, and delete policies within the authenticated account;
- compare a codebase manifest with a policy and report disclosure gaps;
- check whether a stored technology manifest has drifted since generation;
- return disclosure checklists, integration guidance, supported policy types, and account usage.
The AI host still needs access to the project in order to inspect its code. The MCP server does not silently crawl a repository. The host or coding agent builds a structured manifest from what it can see, then sends the relevant fields to the selected PolicyForge tool.
For concrete workflows, see 12 PolicyForge MCP use cases. For current client specific commands, OAuth setup, tool names, and troubleshooting, use the maintained PolicyForge MCP setup page.
MCP access has no separate PolicyForge fee and follows the account's existing plan limits. The free plan currently includes two policy generations per month, and the MCP onboarding offer can add three one time bonus generations. Check the pricing page for current limits.
Try PolicyForge in a compatible AI tool
Review the available tools, choose remote OAuth or a local setup, and start with a low risk read or audit request.
Frequently asked questions
What is an MCP server in simple terms?
An MCP server is a program that gives an AI application a standard way to discover and use outside data, reusable prompts, or actions. It can run locally on your computer or remotely as an online service. The AI application connects through an MCP client and decides which available capability to use for your request.
What is the difference between an MCP server and an API?
An API exposes endpoints for software developers to call. An MCP server describes capabilities in a standard format that compatible AI applications can discover and use. Many MCP servers call an existing API behind the scenes, so MCP usually complements an API rather than replacing it.
Can an MCP server run locally?
Yes. A local MCP server commonly runs as a child process and communicates through standard input and output. A remote server commonly uses Streamable HTTP. Local does not automatically mean safe, and remote does not automatically mean unsafe. Review the server, its permissions, its data access, and how credentials are stored.
Do I need to know how to code to use an MCP server?
Not always. Some AI applications let you add a remote MCP server by entering a URL and completing a browser sign in. Other clients require a command or configuration file. The server provider should publish instructions for each supported client.
Is an MCP server safe?
MCP is a protocol, not a safety guarantee. Risk depends on the server, the client, the permissions, the data it can read, and the actions it can take. Prefer trusted providers, use the least privilege available, inspect read and write capabilities, require confirmation for consequential actions, and revoke access you no longer need.
Does ChatGPT support MCP servers?
OpenAI supports remote MCP servers in its developer platform and offers MCP powered apps in supported ChatGPT plans and workspaces. Available read, search, and write capabilities can differ by plan, workspace settings, role, and interface, so check the current OpenAI product documentation before configuring a server.