This article is part of our MCP Guide: what the Model Context Protocol is, how to use it safely, and how to choose servers, tools and help. Want a second opinion on your setup? Request a free MCP readiness review.
This MCP glossary defines 60 Model Context Protocol terms in plain English. Each definition was checked against the MCP specification dated 2026-07-28 and the official docs on 28 October 2026. That is the latest spec version as of October 2026.
Terms are grouped by topic, starting with the basics and ending with security and the wider ecosystem. Where a feature is deprecated or new in the July 2026 spec, we say so.
If you are new to MCP, read what is MCP first, then use this page as a reference.
Key Takeaways
- MCP has three roles: hosts (AI apps), clients (connectors inside them) and servers (programs that expose tools and data).
- Servers offer three primitives: tools, resources and prompts.
- The 2026-07-28 spec made MCP stateless and replaced server-initiated requests with multi round-trip requests.
- Roots, sampling and logging are deprecated as of 2026-07-28 but still work during a deprecation window.
- Tasks, MCP Apps and Skills over MCP are optional extensions, not part of the core protocol.
- Remote servers use an OAuth 2.1-based authorization flow, and token passthrough is forbidden.
Basics
Model Context Protocol (MCP): An open standard for connecting AI applications to external systems such as files, databases and business tools. The official docs compare it to a USB-C port for AI apps.
Specification: The document that defines MCP's rules for clients and servers. The spec is based on a TypeScript schema file, which is the source of truth for every message.
Protocol version: A date string that names a spec release, such as 2026-07-28. Every request now declares the version it uses, and a server that does not support it replies with an "unsupported protocol version" error listing the versions it does support.
Host: The AI application a person uses, such as Claude Desktop or Visual Studio Code. The architecture docs define it as the app that "coordinates and manages one or multiple MCP clients."
Client: A component inside the host that keeps a connection to one MCP server. The host creates one client per server, so three connected servers means three clients.
Server: A program that provides tools, data or prompts to MCP clients. It can run on your computer or on a vendor's infrastructure. See what is an MCP server.
Local server: An MCP server that runs on the same machine as the host, usually launched by the host over stdio. It can reach local files and programs, so the security guide recommends sandboxing.
Remote server: An MCP server hosted elsewhere and reached over Streamable HTTP. Remote servers typically serve many clients and use OAuth for sign-in.
Connector: A common product name for an MCP connection inside an AI app. Claude and ChatGPT, for example, let users add "custom connectors" by entering a remote MCP server URL, per Vercel's setup guide.
SDK (software development kit): A code library for building MCP servers or clients in a given language. Official SDKs exist for TypeScript, Python, C#, Go, Rust, Ruby, Java, Swift, PHP and Kotlin, ranked in tiers on the SDK page.
Messages and transport
JSON-RPC 2.0: The lightweight message format MCP uses for every exchange. It defines requests, responses and notifications, and MCP adds a few rules, such as request IDs never being null.
Request and result: A request is a message from client to server that starts an operation and carries a unique ID. The server answers with a result (or an error) that carries the same ID; in the 2026-07-28 spec every result includes a resultType such as "complete".
Notification: A one-way message that expects no reply and carries no ID. Servers use notifications for things like progress updates and change alerts.
_meta: A metadata field attached to MCP messages. Under the base protocol, every request uses it to carry the protocol version and client capabilities, and usually the client's name and version.
Stateless: The property that every request contains all the information needed to process it. The 2026-07-28 spec made MCP stateless and removed the old initialize handshake and protocol-level sessions, per the changelog.
server/discover: A request every server must support that returns its supported versions, capabilities and identity. Clients may call it first, but they are not required to.
Capabilities: Declarations of which features a client or server supports, such as tools or elicitation. Clients send theirs on every request; servers return theirs from server/discover.
Transport: The channel that carries MCP messages, such as stdio or HTTP. The transport overview says message meaning is identical on every transport; only framing and delivery differ.
stdio: A transport where the client launches the server as a subprocess and they exchange newline-delimited messages over standard input and output. The server must not write anything to stdout that is not a valid MCP message.
Streamable HTTP: The transport for remote servers. Each message is an HTTP POST to a single MCP endpoint, and the server replies with JSON or a short Server-Sent Events stream; it replaced the older HTTP+SSE transport, which is now deprecated.
Server features
Primitive: One of the core building blocks a server or client can offer. Servers offer tools, resources and prompts; clients offer elicitation.
Tool: A function the AI model can call to take an action, such as querying a database or sending a message. Clients find tools with tools/list and run them with tools/call, per the tools spec.
Input schema: A JSON Schema that describes the inputs a tool expects, including which are required. It lets the AI build valid calls and lets software check them.
Structured content: Machine-readable data a tool returns in a structuredContent field. If the tool declares an output schema, the server must return data that matches it.
Tool annotations: Optional hints about a tool's behavior, such as readOnlyHint, destructiveHint, idempotentHint and openWorldHint. The schema says they are only hints and clients should never rely on them from untrusted servers.
Tool execution error: A failure reported inside a normal tool result with isError: true, such as a bad date or an API failure. It differs from a protocol error (like an unknown tool) and gives the AI a chance to correct itself and retry.
Resource: Read-only data a server shares as context, such as a file, a database schema or a report. Each resource has a unique URI and an optional MIME type, per the resources spec.
Resource template: A parameterized resource address, such as weather://forecast/{city}/{date}. Templates follow the URI template standard (RFC 6570) and let clients request many related resources.
Prompt: A reusable instruction template a server offers for users to pick, often as a slash command. Prompts are user-controlled, which means they run only when someone chooses them.
Interaction patterns
Elicitation: A way for a server to ask the user for more information during a task, such as a seat preference or a confirmation. The client concepts page describes two modes: form and URL.
URL mode elicitation: An elicitation that sends the user to a web page instead of a form in the app. The data never passes through the client, so it suits sensitive steps like credential entry; servers must not use form mode for passwords, API keys or payment details.
Multi Round-Trip Requests (MRTR): The 2026-07-28 pattern for when a server needs input to finish a request. The server returns an "input required" result listing what it needs, and the client retries the original request with the answers, per the message patterns page.
Subscriptions (subscriptions/listen): A long-lived request a client opens to receive chosen change notices, such as "tool list changed" or "resource updated." It replaced the older HTTP GET stream and resources/subscribe methods in the 2026-07-28 spec.
Progress notification: A message a server sends while a request is still running to report how far along it is. The client opts in by attaching a progressToken to its request.
Cancellation: Abandoning a request that is still running. On stdio the client sends a cancel notification; on Streamable HTTP, closing the response stream counts as cancellation.
Pagination: Splitting long lists, such as tool or resource lists, into pages. The server returns a nextCursor, and the client sends it back as cursor to get the next page.
Caching hints: The ttlMs and cacheScope fields on list and read results. ttlMs says how many milliseconds a result stays fresh, and cacheScope says whether shared caches may reuse it (public) or only the same authorization context (private).
Completion: A feature that suggests valid values for prompt or resource template arguments as a user types. For example, typing "Par" for a city could suggest "Paris."
Deprecated features
Sampling: A client feature that let servers ask the host's AI model for a completion. It is deprecated as of 2026-07-28; new builds should call an LLM provider's API directly.
Roots: A client feature that told servers which folders they should focus on, using file:// URIs. It is deprecated as of 2026-07-28; the docs suggest passing paths through tool parameters, resource URIs or server configuration instead.
Logging: A feature that let servers send log messages to the client. It is deprecated as of 2026-07-28; servers should log to stderr on stdio or use OpenTelemetry. Deprecated features stay usable until at least the first revision released on or after 28 July 2027.
Extensions
Extension: An optional, opt-in addition to the core protocol that both client and server must support. Extensions use identifiers like io.modelcontextprotocol/tasks and are listed in the extensions overview.
Tasks: An official extension for long-running operations. The server returns a durable task ID, and the client polls with tasks/get until the status reaches completed, failed or cancelled, per the Tasks docs.
MCP Apps: An official extension that lets a server show interactive UI, such as charts, forms or dashboards, inside the chat. The UI runs in a sandboxed iframe controlled by the host, per the MCP Apps docs.
Skills over MCP: An official extension that lets servers share Agent Skills, which are folders with a SKILL.md instruction file and supporting files. Hosts discover them with skills/list and must verify file digests before use, per the Skills docs.
See MCP Apps, Tasks and Skills explained for more on all three.
Security and authorization
Authorization (OAuth 2.1): MCP's optional sign-in framework for HTTP-based servers, built on the OAuth 2.1 draft standard. A protected MCP server acts as an OAuth resource server, and the client acts as an OAuth client, per the authorization spec. See MCP authentication explained.
Protected Resource Metadata: A document (defined in RFC 9728) that a protected MCP server must publish to point clients to its authorization server. Clients must use it to find where to sign in.
Client ID Metadata Document: A way for an MCP client to identify itself to an authorization server using an HTTPS URL as its client ID. It is the preferred registration method; Dynamic Client Registration is deprecated as of 2026-07-28.
PKCE: Short for Proof Key for Code Exchange, an OAuth safeguard against stolen authorization codes. The client creates a secret code verifier and proves it holds that secret when it trades the code for a token.
Resource indicator (token audience): A parameter (RFC 8707) that names the exact MCP server a token is for. Clients must send it, and servers must reject tokens issued for any other audience.
Scope: A named permission an access token carries, such as files:read. The spec encourages least privilege, with extra scopes requested later through a "step-up" flow when an action needs them.
Token passthrough: An anti-pattern where a server accepts a token meant for another service and forwards it downstream. The security guide says it is explicitly forbidden.
Confused deputy: An attack where a trusted program is tricked into using its authority for an attacker. In MCP it can affect proxy servers that use one static OAuth client ID, so the spec requires per-client user consent.
Prompt injection: Hidden instructions in data or tool output that try to make the AI do something the user did not ask for. Stripe and Supabase both warn about it in their MCP docs and advise keeping tool approvals on.
Human in the loop: Keeping a person able to review and deny AI actions. The tools spec says there should always be a human in the loop with the ability to deny tool invocations.
Ecosystem
Reference servers: Example MCP servers maintained by the MCP project, such as Filesystem, Git, Fetch and Time. The servers README calls them educational, not production-ready.
MCP Inspector: The official developer tool for testing MCP servers, described in its repository as "deterministic testing tools for MCP servers." It runs with npx @modelcontextprotocol/inspector.
MCP Registry: The official metadata catalog for publicly available MCP servers, in preview as of October 2026. It stores metadata, not code, and verifies namespaces through GitHub or DNS, per its about page. See the MCP registry explained.
Agentic AI Foundation (AAIF): The Linux Foundation directed fund that hosts MCP. Anthropic donated MCP to it in December 2025, and Anthropic, Block and OpenAI co-founded it, per Anthropic's announcement. See who owns MCP.
MCPA (Model Context Protocol Associate): A certification launched on 14 September 2026 by the AAIF and Linux Foundation Education. It is an online proctored multiple-choice exam aligned to the 2026-07-28 spec, per the Linux Foundation. The exam page lists it at 90 minutes.
Next step
Glossaries help, but the big picture matters more. Read what is MCP for a plain-English overview, or how MCP works for a step-by-step request. When you are ready to plan a project, our MCP readiness audit is a good place to start.
Frequently asked questions
What is the difference between a tool, a resource and a prompt?
A tool is an action the AI model can choose to run. A resource is read-only data the app can add as context. A prompt is a template the user picks on purpose. The spec describes them as model-controlled, application-driven and user-controlled.
What does "deprecated" mean in MCP?
A deprecated feature still works but is scheduled for removal, so new implementations should not adopt it. Under the MCP feature lifecycle policy, the earliest removal for features deprecated on 2026-07-28 is the first revision released on or after 28 July 2027.
Is MCP still using sessions?
No. The 2026-07-28 spec removed protocol-level sessions and the Mcp-Session-Id header. Servers that need state across calls return an explicit handle, like a cart ID, that the AI passes back as an ordinary argument.
What replaced server-initiated requests?
Multi Round-Trip Requests. Instead of the server sending its own request to the client, it returns an "input required" result. The client gathers the input and retries the original request with the answers attached.
Where can I read the official definitions?
The specification at modelcontextprotocol.io is the authoritative source, with the TypeScript schema as the source of truth. The "Learn" pages on the same site explain the concepts in simpler language.
