# Model Context Protocol (MCP) > VI: https://5ac.vn/wiki/mcp/ · EN: https://5ac.vn/en/wiki/mcp/ · lang: en · spec_as_of 2026-10-18 (spec 2026-07-28) · cluster C4 The open standard that connects AI applications to external data, tools and workflows through one JSON-RPC interface between client and server. --- ## Definition Model Context Protocol (MCP) is an open standard for connecting AI applications to external data, tools and workflows through a uniform JSON-RPC interface. The host application creates exactly one client per server; servers advertise resources, prompts and tools, clients issue calls and receive structured results — one integration contract instead of a bespoke connector per tool. ## Mechanism The 2026-07-28 revision describes a stateless base: requests are self-contained calls, with multi round-trip requests (MRTR) for flows that need extra input mid-flight, plus subscribe-and-notify patterns. The spec splits the protocol into layers: | Layer | Contents | Obligation per spec | | --- | --- | --- | | Base protocol | JSON-RPC 2.0 message types (request, result, error) | MUST — every implementation | | Versioning & compatibility | per-request version declaration, back-compat with earlier revisions | MUST | | Message patterns | request/response, MRTR, subscribe & notify | MUST | | Authorization | auth framework for HTTP-based transports | as needed | | Server features | resources, prompts, tools | as needed | | Client features | elicitation, sampling, root directory lists | as needed | | Utilities | logging, argument completion | as needed | Every request declares its protocol version in `_meta` — and in the `MCP-Protocol-Version` header over Streamable HTTP. A client that wants to settle the version up front can call `server/discover`, an RPC every server MUST support (though calling it is optional), which returns supported versions, capabilities and identity in a single request; a server that doesn't support the requested version replies `UnsupportedProtocolVersionError`. Beyond the core, opt-in extensions negotiated at initialization: Tasks (long-running operations with polling, mid-flight input, durable handles), Skills over MCP (structured agent-workflow instructions), and MCP Apps (interactive UI rendered inside the conversation). Flow: Host (AI app) → MCP client → MCP server → Data, prompts, tools ## Spec anchor The versioning page states the scheme plainly: string versions in `YYYY-MM-DD` form, incremented only on backwards-incompatible changes, revisions labelled Draft/Current/Final, and "The current protocol version is 2026-07-28". The site's official documentation index lists exactly five released revisions: 2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25, 2026-07-28. Two eras matter when reading third-party tutorials: everything up to 2025-11-25 uses a centralized handshake, while 2026-07-28 is stateless per request; a large share of blog content online still describes the old flow. Sources fetched for this entry: - — the current-version statement — accessed 2026-10-18 - — spec overview, extensions, security principles — accessed 2026-10-18 - — base layers, message patterns, error taxonomy — accessed 2026-10-18 - — 1:1 host/client/server model, STDIO vs Streamable HTTP transports — accessed 2026-10-18 - — "What is MCP" page — accessed 2026-10-18 - — official docs index; source of the five-revision list — accessed 2026-10-18 ## Academic anchors The scholarly anchor pins measurement work, not protocol prose. *Evaluation and Benchmarking of LLM Agents: A Survey* (arXiv:2507.21504, Mohammadi et al., submitted 29 Jul 2025) organizes agent evaluation along two axes: objectives (behavior, capabilities, reliability, safety) and process (interaction modes, datasets and benchmarks, metric computation, tooling) — its abstract also flags enterprise gaps such as role-based data access and long-horizon interaction. Useful as a reference frame because MCP defines how agents reach tools, not how well they use them. ## FAQ **What is the relationship between MCP and function calling?** The A2A specification's comparison appendix frames it well: MCP standardizes how tools, APIs and data sources are described outside the model (structured input in, structured output out) so one tool server is reusable across many hosts instead of living inside a single vendor's calling format. **What security duties apply when invoking tools?** Three, per the 2026-07-28 spec: users must explicitly consent to and control every data access and operation; hosts must not transmit resource data elsewhere without consent; and tool descriptions or annotations are untrusted unless they come from a trusted server. **How do host, client and server relate?** The host creates exactly one client per server, and each client keeps a dedicated connection to its server (official architecture overview). "Server" names the program serving context wherever it runs: local servers typically speak STDIO, remote servers Streamable HTTP. **Why pin a revision date before trusting a tutorial?** Behavior changed between eras: the centralized handshake (through 2025-11-25) versus stateless per-request versioning (2026-07-28); the versioning page keeps a dedicated Backward-Compatibility section for bridging them. Sample code copied from old tutorials breaks quietly. **Does the MCP site serve machine-readable docs?** Yes — and it is a working example of the llms.txt convention: an llms.txt index of the whole docs tree, every page with a same-URL `.md` twin. ## Related - [What is a Multi-Agent OS?](/en/blog/what-is-multi-agent-os/) - [AI agent control plane and governance](/en/blog/ai-agent-control-plane-governance/) - [What is Agent2Agent (A2A)?](/en/wiki/a2a/) - [What is llms.txt?](/en/wiki/llms-txt/)