What Is MCP (Model Context Protocol)? A Beginner's Guide

1. Start with the MCP toggle in Cursor

Open Cursor → Settings → MCP. Each line of configuration tells the Host which local process to start and which capabilities to expose to the Agent. Add filesystem, and the Agent can call read_file directly; add the GitHub Server, and it can search Issues — not because the model suddenly got smarter, but because there’s an extra tool-calling path behind the scenes.

That path runs on Model Context Protocol (MCP). You can learn the full name later; for now, remember the division of labor:

Role	What you interact with	What it does
Host	Cursor, Claude Desktop	Chat, orchestration, decides whether to call tools
Server	filesystem, github, etc. in your config	Actually reads disks, calls APIs, runs queries
Client	Built into the Host, usually invisible in the UI	Connects Host and Server over the MCP protocol

Most people install MCP for one reason: let AI access systems outside the chat window — project files, tickets, databases — instead of copy-pasting back and forth. Below we’ll cover why that’s worth doing with a protocol, then break down the architecture.

---

2. Why is a dedicated protocol worth it?

Large models only process what you send into the dialog by default. In real work you often need them to:

1. Read code in your project instead of you copy-pasting manually
2. Look up company intranet docs or ticketing systems
3. Run git commit, execute tests, call APIs

The common approach used to be Function Calling: developers hard-code a set of functions in application code, and the model can only call those. The problem is —

Pain point	Without MCP	With MCP
Tool discovery	Rewrite integration for every new Host	Server capabilities discovered automatically at runtime
Vendor lock-in	Tied to OpenAI / Anthropic proprietary formats	Open protocol; same server reused across multiple Hosts
Permission isolation	Easy to paste API keys into prompts	Credentials hosted on the server side; model only sees tool interfaces
Composable extension	Adding a new tool means changing Host code	Add one line with an MCP server address in config

In late 2025 Anthropic donated MCP to the Agentic AI Foundation, with OpenAI, Google, Microsoft, and others participating. By 2026, MCP has become one of the de facto standards for AI tool integration — similar to how REST became standard for Web APIs.

---

3. Three roles: know who’s who

MCP architecture has only three core roles. Beginners most often confuse Host and Client — we’ll keep them separate.

3.1 Host (host application)

Software you use daily: Cursor, Claude Desktop, VS Code + Copilot, custom Agent platforms, and so on.

The Host is responsible for: showing the chat UI, calling the large model, and deciding whether to hand user tasks to MCP.

3.2 Client (MCP client)

A connector that runs inside the Host, implemented by the Host vendor. One Host can connect to multiple MCP servers at once.

Think of the Client as the Host’s “MCP driver” — users usually never see it.

3.3 Server (MCP server)

The party that actually does the work: exposes Tools, Resources, and Prompts. Can be a local process or a remote service.

┌─────────────┐     ┌─────────────┐     ┌──────────────────┐
│    Host     │     │ MCP Client  │     │   MCP Server     │
│  (Cursor)   │────▶│  (built-in) │────▶│  (filesystem)    │
│  User UI    │     │  Protocol   │     │  Read files /    │
│             │     │  translation│     │  list directories│
└─────────────┘     └─────────────┘     └──────────────────┘
                           │
                           ▼
                    ┌──────────────────┐
                    │   MCP Server     │
                    │  (github)        │
                    │  Open PR /       │
                    │  search Issues   │
                    └──────────────────┘

Role reference

Host

The app you open; handles UX and model inference

Client

Built into the Host; communicates with Servers over the MCP protocol

Server

The tool service you configure; performs concrete operations

---

4. What can an MCP server expose? Three capabilities

4.1 Tools — let AI “take action”

The most common. Each Tool has a name, description, and input parameter schema. The model chooses on its own whether to call it based on the description.

Typical examples:

• read_file(path) — read a file
• search_issues(query) — search GitHub Issues
• run_sql(query) — query a database

Tools are operations with side effects (writing files, sending requests) and need permission controls.

4.2 Resources — let AI “read-only access”

Like “subscribable data sources”: file contents, API docs, database schemas. AI can list / read resources without necessarily modifying them through a Tool.

Good for: exposing log directories and knowledge-base docs to model context without pasting everything each time.

4.3 Prompts — reusable workflows

Pre-built prompt templates on the server, with parameters. For example: “code review template”, “SQL generation template”.

The Host can insert them in one click, reducing repeated prompt writing.

Capability comparison

Capability	Usually has side effects?	Typical use	Beginner priority
Tools	Yes	Run commands, write files, call APIs	★★★★★
Resources	No (read-only)	Expose docs, config, schemas	★★★☆☆
Prompts	No	Standardize review / translation flows	★★☆☆☆

---

5. MCP vs plugins vs Function Calling vs REST

Beginners often ask: “Can’t I just use a REST API?” You can — but the scenarios differ.

Dimension	REST API	Function Calling	Browser plugin / ChatGPT plugin	MCP
Protocol openness	Open	Vendor-specific format	Platform-specific	Open standard
Tool discovery	Must know endpoints upfront	Function list fixed at compile time	Install from store	Dynamic discovery at runtime
Cross-Host reuse	Adapter layer per Host	Different SDK per model	Hardly cross-platform	Same Server shared across Hosts
Local tools	Need self-hosted HTTP service	Embedded in code	Limited	Native stdio / SSE support
Best for	Traditional backend integration	AI embedded in a single app	Consumer chat products	Developer toolchain, Agent ecosystem

Memory aid: REST is “I know the address, so I call it”; Function Calling is “I told the model in advance it only has these moves”; MCP is “after connecting to the server, ask on the spot what it can do.”

~~Treating MCP as a REST replacement~~ isn’t accurate — many MCP Servers wrap REST APIs internally. MCP is an access layer for the AI era, not a replacement for HTTP.

---

6. What happens in a full call?

Take “find all TODO comments in my project” as an example. The simplified flow:

1. User enters the task in the Host (Cursor chat)
2. Host sends the conversation to the large model, with the Tools list from connected MCP servers (name + description)
3. Model decides to call the search_files tool with parameters { "pattern": "TODO", "path": "/project" }
4. MCP Client sends the request to the filesystem MCP Server
5. Server runs grep / traversal and returns result JSON
6. Model uses the results to compose a natural-language reply, or continues calling other tools

Transport

Method	Description	Common scenarios
stdio	Local process, standard input/output	Claude Desktop, Cursor local Servers
SSE / HTTP	Remote HTTP long connection	Team-shared MCP gateway, cloud deployment

For local development, stdio is most common: put command + args in config, and the Host starts a child process.

---

7. Where can you use MCP?

Mainstream Host MCP support in 2026:

Host	MCP support	Configuration
Cursor	✅ Built-in	Settings → MCP → Add server
Claude Desktop	✅ Native	claude_desktop_config.json
VS Code (GitHub Copilot, etc.)	✅ Improving steadily	Extensions / settings panel
Windsurf / Zed	✅ or partial	Per-product docs
Custom Agent	✅ SDK integration	@modelcontextprotocol/sdk

You don’t need to switch editors — add configuration in your existing tools to extend capabilities.

---

8. Five-minute start: enable MCP in Cursor

Below we use the official filesystem server as an example (read-only access to a specified directory). Paths may vary slightly by version; the core steps are the same.

8.1 Prerequisites

• Node.js 18+ installed
• A clear directory for AI access (use a dedicated workspace; don’t open your entire home directory)

8.2 Add configuration

Open Cursor → Settings → MCP → Add new global MCP server, and enter something like:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/you/projects/my-app"
      ]
    }
  }
}

After saving, restart Cursor or refresh the MCP connection. The status bar / MCP panel should show filesystem connected.

8.3 Verify

In Agent mode, enter:

List the files in the root of /Users/you/projects/my-app and tell me which scripts are in package.json.

If the model returns the directory listing directly instead of asking you to paste, MCP is working.

Common shortcuts

• Open command palette: ⌘ + Shift + P (macOS)
• Open Cursor settings: ⌘ + ,

Claude Desktop users: config file path

On macOS the config file is at:

~/Library/Application Support/Claude/claude_desktop_config.json

Structure is similar to Cursor, also using the mcpServers field. After editing, fully quit Claude Desktop and reopen it.

---

9. Popular MCP servers at a glance

The community already has many ready-made Servers, grouped by scenario:

Category	Representative Server	What it does
Filesystem	@modelcontextprotocol/server-filesystem	Read/write files within allowed directories
Code hosting	GitHub MCP, GitLab MCP	Search Issues, read PRs, manage repos
Knowledge base	Notion, Confluence MCP	Read/write pages and databases
Database	PostgreSQL, SQLite MCP	Run read-only or restricted SQL
Search	Brave Search, Fetch MCP	Web search, fetch pages
Automation	Puppeteer / Playwright MCP	Browser automation
Apple ecosystem	Xcode / simctl wrappers (community)	iOS builds, simulator control

See the full list in the official MCP repository and Cursor MCP directory. Read each Server’s permission notes before installing.

Selection tips

1. Start small: begin with 1–2 read-only Servers and confirm behavior matches expectations
2. Separate prod and experiments: loose config on a personal laptop; dedicated machine + allowlisted directories for teams
3. When you need the macOS toolchain (Xcode, simulators), the Server must run on a Mac — consider a cloud Mac mini for 24/7 hosting

---

10. Security checklist: don’t turn AI into a “super admin”

MCP hands execution power to the model. Prompt injection (malicious web pages/docs tricking the model into calling dangerous tools) is a real risk.

Four must-dos

1. Least privilege: filesystem only opens project subdirectories; block ~, /etc
2. Credential isolation: API tokens in Server environment variables, not in chat or config committed to Git
3. Dedicated accounts: production MCP runs under a dedicated system user, no sudo
4. Audit logs: record every Tool call and its parameters for later review

Risk reference

Configuration	Risk level	Notes
Read-only + single project directory	Low	Good for daily development
Writable filesystem + no path limits	Very high	Model may be tricked into deleting files
Server with shell execution	Very high	Only on isolated VM / dedicated machine
Remote SSE + no auth	Very high	Must add Token / mTLS

Principle: permissions you give AI should not exceed what you’d give a junior intern.

---

11. Five common misconceptions

1. “MCP is a type of large model” — Wrong. MCP is a protocol, unrelated to GPT, Claude, etc.
2. “Installing MCP makes the model smarter” — Wrong. MCP only extends hands and eyes (tools and data), not reasoning ability.
3. “MCP only works locally” — Wrong. stdio suits local use; SSE/HTTP can be deployed in the cloud for team sharing.
4. “MCP will replace LangChain” — Not quite. LangChain is an orchestration framework; MCP is a tool-integration protocol — they often work together.
5. “All Servers are officially maintained” — Wrong. Community Server quality varies; review source and permissions before connecting.

---

12. Should I use off-the-shelf or build my own?

Your situation	Recommendation
Just want Cursor to read project files	Use official filesystem — done in 5 minutes
Need to connect internal company APIs	Start with Fetch / a thin custom Server
Private database + complex business logic	Write your own Server with Python/TS SDK
Team sharing, need auditing	Cloud Mac / Linux SSE gateway + unified auth

Minimal Python example for a custom Server (concept demo):

# pip install mcp
from mcp.server.fastmcp import FastMCP

mcp = FastMCP("hello")

@mcp.tool()
def greet(name: str) -> str:
    """向指定名字打招呼"""
    return f"Hello, {name}!"

if __name__ == "__main__":
    mcp.run()

After running, point command in Host config to python /path/to/server.py.

---

13. Glossary

Term	English	One-line explanation
MCP	Model Context Protocol	Open protocol for AI apps to connect tools and data
Host	—	The AI software you use (Cursor, Claude Desktop)
Server	MCP Server	Tool service exposing Tools/Resources
Tool	—	Function the model can call, often with side effects
Resource	—	Read-only data source, e.g. file or document URI
stdio	standard I/O	Local process communication; most common
SSE	Server-Sent Events	Remote HTTP streaming communication

---

14. Verdict: worth learning now?

Yes. Even if you don’t write your own Server yet, understanding MCP helps you:

• Configure Cursor / Claude Desktop extensions more safely
• Align with your team on architecture language for “how AI connects to internal systems”
• Judge when to use MCP vs traditional APIs

Suggested path:

1. Today: add a filesystem or GitHub Server in Cursor
2. This week: read one official Server’s source and see how Tools are defined
3. When needed: read MCP server deployment in practice and run the Server in the cloud 24/7

Getting filesystem or GitHub Server wired up and watching the Agent call a tool once beats stacking definitions every time.

Further Reading

• MCP Server Deployment: Private AI Tool Gateway on Cloud Mac mini M4 →
• Multi-Agent Architecture: 4 Patterns in Production →
• AI Coding Stack: Cursor + Agent + OpenClaw →

FAQ

How is MCP fundamentally different from a REST API?

REST is a fixed menu—you must know every endpoint upfront. MCP discovers available tools at runtime and then picks one, so Agents gain new capabilities without code changes.

Can I use MCP without writing code?

Yes. In Cursor or Claude Desktop, add off-the-shelf servers (filesystem, GitHub, Notion) and describe tasks in plain language. You only need code when building private tools.

Is MCP safe? Can AI delete files on my machine?

Risk depends on which servers you enable and how wide permissions are. Restrict filesystem to specific folders; in production use dedicated accounts, least privilege, and audit logs. See the security checklist in the article.

Is MCP the same as ChatGPT plugins?

No. ChatGPT plugins are OpenAI-specific. MCP is an open protocol donated to the Agentic AI Foundation—consumed by Cursor, Claude Desktop, VS Code, and more, and you can self-host.

Do I need to understand AI Agents before learning MCP?

No. If you can chat and edit Cursor settings, you can follow this guide to get filesystem working. Agent orchestration comes later.