speak the language

The MCP glossary

47 terms, defined in plain language, with spec-version notes where they matter. Every term is tagged protocol, building, transports & auth, security, or ecosystem — type a word or a tag to filter.

.mcp.json: Claude Code’s project-scoped server config, committed to the repo so the whole team gets the same servers. Supports ${VAR} expansion, so no secrets land in git. Config templates →
AAIF (Agentic AI Foundation): The Linux Foundation body that has governed MCP since December 2025, co-founded by Anthropic, Block, and OpenAI, with Google, Microsoft, AWS, and Cloudflare as members. The reason "one vendor controls MCP" is out of date.
Authorization server: The system that authenticates users and issues tokens — Auth0, Okta, Keycloak, or your IdP. Kept deliberately separate from your MCP server so you never build login flows yourself.
Capability negotiation: During initialization, each side declares what it supports — tools, resources, sampling, elicitation — so both sides only use features the other understands.
claude_desktop_config.json: Claude Desktop’s server config — an mcpServers map at ~/Library/Application Support/Claude/ (macOS) or %AppData%\Claude\ (Windows). Absolute paths only; secrets go in each entry’s env block.
Client: The protocol-speaking component inside a host that holds a one-to-one connection with a single server. One host typically runs many clients, one per configured server.
Client ID Metadata Documents: The spec 2025-11-25 alternative to dynamic client registration: the client’s HTTPS URL is its ID, and the authorization server fetches its metadata from that URL.
Confused deputy: An MCP server tricked into using its own authority on an attacker’s behalf — classically via OAuth proxy flows. Mitigations the spec requires: per-client consent and exact redirect-URI matching. Full threat model →
Dynamic client registration: Lets a client register itself with an authorization server on the fly instead of being pre-provisioned — essential when thousands of independent MCP clients exist. ChatGPT connectors rely on it.
Elicitation: A server pausing mid-operation to ask the user for structured input ("which environment?"). Added in spec 2025-06-18; 2025-11-25 added a URL mode for handing the user to a browser flow.
EMA (Enterprise-Managed Authorization): The extension (stable July 2026, driven by Anthropic, Microsoft, and Okta) that routes MCP access through your company IdP — SSO for servers, with IT able to grant and revoke centrally. Org-wide rollout →
Extensions: The framework arriving with the 2026-07-28 release candidate for standardized optional add-ons — MCP Apps and Enterprise-Managed Authorization are the flagship examples — so the core spec stays small.
FastMCP: The decorator-style Python API — @mcp.tool() on a typed function and the schema is derived for you. FastMCP 1.0 ships inside the official mcp SDK; FastMCP 2.x (gofastmcp.com) is a separate, larger community framework. Untangle the naming →
Host: The AI application the user actually runs — Claude Desktop, Cursor, VS Code. The host creates and manages one client per server connection and owns all user consent.
Initialize handshake: The first exchange on every connection: client and server agree a protocol version and swap capabilities before anything else. The 2026-07-28 release candidate removes it in favour of a stateless core.
JSON-RPC: The wire format under every MCP message: JSON-RPC 2.0 requests, responses, and notifications. Spec 2025-06-18 removed batching, so one message per line/request.
MCP (Model Context Protocol): The open standard that connects AI applications to external tools, data, and prompts over JSON-RPC. Write one server; every compliant client — Claude, ChatGPT, Cursor, VS Code — can use it. Plain-English explainer →
MCP Apps: An official extension letting servers deliver interactive UI (forms, dashboards) rendered inside the host, instead of text-only results. Part of the 2026-07-28 direction.
MCP Inspector: The official browser-based test harness: npx @modelcontextprotocol/inspector <command> launches your server and lets you list and call tools interactively — no install, no client config. Your first stop for every bug. Debugging workflow →
mcp-publisher: The CLI that validates your server.json, verifies namespace ownership (e.g. via GitHub), and publishes your server to the registry.
Notifications: One-way JSON-RPC messages needing no reply — most usefully notifications/tools/list_changed, which tells the client to re-fetch your tool list when it changes at runtime.
OAuth 2.1: The authorization framework MCP standardizes on for remote servers: users grant access through a browser flow instead of pasting API keys into configs. Required by clients like ChatGPT connectors. Add auth step by step →
Official SDKs: Maintained in tiers: TypeScript, Python, C#, and Go are Tier 1; Java and Rust Tier 2; Swift, Ruby, PHP, and Kotlin Tier 3. Python (mcp on PyPI, stable 1.28.1) and TypeScript (@modelcontextprotocol/sdk, 1.29.0) have the richest docs.
Output schema: The optional outputSchema a tool declares so clients can validate its structured results, mirroring how inputSchema constrains arguments. JSON Schema 2020-12 is the default dialect as of spec 2025-11-25.
Primitive: One of the core capability types MCP defines: tools, resources, and prompts on the server side; sampling, elicitation, and roots on the client side. The three server primitives →
Prompt (MCP prompt): A user-controlled, reusable message template a server offers — surfaced as slash commands in many clients. The user invokes it explicitly; the model never triggers it.
Protected resource metadata (RFC 9728): A well-known metadata document your server publishes telling clients which authorization server protects it — how clients bootstrap the whole OAuth flow automatically.
Registry: The official server catalog at registry.modelcontextprotocol.io — live but labelled preview. It feeds aggregators and marketplaces rather than being something hosts consume directly.
Resource: Application-controlled, read-only data a server exposes under a URI — file contents, records, schemas. The host or user chooses when to attach it as context.
Resource indicators (RFC 8707): The client names the exact server a token is for when requesting it, so a token minted for one MCP server cannot be replayed against another. Mandatory in the MCP auth model.
Resource server: The OAuth role your MCP server plays as of spec 2025-06-18: it validates access tokens issued by an external authorization server, and never issues tokens itself.
Roots: Directories the client tells a server it is allowed to work within — a soft filesystem boundary, not a sandbox. Deprecated by the 2026-07-28 release candidate.
Sampling: A server asking the client to run an LLM completion on its behalf, keeping the user in control of model choice and cost. Spec 2025-11-25 added tool calling inside sampling; the 2026-07-28 RC deprecates the feature with a 12-month window.
Server: The program you write: it exposes tools, resources, and prompts over MCP. It can be a 20-line local script on stdio or a hosted service behind OAuth. Build one →
server.json: The manifest describing your server for the registry: name in reverse-DNS form (io.github.you/server), install packages, and remote endpoints.
Session hijacking: Guessing or stealing an Mcp-Session-Id to impersonate another user’s connection. The rule that prevents it: sessions are not authentication — authorize every request, not just the first.
SSE (deprecated transport): The original remote transport (protocol 2024-11-05) with its separate /sse endpoint — deprecated since 2025-03-26 in favour of Streamable HTTP. Confusingly, Streamable HTTP may still use SSE internally to stream; only the old transport is dead.
Stateless core: The 2026-07-28 release candidate’s headline change: no initialize handshake, no Mcp-Session-Id — every request self-describing. Makes servers trivially load-balanced and serverless-friendly.
stdio: The local transport: the client launches your server as a subprocess and speaks JSON-RPC over stdin/stdout. Golden rule — never print to stdout; one stray print corrupts the stream. Log to stderr.
Streamable HTTP: The remote transport since spec 2025-03-26: a single HTTP endpoint that can answer with plain JSON or stream via SSE. Replaces the deprecated HTTP+SSE transport and is what hosted, multi-user servers use.
Structured tool output: A tool returning machine-readable JSON in structuredContent alongside the human-readable text block. Added in spec 2025-06-18 so downstream code can parse results without regex.
Tasks: The experimental primitive for long-running, resumable work introduced in spec 2025-11-25 — call, disconnect, poll for the result later. Redesigned in the 2026-07-28 release candidate.
Token passthrough: The forbidden anti-pattern of a server accepting or forwarding tokens that were not issued for it. The spec is blunt: validate audience, and reject any token not minted for your server.
Tool: A model-controlled function a server exposes — the model decides when to call it, the host enforces consent. Defined by a name, description, and JSON Schema input. When to use which →
Tool annotations: Hints on a tool like readOnlyHint and destructiveHint that help clients decide how much confirmation to require (spec 2025-03-26). They are untrusted metadata — never a security control.
Tool poisoning: Malicious instructions hidden inside a tool’s description or output that the model dutifully follows — the signature MCP attack. Defend by vetting servers, pinning versions, and reviewing tool descriptions like code. Harden your setup →
Transport: How MCP messages physically move between client and server. Two current options: stdio for local subprocesses, Streamable HTTP for anything remote or shared. Which to use →