# Connecting tools with MCP > The Model Context Protocol is a standard way to expose tools and data to an agent through a server the agent's client connects to. This topic covers the server and client roles, the transports that connect them, the primitives a server or a client can offer, when a plain command-line tool is the better choice, what a tool costs in tokens, and the security consequences of connecting one. Page: https://schubergphilis.github.io/ai-training/topics/customizing-agents/mcp/ License: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/ *Customizing agents* ยท topic `customizing-agents/mcp` The Model Context Protocol is a standard way to expose tools and data to an agent through a server the agent's client connects to. This topic covers the server and client roles, the transports that connect them, the primitives a server or a client can offer, when a plain command-line tool is the better choice, what a tool costs in tokens, and the security consequences of connecting one. ## Concepts - **Server**: The process that exposes tools, resources and prompts over the protocol. A server wraps something, a database, an API, a file system, a browser, and describes each tool with a name, a purpose and a parameter schema the model can read. Write or install a server once and any compliant agent can use it, which is the protocol's point. [glossary](https://schubergphilis.github.io/ai-training/glossary/#server) - **Client**: The side inside the agent application that connects to servers, lists the tools they offer, passes those descriptions to the model, executes the model's tool calls against the right server and returns results. The client and the host application around it hold the connection configuration, the approval prompts and the permission checks, so they are where a user controls what a server may do. [glossary](https://schubergphilis.github.io/ai-training/glossary/#client) - **Transport**: How client and server exchange messages. A local server usually runs as a child process talking over standard input and output. A remote one is reached over HTTP, often with streaming. The transport decides where the server's code runs and what credentials it holds, which makes it a security decision as much as a plumbing one. [glossary](https://schubergphilis.github.io/ai-training/glossary/#transport) - **MCP primitives**: The features a server or a client can offer. In revision 2026-07-28, a server offers tools the model calls, resources with a URI that the user or the model reads as context, and prompts the user picks by name. A client can offer elicitation, so a server can ask the user for more input. That revision deprecates roots and sampling. Roots name the directories a client finds relevant, and the protocol doesn't enforce them. Sampling lets a server ask the client's model for a completion. [glossary](https://schubergphilis.github.io/ai-training/glossary/#mcp-primitives) - **MCP vs CLI**: An agent can often reach the same system through a protocol server or by running a command-line tool it already knows. A server gives typed tools, discoverability and a stable interface across agents. A CLI is already installed, costs no tool descriptions in context and is easy to audit. Prefer the CLI when it exists and is good. Add a server when the interface needs shaping. [glossary](https://schubergphilis.github.io/ai-training/glossary/#mcp-vs-cli) - **Tool cost**: Every connected tool adds to the context on every turn. Without tool search that is its full description. With tool search, which Claude Code uses by default, only the tool's name and its server's instructions load until the model searches for the tool. Every call adds its result, and verbose results crowd out the conversation. Connect only the servers a project needs, prefer servers with few well-described tools, and watch result sizes. [glossary](https://schubergphilis.github.io/ai-training/glossary/#tool-cost) - **MCP security**: Connecting a server lets the agent reach everything the server can reach. Risks include servers from untrusted sources, tool descriptions that carry injected instructions, tools that return attacker-controlled content, and tools that can send data outward. Vet the source, run with least privilege, approve risky tools per call and review what leaves. Connect a server with your own identity, never with a shared service account, so it can do only what you may do and its actions trace back to you. [glossary](https://schubergphilis.github.io/ai-training/glossary/#mcp-security) - **Stdio logging**: On the transport over standard input and output, the server's standard output carries protocol messages only, and the specification forbids writing anything else there. A stray print statement or a library's log line corrupts the message stream, and the client fails in ways that are hard to trace. Logs go to standard error, which the client may capture, show or ignore, and which it does not treat as a sign of failure. [glossary](https://schubergphilis.github.io/ai-training/glossary/#stdio-logging) ## Links - **Builds on:** [Project instructions](https://schubergphilis.github.io/ai-training/topics/customizing-agents/instructions/), [What an agent is](https://schubergphilis.github.io/ai-training/topics/concepts/what-is-an-agent/) - **Leads to:** [Guardrails and production](https://schubergphilis.github.io/ai-training/topics/building-agents/production/) - **Competencies drawing on it:** [Runs an agent in production with guardrails](https://schubergphilis.github.io/ai-training/competencies/building-agents/runs-in-production/), [Connects an agent to tools and data safely](https://schubergphilis.github.io/ai-training/competencies/customizing-agents/connects-tools-safely/) ## Lessons - [Logging from a stdio server](https://schubergphilis.github.io/ai-training/customizing-agents/logging-from-a-stdio-server/) (tutorial) - [Connecting an agent to your systems with MCP](https://schubergphilis.github.io/ai-training/customizing-agents/mcp/) (explanation) - [Connecting your first tool server](https://schubergphilis.github.io/ai-training/customizing-agents/mcp-first-server/) (tutorial) - [Hardening a tool connection](https://schubergphilis.github.io/ai-training/customizing-agents/mcp-hardening/) (tutorial) - [Measuring what a tool server costs](https://schubergphilis.github.io/ai-training/customizing-agents/mcp-tool-cost/) (tutorial) ## Sources - `AEC-14` [Agent protocols, MCP and A2A](https://lsimons.github.io/agent-engineer-course/14-agent-protocols-mcp-and-a2a/), Agent Engineer Course (course) - `AEC-16` [MCP deep dive: MCP versus CLI, security failure modes, token cost](https://lsimons.github.io/agent-engineer-course/16-mcp-deep-dive/), Agent Engineer Course (course) - `DLAI-9` [MCP: Build Rich-Context AI Apps with Anthropic](https://www.deeplearning.ai/courses/mcp-build-rich-context-ai-apps-with-anthropic), DeepLearning.AI (course) - `Academy introduction-to-model-context-protocol` [Introduction to Model Context Protocol](https://academy.claude.com/courses/introduction-to-model-context-protocol), Claude Academy (course) - `Academy model-context-protocol-advanced-topics` [Model Context Protocol: Advanced topics](https://academy.claude.com/courses/model-context-protocol-advanced-topics), Claude Academy (course) - `Academy claude-code-101` [Claude Code 101](https://academy.claude.com/courses/claude-code-101), Claude Academy (course) - `Invariant tool poisoning` [MCP Security Notification: Tool Poisoning Attacks](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks), Invariant Labs blog (reference) - `MCP specification` [Model Context Protocol specification 2026-07-28](https://modelcontextprotocol.io/specification/2026-07-28), modelcontextprotocol.io (reference) - `MCP deprecated features` [Deprecated Features, Model Context Protocol specification 2026-07-28](https://modelcontextprotocol.io/specification/2026-07-28/deprecated), modelcontextprotocol.io (reference) - `Claude Code mcp` [Connect Claude Code to tools via MCP](https://code.claude.com/docs/en/mcp), Claude Code documentation (reference) - `Claude Code costs` [Manage costs effectively](https://code.claude.com/docs/en/costs), Claude Code documentation (reference)