AI Knowledge Center 🎓 Exam Prep
Extend Tools model-invoked GA open standard · 2024-11-25 ⓘ legend

MCP

An open standard for connecting AI tools to external systems. An MCP server gives Claude new tools, resources, and prompts so it can read and act on systems directly instead of you pasting data in.

Analogy — MCP is a universal power socket (USB-C) for tools. Instead of a custom adapter per device, every system that speaks MCP plugs into any client that speaks MCP — solving the “N×M” integration problem. If a skill is know-how, MCP is a hand.

Mechanism

An MCP client (Claude Code) connects to one or more servers, each exposing three primitives:

Tools

Actions Claude can call (model-invoked).

Resources

Data referenced with @server:protocol://path (user-invoked).

Prompts

Surfaced as /mcp__server__name slash commands.

Transports & install

HTTP (recommended for remote; supports OAuth) · stdio (local process) · SSE (deprecated — use HTTP) · WebSocket (push events, header-auth only).

claude mcp add --transport http  <name> <url>
claude mcp add --transport stdio <name> -- <cmd> [args]
claude mcp list | get | remove

Tool Search (on by default): only tool names + server instructions load at start; Claude searches for tools on demand to keep context low (needs Sonnet 4+/Opus 4+). Mark a server alwaysLoad: true to keep its tools always in context.

Config scopes
ScopeShared?Stored in
Local (default)No~/.claude.json
ProjectYes (commit).mcp.json at repo root
UserNo~/.claude.json

Note: MCP “local scope” lives in ~/.claude.json, not .claude/settings.local.json.

When to reach for it

✓
You keep copying data into chat from a system Claude can’t see (Jira, Sentry, a DB, GitHub).
✓
You want Claude to act on an external system, not just read about it.

When not to

✕
The need is a procedure using tools Claude already has → a skill.
✕
You don’t trust the server — don’t connect it (see security).

Best practices

★
Use HTTP for remote (widest support + OAuth); treat SSE as deprecated.
★
Choose scope deliberately: Project (committed) for team servers; Local for anything carrying personal credentials.
★
Keep credentials out of config — use OAuth via /mcp or env-var expansion; secrets land in the OS keychain.
★
Pair with a skill that encodes how to use the server well.
Security — heightened vs skills MCP crosses an external trust boundary, so prompt injection is the headline risk: a server that fetches outside content can smuggle instructions. Docs: “verify you trust each server before connecting it.” Project-scoped servers require explicit approval; enterprises restrict via allowedMcpServers/deniedMcpServers.

Sources