- An MCP server is a service that exposes tools, data, and actions to AI agents through the Model Context Protocol (MCP), an open standard for connecting AI systems to external resources.
- MCP replaces one-off custom integrations with a single, reusable communication layer, letting any compatible AI client discover and invoke capabilities at runtime.
- An MCP deployment has three roles: host, client, and server, each with a distinct job and a distinct trust boundary.
- MCP servers introduce access control questions security teams need to plan for, since the server mediates every action an agent takes on a backend system.
- As agentic AI deployments accelerate, MCP is becoming a foundational layer for how AI agents interact with enterprise systems.
What Is an MCP Server?
An MCP server is a service that implements the Model Context Protocol, exposing a defined set of tools, resources, and actions that AI agents can discover and invoke through a standardized interface. Rather than requiring custom code for every system an AI needs to reach, an MCP server acts as a governed bridge between an AI client and one or more backend services. The AI client connects, learns what the server can do, and calls approved capabilities without needing direct access to the underlying system.
The Model Context Protocol is an open standard built on JSON-RPC 2.0 messaging. It drew on existing concepts like function calling and tool use, but formalized them into a single communication specification. Any AI application can implement it once and then connect to any compliant server, regardless of what backend that server wraps.
MCP matters now because enterprise AI deployments are entering a second phase. Early adoption centered on chat interfaces, but the current wave involves agents, meaning autonomous programs that take actions, call tools, and move data across systems without a human approving every step. MCP is the plumbing that makes those connections possible at scale.
How MCP Servers Work
An MCP deployment has four architectural components.
- MCP host: The application or environment that contains the large language model (LLM) and serves as the user interaction point.
- MCP client: A component within the host that translates model requests into MCP-formatted calls and returns results to the model.
- MCP server: The external service that wraps one or more backend systems, declares available tools and resources, handles backend authentication, and returns structured results.
- Transport layer: The communication channel between client and server, using JSON-RPC 2.0 messaging. Standard input/output (stdio) serves local, low-latency connections; Server-Sent Events (SSE) over HTTP serves remote or multi-client deployments.
The Request Lifecycle
The AI client first sends a discovery request, the server returns a schema of available tools, the client invokes the chosen tool, and the server validates the request, queries the backend, and returns a structured result. The AI model never touches the backend directly. All access is mediated through the server, which is where permissions, filtering, and logging should be enforced.
Servers expose three capability types:
- Tools, or actions the AI can trigger
- Resources, or data the AI can read
- Prompts, or predefined instruction templates
MCP Server Examples and Common Use Cases
MCP servers exist for a wide range of enterprise systems. The most common implementations connect AI agents to the tools employees already use.
| MCP server type | Backend system | Typical actions exposed |
|---|---|---|
| Source control | Git repositories | Read files, create branches, open pull requests |
| Databases | PostgreSQL, SQL Server | Run approved queries, fetch schema metadata |
| Productivity suites | Google Drive, SharePoint | Read documents, list folder contents |
| Project management | Jira, Linear, Notion | Create and update tickets, read project status |
| Communication | Slack, Teams | Post messages, retrieve channel history |
| Cloud infrastructure | Kubernetes, AWS | Check resource status, read logs |
| CRM and ERP | Salesforce, SAP | Look up records, trigger approved workflows |
A growing number of vendors also ship an MCP server for their own platform. Identity and security vendors, for example, expose MCP servers so an agent can query access records, entitlements, or alerts directly instead of going through a separate API integration for each one. A single AI agent configured with multiple MCP servers can orchestrate work across systems that previously required separate integrations and credentials for each.
MCP Server vs. API: Key Differences
Security and architecture teams often ask how MCP servers relate to conventional APIs. The distinction matters for access control design.
A traditional REST or GraphQL API is built for human developers and machine-to-machine integration. Its endpoints are fixed, authentication is typically static (API keys or OAuth tokens), and the calling application must know in advance what endpoints exist.
An MCP server is built for AI agents. Its defining characteristic is dynamic tool discovery, as an AI client can ask a server at runtime what it can do, learn the schema for each capability, and invoke the appropriate tool without any prior hardcoded knowledge. MCP also standardizes per-request, server-mediated authentication, multi-step agent workflows, and centralized audit logging in ways conventional APIs leave to each implementer.
The implication is consolidation. MCP servers collapse what were formerly many discrete API integrations into a single governed layer. That is an opportunity, as it creates a natural enforcement point. It is also a risk if that enforcement point is poorly designed.
MCP Server vs. MCP Client: Key Differences
The server and the client sit on opposite sides of the same connection, and the distinction is a common point of confusion.
The MCP server is the component that holds the connection to a real backend system. It defines which tools exist, authenticates to the underlying service, and executes the requested action. The server is where credentials live and where permissions should be enforced.
The MCP client is the connector inside the AI host, such as a chat assistant or a development tool, that maintains a session with one specific server. Each client instance connects to exactly one server; a host application that needs to reach multiple backend systems runs one client per server. The client's job is to format the model's requests into valid MCP calls and return results to the model.
In short, the server exposes capabilities, and the client consumes them on behalf of the model. Because the client and server can be built and operated by different parties, an organization can build its own client while connecting to servers from third-party vendors, internal teams, or the open-source ecosystem.
Security Considerations for MCP Servers
Because an MCP server mediates every action an agent takes, it also functions as an access control boundary. If a server grants a tool broader permissions than the task requires, or fails to verify who is asking, that gap becomes a path into enterprise data that conventional network-based tools were not built to see.
A few considerations stand out for any team deploying or evaluating MCP servers:
- Permission scope matters as much as functionality
Applying the principle of least privilege means a tool that reads records should not also be able to write or delete them by default. - Data movement through an MCP server can bypass traditional DLP
When sensitive data enters an AI pipeline through a tool call, that movement may leave no trace in conventional monitoring, and a malicious tool response can carry a prompt injection payload the model treats as trusted context. - Unmanaged servers are a discovery problem before they are a policy problem Employee-installed MCP connections are a form of shadow IT, and security teams need to know which servers are running in their environment before they can govern them.
- Every tool call should leave a record
An audit log tying each request to an identity, a tool, and a data source is the foundation of any incident investigation.
These considerations are part of the broader discipline of MCP security, which covers the full risk landscape, from tool poisoning to credential theft, along with the controls that address each one.
How Cyberhaven Addresses MCP Server Visibility
MCP servers create a category of data movement that most existing security tools were not designed to observe. When an agent makes a tool call and sensitive data flows into the model's context and then out through the model's actions, that movement is invisible to conventional network-based DLP and cloud access security tools.
Cyberhaven addresses this through a unified data security platform that combines Data Lineage and AI Security to track data origin, movement, and transformation across AI interactions at the endpoint level. When an agent on an employee's device invokes an MCP server and retrieves sensitive content, Cyberhaven reconstructs the full execution lifecycle: which tool was called, what data was accessed, and where it traveled next.
Cyberhaven also maintains a continuous inventory of AI agents across endpoints, including locally installed agents operating through MCP connections that are invisible to cloud-based controls. Runtime data flow guardrails enforce policy at the moment of execution, blocking or warning when an agent attempts to move sensitive data outside approved boundaries.
Frequently Asked Questions
What is an MCP server?
An MCP server is a service that implements the Model Context Protocol, wrapping one or more backend systems and exposing their capabilities as structured tools, resources, or prompts that AI agents can discover and invoke at runtime. It acts as a governed access layer between an AI client and external systems, mediating authentication, filtering responses, and providing a standardized interface any MCP-compatible AI system can use.
How is an MCP server different from a normal API?
The key difference is dynamic tool discovery. A conventional API requires the calling application to know in advance what endpoints exist. An MCP server advertises its capabilities at runtime through a structured schema, so AI agents can discover available actions without prior hardcoded knowledge. MCP also standardizes multi-step workflows and authentication mediation in ways conventional APIs leave to each implementer.
What is the difference between an MCP server and an MCP client?
The MCP server holds the connection to the backend system, defines available tools, and executes requested actions. The MCP client sits inside the AI host application and maintains the session with one specific server, translating the model's requests into MCP calls. A host that needs to reach several systems runs one client per server it connects to.
Does an MCP server replace a RAG system?
MCP and retrieval-augmented generation (RAG) are not direct substitutes. RAG retrieves relevant content from a knowledge base to augment a model's prompt before generation. MCP enables active, two-way interaction where an AI can invoke tools and retrieve structured data at any point during a task. Many deployments use both: RAG for document-grounded question answering and MCP for task execution involving live systems.
What security risks should teams know about with MCP servers?
Because an MCP server mediates every action an agent takes, over-permissioned tools, weak per-user authentication, and missing audit trails are the most common gaps. These risks, along with prompt injection, tool poisoning, and credential theft, are covered in depth in Cyberhaven's guide to MCP security.
.avif)
.avif)
