Model Context Protocol
Core Facts
When connecting to multiple MCP servers simultaneously, tool descriptions alone can consume thousands or even tens of thousands of tokens.
MCP采用客户端-服务器架构，基于标准化的JSON-RPC通信协议
Anthropic launched MCP (Model Context Protocol) at the end of 2024, an open standard designed to standardize the way AI models interact with external tools and data sources.
Timeline (last 90 days)
When using MCP, developers only need to wrap the API into a lightweight Node service, and it can be called by all MCP-ready applications, with no need to rewrite Slack, GitHub, and database integrations for each AI application.
The Obsidian MCP server runs as a local process on the user's computer, reads files directly from the file system, communicates with AI tools via stdio, requires no network access, and requires no API key configured for the vault.
When using the MCP mode, AI applications (such as Claude) do not touch the user's Instagram login information, and only connect to the MCP server and discover its capabilities.
In MCP, JSON schema is used to describe tool input parameters; the host can use it to automatically generate call forms, validate parameters or reject invalid parameters in advance, but it does not constrain whether a tool should be called or whether a call is authorized.
"Read-only" in a prompt is not a permission boundary; both the CLI and the local MCP server need platform-level constraints enforced on the execution environment, filesystem, network, and resource limits.
A static bearer token left over in the MCP configuration of a development laptop is the most common starting point of failure; the way to handle it is to rotate immediately, migrate to short-lived OAuth and revoke the old token in the IdP/SAP.
The security review for an AI Agent connecting to an SAP system should follow a specific order of checks: the Agent service account identity and least-privilege SAP roles; a default read-only tool allowlist with write as the exception; network paths and separated DEV/PRD MCP endpoints; secret storage, token lifecycle and rotation owner; log/SIEM evidence with sample correlated events; a disable/rollback drill within 15 minutes; and a signed use case scope with explicit non-goals.
Sharing one MCP URL between DEV and PRD is a dangerous practice; endpoints should be split, DNS and certificates confirmed, and it should fail closed when the target environment is wrong.
In SAP scenarios, security responsibility is shared among three parties: SAP is responsible for core system security and the foundational authorization framework, the MCP implementer is responsible for protocol-layer security and message validation, and the enterprise itself bears application-layer access control, data classification, business rule validation, and monitoring and alerting.
OpenZeppelin MCP Agent combines security auditing capabilities with the Model Context Protocol, enabling AI models to invoke contract security checking tools in a standardized manner.
40 more timeline events
All Facts (20)
When connecting to multiple MCP servers simultaneously, tool descriptions alone can consume thousands or even tens of thousands of tokens.
90%VerifiedMCP采用客户端-服务器架构，基于标准化的JSON-RPC通信协议
90%VerifiedAnthropic launched MCP (Model Context Protocol) at the end of 2024, an open standard designed to standardize the way AI models interact with external tools and data sources.
90%VerifiedIn MCP, Tools are invoked at the model's discretion, Prompts are triggered by the user, and Resources are controlled by the application.
80%VerifiedMCP采用客户端-服务器架构，AI编程工具作为MCP客户端，外部服务作为MCP服务器
80%VerifiedMCP基于JSON-RPC 2.0协议构建，支持请求-响应和通知两种消息模式
80%VerifiedThe Model Context Protocol (MCP) is an open protocol officially open-sourced and released by Anthropic in November 2024.
80%VerifiedMCP (Model Context Protocol) is an open standard protocol released by Anthropic in late 2024 that defines a unified communication specification between AI models and external tools and data sources.
80%VerifiedMCP（Model Context Protocol）是由 Anthropic 于2024年底提出并开源的标准化协议，旨在让 AI 模型与外部工具、数据源之间的交互有统一的接口规范
80%VerifiedMCP addresses the connectivity problem (how a model reaches tools), while Skill addresses the usage problem (when and with what strategy the model combines tools).
75%VerifiedIn MCP's security design, tool invocations are stipulated to require explicit user authorization, and resource access is constrained by permission boundaries.
65%VerifiedA malicious MCP Server can declare a legitimate tool name and embed prompt injection instructions in the description field; this type of attack is known as "Tool Poisoning."
65%VerifiedDuring the reasoning process, an MCP Agent autonomously decides whether to call a tool, which tool to call, and what parameters to pass in through its Function Calling capability, and the entire process is multi-turn and iterative.
65%UnverifiedMCP主要解决的是Agent与工具/数据源的连接问题，而非Agent-to-Agent实时通信
90%UnverifiedMCP Atlas基于Anthropic提出的Model Context Protocol设计，测量模型在标准化工具调用协议下的Agent执行能力
85%UnverifiedThe MCP authorization specification emphasizes token audience validation, requiring MCP servers to verify that a token was indeed issued to themselves in order to prevent confused deputy attacks.
60%UnverifiedOpen standards such as Model Context Protocol (MCP) are attempting to alleviate platform lock-in issues in the AI Agent space, but the industry has yet to form a unified Agent interoperability standard.
60%UnverifiedWhen using MCP, developers only need to wrap the API into a lightweight Node service, and it can be called by all MCP-ready applications, with no need to rewrite Slack, GitHub, and database integrations for each AI application.
50%UnverifiedThe Obsidian MCP server runs as a local process on the user's computer, reads files directly from the file system, communicates with AI tools via stdio, requires no network access, and requires no API key configured for the vault.
50%UnverifiedWhen using the MCP mode, AI applications (such as Claude) do not touch the user's Instagram login information, and only connect to the MCP server and discover its capabilities.
50%