MCP Protocol Explained: How AI Apps Connect to Tools

When you ask an AI app to find you the cheapest flight to Lisbon, it checks your calendar, searches 14 dates, monitors fares for two days straight, holds a seat, and asks you one question before final payment. From the moment you state your request to confirming payment, dozens of messages cross the network: requests, results, a task that runs for two days, permission checks, and a service quietly trying to get your passport number. All of it runs on one protocol — MCP.

What Is MCP and Why Do We Need It

MCP (Model Context Protocol) is an open protocol designed to standardize how AI applications connect to external tools and data sources. Before MCP, every AI app that needed to integrate with a calendar, search engine, or payment service had to build a custom integration, leading to duplicated effort and fragmentation. MCP provides a unified set of communication rules that let AI models discover, invoke, and coordinate external capabilities in a consistent way.

According to the video description, MCP supports the full flow from simple queries to multi-day tasks. It is not just an API call format; it defines the task lifecycle, permission boundaries, and message routing.

MCP was open-sourced by Anthropic in November 2024 and uses a client-server architecture: the AI application acts as the MCP client, while external tools or data sources expose their capabilities through MCP servers. The protocol exchanges messages over JSON-RPC 2.0 and defines three core primitives — Tools (invocable functions), Resources (readable data), and Prompts (reusable prompt templates). The transport layer supports both local stdio and remote HTTP/SSE. This layered design lets the same MCP server be reused by different AI applications without being tied to a specific model or vendor — which is precisely what sets it apart from proprietary plugin systems.

The Message Flow Behind a Single Flight Booking

The video uses the "find the cheapest flight" scenario to show how MCP works in practice. The AI app needs to: check the calendar (read the user's schedule), search 14 dates (multiple calls to the flight search tool), monitor fares for two days (a long-running task), hold a seat (a write operation), and confirm before payment (a permission request).

Throughout this process, MCP manages dozens of request and response messages. Each tool call carries context and permission information, ensuring the AI does not exceed its authority. Especially when money and privacy are involved, MCP's permission-checking mechanism becomes a critical line of defense.

Long-Running Tasks and Permission Control

Traditional API calls are usually short-lived and stateless, whereas AI agents may need to execute tasks spanning several days. The video mentions "a task that ran for two days," which requires the protocol to support state persistence, timeout management, and progress notifications. Through task identifiers and session mechanisms, MCP allows AI applications to coordinate multiple tools over long time spans.

Permission control is another core element. In the scenario, a connected service "quietly tries to get your passport number," and MCP's permission checks intercept such unauthorized access, allowing only data sharing the user has consented to. This fine-grained permission model is essential for building trustworthy AI agents.

In MCP's protocol semantics, a "long-running task" does not rely on a single persistent connection; instead, it associates multiple calls through a session identifier and request IDs. The client can maintain context state for multi-day tasks, while the server verifies the authorization scope of that session on each call. Since JSON-RPC itself is a stateless message format, state persistence is actually managed jointly by the client and server, and the protocol only specifies how messages are routed and correlated. This also means that mechanisms such as timeout retries and progress notifications must be implemented by tool developers on the server side — the protocol provides a coordination framework, not a built-in task scheduler.

Security Challenges and Design Trade-offs

MCP's openness brings convenience but also introduces risk. Third-party tools may request more permissions than necessary, or the AI model may misinterpret user intent and invoke sensitive operations. The passport number example in the video illustrates exactly this: the protocol must strike a balance between flexibility and security.

The MCP ecosystem is still evolving. Tool developers need to follow the principle of least privilege, and AI applications need to implement clear user confirmation flows. For enterprises, deploying MCP requires an additional audit and policy layer to monitor data flows across tools.

The principle of least privilege originates in the information security field and requires that each component be granted only the minimum access necessary to complete its task. In the MCP context, this means a flight search tool should not simultaneously have permission to read passport information, even if it could technically request it. MCP enforces this principle through capability declarations and user consent mechanisms: servers declare the tools they provide and the permissions they require at initialization, and clients show the user the scope of a request before invoking a sensitive tool. However, the protocol itself does not enforce policies; actual permission interception depends on the client implementation and the deployer's policy layer, which is one reason security practices vary across the current ecosystem.

Impact on AI Application Development

MCP lowers the barrier to integrating external tools into AI applications. Developers no longer need to write an adapter for every service; implementing an MCP client once connects them to a broad ecosystem. This is expected to accelerate AI agents' transition from demos to production, especially in scenarios requiring multi-step coordination such as travel, finance, and customer service.

However, MCP is not a silver bullet. It solves the problem of communication standardization, not the quality or security of the tools themselves. Application developers still need to conduct due diligence on each integrated tool and design good user experiences to manage permission requests.

Conclusion

As the "connection layer" between AI and tools, MCP is becoming infrastructure for agentic AI. The flight booking case shows that it handles complex issues such as message routing, long-running tasks, and permission checks. As the ecosystem matures, MCP is expected to enable more reliable AI applications to reach production, but security and permission design still require ongoing attention.

One-line Summary

Using a flight booking example, MCP shows how AI agents coordinate multiple tools, long-running tasks, and permission control through a standardized protocol.

Paragraph Summary

Using a multi-day flight booking scenario as a thread, the article introduces MCP (Model Context Protocol) as a standardized connection layer between AI applications and external tools. In this scenario, the AI needs to check the calendar, search 14 dates, monitor fares for two days straight, hold a seat, and ask for confirmation before payment, with dozens of messages transmitted via MCP. The article focuses on how MCP manages state persistence for long-running tasks, how fine-grained permission checks intercept unauthorized passport number access, and discusses the trade-offs an open protocol must make between flexibility and security. It concludes that MCP lowers the integration barrier and is expected to drive agentic AI adoption, but tool quality and security auditing still depend on developers themselves.