WTF is an MCP server?

Short version

An MCP server plugs outside tools and data into an AI agent, and those tools can do real things.

MCP: Model Context Protocol, an open-source standard for connecting AI applications to external systems. Its docs call it a USB-C port for AI applications.
Server: The program on the other end. It offers tools the AI can invoke, resources it can read and prompt templates. It can run on your machine or remotely.
The spec's warning: Tools represent arbitrary code execution, and hosts must get explicit user consent before invoking one.
The catch: MCP cannot enforce that at the protocol level, so it comes down to each app.
Local servers: MCP security guidance says they are binaries downloaded and executed on the same machine as the client, and lists arbitrary code execution and data exfiltration among the risks.
Tool poisoning: OWASP: malicious instructions hidden in tool descriptions or return values.
Rug pull: OWASP: a server changing its tool definitions after you approved them.

Tool poisoning in example-mcp-server 1.2.0: hidden instructions in a tool description.

You approved a tool and got its orders too. Tool text can carry prompt injection straight to your agent.

Example only. The product, versions and names are made up.

Know who publishes it. Installing one is closer to running a stranger's program than adding a bookmark.
Read the exact command before you approve it.
Do not assume a tool you approved yesterday is the same tool today.
Treat tool descriptions and responses as untrusted. The spec and OWASP both say so.