# What Is MCP? — The Model Context Protocol, Explained

Canonical: https://commareports.com/glossary/model-context-protocol
Published: 2026-09-11

> MCP is an open protocol for giving AI agents tools, resources and prompts over a standard interface. What a server exposes, how transports work, and what changes when an agent can publish.

# Model Context Protocol

**MCP is an open protocol, introduced by Anthropic in late 2024, that
standardises how AI applications connect to external systems.** A client
— an agent, an editor, a desktop app — speaks JSON-RPC to an MCP server,
which advertises what it can do.

Before it, every integration was bespoke: one adapter per agent per
service. MCP makes the service implement one interface and every
compliant client gets it.

## The three primitives

| Primitive     | Who decides to use it | Shape                                      |
| ------------- | --------------------- | ------------------------------------------ |
| **Tools**     | The model             | Named function + JSON input schema         |
| **Resources** | The client            | Readable data pulled in as context         |
| **Prompts**   | The user              | A reusable template, often a slash command |

The distinction matters for design. A tool is something the agent may
call on its own initiative, so its schema and description are effectively
prompt text. A resource is something the client fetches deliberately.

## Transports

- **stdio** — the client launches the server as a subprocess and talks
  over standard input and output. Local, no network, no auth beyond
  process boundaries.
- **Streamable HTTP** — a remote server over HTTP, with streaming
  responses. This is what a hosted service exposes.

Same protocol, different framing.

## Authorisation is the server's business

MCP does not invent an auth model. A remote server applies whatever it
already applies: a bearer token per user, with the same expiry,
revocation, scope and rate-limit rules as its REST API.

That is the right shape for agents specifically, because an agent is
software you are handing a credential to. A token that is
scoped to publishing, revocable in one click, and rate-limited per token
is a very different risk from a session cookie
([scoped tokens for AI agents](/agents/scoped-tokens-for-ai-agents)).

## What this changes for reports

An agent that finishes a long task has output. Pasting it back into the
chat is the default, and it is the wrong shape: chat has a message
ceiling, no formatting beyond markdown, no place for anyone else to
respond, and it scrolls away
([the agent's output is too long to paste](/fix/agent-output-too-long-to-paste)).

With an MCP server for publishing, the agent creates a report as a normal
step in its run and returns a URL. The artifact outlives the session, has
an address a teammate can open, and can be commented on — and the agent
can read those comments back on the next run and act on them
([let an agent respond to comments](/agents/let-an-agent-respond-to-comments)).

Comma's MCP server wraps the same surface as the REST API, authenticated
with the same `comma_sk_…` tokens, so scope, revocation and rate limits
behave identically either way.

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Set up the MCP server →](/mcp)**

### Related

- [MCP setup](/mcp) · [Claude Code](/mcp/claude-code) · [Cursor](/mcp/cursor) · [VS Code](/mcp/vscode)
- [Agent artifact](/glossary/agent-artifact) · [Where should my agent post?](/agents/where-should-my-agent-post)
- [Agent guides](/agents) · [Glossary](/glossary)