What an MCP server does—and what it does not do
An MCP server implements protocol methods that let a compatible client discover its identity and capabilities and use its primitives. A database server may expose a query tool, a schema resource, and a prompt with safe query examples. A repository server may expose issue and pull-request operations. The capability remains owned by the server and its downstream service.
An MCP server is not automatically an AI agent, a model, a security sandbox, or proof that an integration works. The host may use an LLM to select a tool, but it is responsible for deciding which capabilities enter the model context and how user approval is handled.
How the connection works
The host creates a dedicated MCP client for each configured server. The participants exchange protocol-version and capability information, the client discovers available primitives, and the host builds an available capability set. When a tool is selected, the client sends a structured call and returns the server's content to the host.
Current MCP architecture documentation uses a discovery exchange and per-request metadata. Older tutorials may show earlier initialization flows. Always match the server SDK and client documentation to the protocol version you are actually deploying.
Local stdio and remote Streamable HTTP
With stdio, the client launches the server as a subprocess and exchanges protocol messages through standard input and output. This is common for local file, developer, and database integrations. The process runs with the client's operating-system privileges unless an external sandbox or permission boundary restricts it.
With Streamable HTTP, the server runs independently and can serve remote clients. It can use standard HTTP authentication patterns, including OAuth. Remote does not mean verified or safe: requests, context, and credentials may cross a network and operator boundary. Legacy SSE declarations still appear in clients and datasets, but new architecture should follow the current transport guidance.
Tools, resources, and prompts in one concrete example
Consider a customer-support integration. A refund-policy document can be a resource selected by the application. `lookup_order` can be a read-only tool with an order ID schema. `issue_refund` can be a separate consequential tool that requires a narrower credential and user confirmation. A `resolve_refund_case` prompt can package the recommended workflow without hiding those authority boundaries.
This separation matters. Content from a resource can be untrusted or stale; a tool can read or write; a prompt can influence how the model combines both. Describe control, permissions, freshness, and side effects instead of treating every primitive as a generic 'tool.'
How to choose a server using evidence
Start by resolving identity across the registry entry, publisher, package or endpoint, repository, and release. Then inspect maintenance, license, runnable entry, required runtime, credential scopes, tools exposed, downstream systems, and recent changes. Test the exact artifact in the exact client with a non-destructive task before production use.
MCP Radar's TrustScore summarizes public maintenance, adoption, usability, health, and community signals. It helps screen candidates; it does not certify security, correctness, data handling, endpoint reachability, or suitability for your account. A derived compatibility label means the transport appears compatible, not that a real client tool call succeeded.
How to set up an MCP server
First choose the client and trust scope: personal current project, shared project, or personal global. For a local server, verify the launch command and arguments and restrict its files, network, and credentials. For a remote server, verify the endpoint operator, HTTPS, auth flow, requested scopes, and data handling.
Then verify four gates independently: the configuration parses; the process or endpoint is reachable; primitive discovery succeeds; and one read-only or reversible operation returns the expected result. Save the server identity, version, config shape, evidence basis, and test date so the integration can be reviewed after an update.
Are MCP servers free?
The protocol itself is an open standard and does not charge a fee. A server implementation may be open source, commercial, or both. Costs can come from a hosted MCP plan, the downstream API, database or SaaS account, network/compute, and the engineering needed to secure and operate it.
Do not infer free usage from a public repository. Check the server's current license and pricing, then check every upstream service and quota it uses. Local execution can avoid a hosting subscription while still incurring API, infrastructure, and maintenance costs.