MCP Explained

MCP Explained teaches the Model Context Protocol by playing back the messages the protocol actually sends. MCP is the open standard Anthropic introduced in November 2024 for connecting AI apps to outside tools and data. Each of the site's 23 lessons draws the parties involved, such as the AI app, its MCP client, a server, the model and sometimes the user or a sign-in server, then steps through the JSON-RPC messages that pass between them, with notes on individual fields. The lessons are written against the 2025-11-25 version of the specification.

The point the lessons keep returning to is that the model never talks to an MCP server. A server describes its tools, the AI app places those descriptions in the model's context, the model decides to use one, and the app makes the call and passes the result back. That arrangement explains several of the site's "Break it" security lessons. Because tool descriptions and tool results are text the model reads, a malicious server can hide instructions inside a description, or change it after the user has approved the server, and anyone who can write where a tool reads, such as a public GitHub issue, can steer the agent through the result.

A "spec time machine" replays the lifecycle, transport and authorization lessons across five specification versions from November 2024 to July 2026. In the site's July 2026 version, the opening handshake is gone and every request carries its own protocol version and capabilities.

The site is made by Runlayer, which makes a gateway that sits between AI apps and MCP servers, and each security lesson has a "With Runlayer" view of how that product handles the attack. In the tool-poisoning lesson, that view also lists what the gateway does not cover: a poisoned description still reaches the model, and a changed tool is not held for re-approval. The protocol mechanics stand on their own; the defensive claims are a vendor's account of its product.