Model Context Protocol, usually shortened to MCP, is an open protocol that gives AI applications a consistent way to connect to outside tools and information. Before shared protocols like this, every AI assistant needed custom code for every system it talked to. MCP standardizes the conversation: how an application finds out which tools exist, how it asks for one to run, and what shape the answer comes back in.
A useful comparison is a standard electrical socket. It defines the shape of the plug and the voltage. It does not decide which appliances you own, who may use them, or whether plugging something in is a good idea. Keep that distinction in mind; it matters at the end of this guide.
The moving parts
- Host: the AI application a person actually uses, such as a chat assistant or a coding tool.
- Client: the component inside the host that maintains a connection to one server.
- Server: a program that offers capabilities to clients. Servers can expose tools, resources (readable context such as files or records) and prompts (reusable templates).
- Tool: a named operation the model can ask the client to invoke, with a description and a schema describing its inputs.
Messages travel over a transport, such as standard input and output for a local server or HTTP for a remote one.
The message format: JSON-RPC 2.0
MCP messages follow JSON-RPC 2.0. A request carries "jsonrpc": "2.0", an id, a method and optional params. A response repeats the same id and contains either a result or an error. A notification has no id and expects no reply. Matching ids is how a client knows which answer belongs to which question.
Discovering tools with tools/list
A client calls tools/list to learn what a server offers. Each tool entry includes a name, a human-readable description and an inputSchema, which is a JSON Schema stating which arguments are allowed, their types, and which are required. Entries can also carry an outputSchema for structured results and annotations such as readOnlyHint. Annotations are hints from the server. They describe intent; they do not enforce anything.
Calling a tool with tools/call
To run a tool, the client sends tools/call with the tool’s name and an arguments object. A well-built server validates the arguments against the schema before doing any work. The result contains content (for example, text the model can read) and, when the tool defines an output schema, structuredContent that matches it. A failure inside the tool is reported in the result with isError: true; a malformed request or unknown method gets a JSON-RPC error instead.
A synthetic example
The exchange below is illustrative. It uses a tool name from KEYXE’s demo catalog, fictional campaigns and invented values.
{
"jsonrpc": "2.0",
"id": 7,
"method": "tools/call",
"params": {
"name": "analytics_query",
"arguments": {
"dataset": "sample_ads_campaign_daily",
"metrics": ["spend", "attributed_sales", "acos"],
"group_by": "campaign",
"marketplace": "US",
"date_range": { "preset": "30d" },
"limit": 2
}
}
}
{
"jsonrpc": "2.0",
"id": 7,
"result": {
"content": [{ "type": "text", "text": "2 rows of synthetic sample data." }],
"structuredContent": {
"mode": "synthetic_demo",
"currency": "USD",
"data_as_of": "2026-10-01T00:00:00Z",
"rows": [
{ "campaign": "Demo Campaign A", "spend": 120.0, "attributed_sales": 410.0, "acos": 0.293 },
{ "campaign": "Demo Campaign B", "spend": 75.0, "attributed_sales": 0.0, "acos": null }
],
"is_live_amazon_data": false,
"warnings": ["Synthetic sample data. No Amazon API call was made."]
},
"isError": false
}
}
Notice what travels with the rows: the mode, currency, an “as of” time, a flag saying the data is not live Amazon data, and a warning. A careful client shows that context to the person instead of stripping it away. It also renders a null ratio as N/A:
| Campaign (fictional) | Spend | Attributed sales | ACoS as displayed |
|---|---|---|---|
| Demo Campaign A | 120.00 | 410.00 | 29.3% |
| Demo Campaign B | 75.00 | 0.00 | N/A |
The ACoS for Campaign A is 120.00 ÷ 410.00 × 100% ≈ 29.3%. Campaign B has no attributed sales, so its ACoS is undefined, and the response says so with null rather than a misleading zero.
Boundaries: a protocol is not permission
MCP describes how messages move. It does not grant the right to read data, and it does not make sharing data acceptable. Those questions are answered elsewhere:
- Authorization. Who is the user, which organization’s data may this client see, and which tools may it call? Remote servers typically rely on an authorization layer such as OAuth with narrow scopes.
- Least privilege. Expose the fewest tools, the narrowest scopes and the smallest datasets that serve the task. Read-only should be the default.
- Consent. The MCP specification stresses that people should understand and approve what data is exposed and which tools are invoked, and that tool descriptions from an untrusted server should not be taken at face value.
- Data-use policies. The source of the data sets its own rules. Under Amazon’s data policies, sending real seller or advertising data to an external AI provider can amount to disclosure to a third party.
KEYXE applies these boundaries conservatively. Its MCP Tool Explorer is a browser-local simulator that runs read-only tools on synthetic data, calls no Amazon API, and sends nothing to an AI provider. No public hosted MCP endpoint exists, and no tools that change accounts exist. Transfer of real Amazon data to external AI services is disabled pending policy review and any approvals that may be required.
Common mistakes
- Treating
readOnlyHintor a tool description as a security control. - Assuming that a connected tool means its data may be shared with any model.
- Accepting free-form queries instead of schema-validated, allow-listed inputs.
- Dropping “as of” times and warnings when summarizing a tool result.
- Confusing protocol errors with tool errors, and silently retrying both.
Try it
Open the MCP workspace of the synthetic demo to list tools, inspect their schemas and run analytics_query in your browser, or use the MCP Learning Playground at the free tools. The MCP & AI page describes KEYXE’s design, and the privacy notice explains data handling. Next, read How to Evaluate an AI Recommendation and check terms in the glossary.