What is an MCP server? A real one, measured

What is an MCP server?

An MCP server is a program that gives AI applications such as Claude or ChatGPT a set of tools and data they can use, through the Model Context Protocol. MCP is “an open-source standard for connecting AI applications to external systems.” A server usually wraps one or more of your systems, such as accounting or email, and the AI application calls its tools.

MCP’s documentation names three parts. The host is the AI application, such as Claude Code, and it creates “one MCP client for each MCP server.” The server is “A program that provides context to MCP clients,” on your machine or somewhere else.

Anthropic open-sourced MCP on November 25, 2024. On December 9, 2025 it donated the protocol to the Agentic AI Foundation, “a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI.” As of October 2026 the current version of the spec is 2026-07-28.

How does an MCP server work?

A server offers up to three kinds of things. Tools are “Executable functions that allow models to perform actions or retrieve information.” Resources are “Structured data or content that provides additional context to the model.” Prompts are “Pre-defined templates or instructions that guide language model interactions.”

There are two ways to connect. With stdio, “the client launches the MCP server as a subprocess” on the same machine. With Streamable HTTP, “each message is an HTTP POST to a single MCP endpoint,” so a remote server can handle many clients. The older HTTP+SSE transport is formally deprecated.

The 2026-07-28 revision changed the core. The release post says MCP is “transforming from a bidirectional stateful protocol into a request/response stateless protocol.” The changelog removes the initialize handshake and deprecates Roots, Sampling and Logging, so guides written before July 2026 describe steps the spec no longer has.

What does a real MCP server look like?

Alliance Chemical’s sales agent has run on one since February 2026. The agent works inside Claude Code, which starts the server over stdio. On October 2, 2026 the server answered a tools/list request with 169 tools in 21 domains, including QuickBooks Online, Shopify, Outlook email, ShipStation and UPS. It offers no resources or prompts. Disclosure: Andre Taki, a PHASEKIND founder, is Alliance Chemical’s Chief Commercial Officer and the agent’s main operator.

We sorted the tools by what they do (Figure 1). 90 read data and change nothing. 29 write only to the agent’s own records, such as deals, drafts and generated files. 50 change something outside, such as an invoice, an order, a shipment or a payment, or send a message to a person.

From August 3 to September 30, 2026 the server logged 38,328 successful calls: 30,354 reads (79.2%), 5,093 internal writes (13.3%) and 2,881 external writes (7.5%). That is about ten reads for every external write. The median call took 668 milliseconds.

On September 14, 2026 a quote request arrived at 11:05:14 a.m. and the reply went out at 11:11:36. In those six minutes the server logged 80 calls to 34 tools in 10 systems: 72 reads, 5 internal writes and 3 external writes, including a 13.9-second quote workflow, a QuickBooks estimate and the email send.

How we counted: the tool list comes from the live server and the calls from its own log, queried read-only. We classed each tool by reading what it does. 620 failed calls (1.6%) are left out. Some of the 80 calls belong to other emails worked in the same minutes, and email lookups can include teammates’ agents. This is one company’s server, so read the ratios as an example, not a benchmark.

How do you build an MCP server?

You write a program with one of the official SDKs, register each tool with a name, a description and an input schema, and add the server to your AI application’s settings. Alliance’s is TypeScript, with one module per system. Until March 6, 2026, Claude Code’s config listed 11 separate servers. That day they were merged into one entry point that loads every module, so one failing system doesn’t take the others down.

The model works from what you write in the definition. Here is QuickBooks customer search as the server lists it: the name qbo_search_customer, the description “Search QBO customers by email, company, or name. Returns terms info.” and three optional text fields, email, company and name. Write descriptions the way you would brief a new hire.

Log every call from the start. Alliance added one wrapper on August 3, 2026 that records each call’s tool, result and time, which is where every number above comes from. It doesn’t record a request ID, so the six-minute trace can’t separate one email’s calls from another’s. Add one.

MCP server vs API, AI agent and MCP gateway

An API is how a system exposes functions to programs. An MCP server sits on top of APIs and turns chosen functions into tools a model can find and call; MCP’s documentation lists “API calls” among the things tools do. Alliance’s QuickBooks domain is 24 tools over the QuickBooks API.

An AI agent decides what to do; the server only offers tools. At Alliance, Claude in Claude Code picks a tool from the list and the server runs the call.

The spec doesn’t define an MCP gateway; it mentions gateways only as intermediaries. Docker describes its own as “a centralized proxy between clients and servers, managing configuration, credentials, and access control.” Alliance runs one so teammates’ agents can use the same tools without holding API keys. It is hosted, takes a separate token for each person over Streamable HTTP and filters the tool list by role.

Is an MCP server secure?

An MCP server is as safe as the tools it exposes and the checks around them. The spec says “there SHOULD always be a human in the loop with the ability to deny tool invocations.” Its security guide adds: “MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server.”

Alliance puts its checks in code. 36 of the 50 external-write tools take a confirmedWrite field that the schema describes as “Set true after user approval,” and QuickBooks, Shopify, Amazon and eBay writes are refused without it. 37 take an idempotency key, a “Dedupe key for safe retries,” so a repeated call replays the first result instead of writing twice. Email sends have their own checks: the sending address is fixed and the recipient has to match the thread.

The gateway’s block list for supervised roles names 28 of the 169 tools, including 10 external writes: card refunds, invoice voids, order cancellations, credit decisions and sending email. Blocked tools don’t appear in a teammate’s tool list. On the operator’s side the agent is supervised, so a person approves each email before it goes out.

Does your business need an MCP server?

You need one when you want an AI application to work in your own systems, not just answer questions about them. The Linux Foundation says MCP “has been adopted by Claude, Cursor, Microsoft Copilot, Gemini, VS Code, ChatGPT and other popular AI platforms.” Anthropic counted “more than 10,000 active public MCP servers” in December 2025, so check whether your software already has one.

If you build one, plan around the calls. At Alliance there were about ten reads for every external write. Ship the read tools first, add drafts next, and put every external write behind a person, a confirmation field and a role check.