Model Context Protocol (MCP)

The Model Context Protocol (MCP) is an open protocol that standardises how AI applications connect to external tools and data. An MCP server exposes tools (actions), resources (data) and prompts; an MCP client, inside the AI application, discovers them and lets the model use them.

What it is

MCP messages are JSON-RPC 2.0. The specification defines two standard transports:

• stdio: the client starts the server as a local subprocess and talks over standard input and output.
• Streamable HTTP: the server is an independent service with one HTTP endpoint; the client sends each message as a POST and gets JSON or an event stream back. It replaced the older HTTP+SSE transport.

A client connects, lists the server's tools with their input schemas, and passes them to the model. When the model asks to call a tool, the client sends the call to the server and returns the result to the model.

Why it matters

Before MCP, every AI tool wrote its own integration for every service. With a shared protocol, a service publishes one MCP server and any MCP client can use it. For agents writing code, that means an issue tracker, documentation search or live dependency data without custom glue. It also means new risk: a tool call can change things, so which tools an agent may call needs a policy.

In AI CodeOps

AI CodeOps is an MCP client. You add servers under Configure → MCP Servers, and the agents in your sessions can use their tools. It is also an MCP server: Claude Code, Cursor or any MCP client can connect to it with a workspace API key to start sessions, read findings and check the release gate (see the AI CodeOps MCP server). MCP support is in beta.

• Sessions use remote servers only: a public HTTPS address speaking Streamable HTTP, authenticated with static headers such as a bearer token. OAuth sign-in and the older SSE-only transport aren't supported yet.
• Headers are encrypted at rest with AES-256-GCM, never sent back to the browser, and decrypted only when a session connects.
• At session start, AI CodeOps connects to each enabled server and lists its tools. An unreachable server is skipped.

Limits and naming, as agents see them:

tool names   <server>__<tool>, e.g. github__create_issue
per session  up to 32 MCP tools in total
per step     up to 6 rounds of tool calls
per call     30-second timeout; long results are shortened

Two controls decide which tools reach the agents. A custom agent's MCP tools allowed field lists servers, tools or server__tool names. And a policy rule on mcp.invoke matches server/tool:

{ "id": "no-repo-deletes", "action": "mcp.invoke", "resource": "github/delete_*", "decision": "deny" }

mcp.invoke rules can allow or deny, not ask. With the none trust posture, MCP tools are denied unless a rule allows them. Adding, changing and removing servers is recorded in the audit log. Managing servers needs the mcp:manage permission: owners, admins and DevOps admins.

Related terms

• Agent orchestration: where tool calls fit in a session.
• Policy engine: how tool access is allowed or denied.
• Software composition analysis (SCA): one use, giving the Dependency Auditor live data.