What is an MCP server? Explained with a live one.
Most explanations of the Model Context Protocol stop at a diagram. This one ends with a working, public MCP server you can add to Claude in one command — the one running on this website — plus three more I've built for real products.
MCP server meaning, in one paragraph
An MCP server is a program that exposes a system — a database, a SaaS product, a file system, your company profile — to AI assistants through the Model Context Protocol, an open standard Anthropic published in late 2024 that the rest of the industry has since adopted. The server says “here is what I can do, and here is the exact input each action needs”; the assistant decides when to use it. Write the server once and it works in Claude, ChatGPT, Cursor, VS Code and every other MCP client, instead of building one plugin per assistant.
The useful mental model is USB-C for AI: the protocol fixes the plug, so the device on either end can change without rewiring.
Hosts, clients and servers
Three roles. The host is the app the person uses — Claude Code, Claude Desktop, an IDE. Inside it, one client per connection keeps a session with one server. Everything on the wire is JSON-RPC 2.0: the client sends initialize, learns what the server supports, then calls methods like tools/list and tools/call.
A server can offer three kinds of thing, and the difference is who is in control:
- Tools — actions the model chooses to call, each with a name, a description and a JSON Schema for its arguments. “search_profile”, “create_deal”, “send_email”. This is what most servers are.
- Resources — read-only context the application attaches, addressed by URI: a file, a schema, a record.
- Prompts — reusable templates the user picks, such as a slash command that starts a code review with the right context.
Clients can offer features back — sampling (the server asks the host's model for a completion), roots and elicitation (the server asks the user a question) — but tools are where nearly all real-world value sits today.
stdio vs Streamable HTTP
stdio is for local servers. The host starts the server as a child process and they exchange JSON-RPC over standard input and output. No network, no auth — the server runs with your permissions on your machine. It's how file-system, git and most developer-tool servers work, and it's the right choice when the data lives on the laptop.
Streamable HTTP is for remote servers. The server exposes one URL; the client POSTs JSON-RPC messages to it and gets back either a plain JSON reply or a stream of server-sent events when the work takes a while. Sessions are optional. It replaced the older two-endpoint HTTP+SSE transport, and it's what you want for a SaaS product, because anyone can connect without installing anything. The server on this site is Streamable HTTP and fully stateless: every request gets one JSON answer, which makes it trivial to host on serverless functions.
A live MCP server for Claude, in one command
This website runs a public, read-only MCP server at https://moeidsaleem.com/api/mcp. Add it to Claude Code, then ask something like “Is Moeid available for a CTO role, and has he worked with Kafka?”:
claude mcp add --transport http moeid https://moeidsaleem.com/api/mcpOr skip the client and talk to it directly. This is the whole protocol, unwrapped — list the tools:
curl -s https://moeidsaleem.com/api/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Then call one, exactly as Claude would:
curl -s https://moeidsaleem.com/api/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
"params":{"name":"search_profile","arguments":{"query":"Kafka"}}}'The server answers with { "content": [{ "type": "text", ... }] }. Its 8 tools:
get_profileFull canonical profile of Moeid Saleem Khan (identity, availability, contact, experience, 2026 products, services, speaking, awards, education, stack, regions, FAQs, citable quick facts, page map).get_experienceCareer history from 2013 to today — role, company, place, period, description, achievement bullets and stack per role.get_productsProducts Moeid designed, built and shipped in 2026 as Founder & CTO of Atrix.get_servicesProductized engagements — Fractional CTO, AI Implementation and AI Readiness Assessment — with what each includes and how pricing works.get_speaking_and_awardsConference talks, panels, mentorship (MISK Foundation) and recognition.get_availabilityIs Moeid open to work, for what (full-time CTO / Head of Engineering (AI), fractional CTO), in which regions, and how to reach him (booking link, email, CV).get_recent_writingLatest articles from moeidsaleem.com/writing (title, description, tags, URL, published date).search_profileKeyword search across the whole profile (experience, products, services, stack, FAQs, pages).Notice what's missing: no write tools, no auth, no resources or prompts. A public server should be boring. It's rate-limited per IP, caps request size, and every answer comes from the same source as the pages you're reading.
MCP server vs API
They aren't competitors. An API is how programs talk to your system; an MCP server is how AI models do. Most good MCP servers are a thin, opinionated layer over an existing API.
| MCP server | REST API | |
|---|---|---|
| Who calls it | An AI model, deciding at run time which tool fits the request | Code a developer wrote in advance |
| Discovery | Built in: tools/list returns names, descriptions and JSON Schemas | Out of band: docs, OpenAPI files, SDKs |
| Shape | A few task-sized tools with descriptions written for a model | Many resource endpoints shaped for programs |
| Wire format | JSON-RPC 2.0 over stdio or Streamable HTTP | Usually REST or GraphQL over HTTP |
| Auth | OAuth 2.1 for remote servers; none for local stdio | Whatever the provider chose: keys, OAuth, mTLS |
| Integration cost | Write once, works in every MCP client | One integration per app that wants it |
The design lesson: don't mirror your REST endpoints one-to-one. A model does better with eight well-described tools than eighty thin ones. Shape tools around the tasks people ask for, and put the effort into descriptions — they are the model's only documentation.
MCP server examples I've built
This site — a public, read-only profile server
8 tools over Streamable HTTP at /api/mcp, no auth, stateless, rate-limited per IP. Recruiters and founders can ask their own assistant about my experience and availability, and the answers come from the same data as this website.
Atrix — a remote server for a whole workspace
The AI workspace I built in 2026 exposes CRM, projects, hiring, HR and billing over MCP with OAuth 2.1 and scoped, revocable tokens — 49 grantable scopes where a write scope implies its read. It is listed in the official MCP Registry, and one connection also reaches Atrix Analytics, Atrix Mail and PrimeLeadFinder.
Atrix Mail — a 41-tool server on npm
Email hosting with a developer sending API, packaged as a 41-tool MCP server published on npm, so the same capabilities are usable from any MCP client instead of only from code.
Etera AI — federated MCP behind multi-agent LLMs
At Etera AI, a G42-powered travel platform, I led a federated-MCP, multi-agent LLM layer (LangChain, LangGraph, MCP) across Restaurants, Experiences, Hotels and Flights — hierarchical agent graphs with scoped memory and vector-augmented retrieval per vertical.
Case studies: Atrix, Atrix Mail and Atrix Analytics.
How to secure a remote MCP server
- OAuth 2.1, not pasted keys. The MCP authorization spec builds on OAuth 2.1: the server answers 401 with a pointer to its authorization server, the client registers itself and opens a browser, and what gets stored is a refreshable token rather than a long-lived secret in a config file.
- Scoped and revocable. Tokens should carry narrow scopes, never exceed the permissions of the person who granted them, and die the moment access is revoked. On Atrix, permissions are resolved per call for exactly that reason.
- Read-only when public. If a server needs no login, it should have no write tools. Mine doesn't.
- Rate limits and audit logs. Agents loop. Cap calls per token or IP, and log which tool ran and its outcome — not the content.
- Tool output is data. Text a tool returns can contain instructions aimed at the model. Keep anything that sends, pays or deletes behind an explicit human confirmation.
When should you build an MCP server?
Build one if your customers already use AI assistants and would rather ask than click; if you're a SaaS product whose competitors will be “in Claude” before you are; or if you have internal agents that need the same capabilities across several tools. Don't if a single app calls a single model — plain function calling is simpler — or if you can't yet describe the five tasks people would use it for. Start read-only, ship three to eight tools, watch which ones get called, then add writes behind scopes.
If you want help shaping or shipping one, that's part of my AI implementation work.
MCP server questions, answered
What is an MCP server in simple terms?
A small program that tells an AI assistant what it can do in some system — read a calendar, search a database, send an email — and then does it when the assistant asks. It speaks the Model Context Protocol, so any MCP-capable assistant (Claude, ChatGPT, Cursor, VS Code and others) can use it without custom integration code.
Is an MCP server the same as an API?
No. Most MCP servers sit in front of an API. The API is the system's interface for programs; the MCP server is an adapter for AI models — fewer, task-shaped tools, descriptions written for a model, built-in discovery and a standard way to authorise a client. If you already have a good API, the MCP server is usually a thin layer over it.
How do I add an MCP server to Claude?
In Claude Code, run "claude mcp add --transport http <name> <url>" for a remote server, or "claude mcp add <name> -- <command>" for a local stdio server, then check it with /mcp. In the Claude apps, add a remote server as a custom connector in settings. To try one now, add mine: claude mcp add --transport http moeid https://moeidsaleem.com/api/mcp
Do I need an MCP server, or is function calling enough?
If one app of yours calls one model, function calling inside that app is enough. Build an MCP server when you want the same capabilities usable from many assistants and clients — your customers' Claude, your team's IDE, your own agents — without writing the integration again each time.
Are MCP servers safe?
As safe as their design. The dangerous parts are over-broad tokens, write tools without confirmation, and tool output that carries hidden instructions into the model. Use OAuth 2.1 with narrow, revocable scopes for remote servers, keep public servers read-only, rate-limit, audit every call, and treat everything a tool returns as data, not instructions.
Can you build an MCP server for our product?
Yes — it's part of my AI implementation work. I've shipped a public read-only server, a 41-tool server on npm and a multi-product remote server with OAuth 2.1 and scoped tokens, so we can usually go from your existing API to a registry-ready MCP server quickly, with security designed in.
Want an MCP server for your product?
Book a 30-minute call. I'll look at your API and tell you which tools an assistant actually needs, how to secure them, and what it takes to get listed.