{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"ai/mcp-server","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/ai/mcp-server/","da":"https://cmaintz.github.io/tech-atlas/da/terms/ai/mcp-server/"},"term":{"en":"MCP server","da":"MCP-server"},"aka":{"en":[],"da":[]},"domain":["ai"],"cluster":"agents","layer":"agent","status":"emerging","era":2024,"summary":{"en":"A small program that offers tools or data to AI apps through the Model Context Protocol, such as reading mail or searching files.","da":"Et lille program, der tilbyder værktøjer eller data til AI-apps via Model Context Protocol, fx at læse mail eller søge i filer."},"body":{"formal":{"en":"A program that speaks the Model Context Protocol and tells a connected AI app which tools, data and prompts it offers, each with a name and a text description; it runs the tool calls it receives, either on the same machine or over the internet.","da":"Et program, der taler Model Context Protocol og fortæller en tilsluttet AI-app, hvilke værktøjer, data og prompts det tilbyder, hver med et navn og en tekstbeskrivelse; det udfører de værktøjskald, det modtager, enten på samme maskine eller over internettet."},"plain":{"en":"Like letting a temp from an unknown agency into the office because their written list of skills looks useful - you only have their word for what they will actually do.","da":"Som at lukke en vikar fra et ukendt bureau ind på kontoret, fordi vikarens skrevne liste over, hvad vedkommende kan, ser nyttig ud - man har kun vikarens eget ord for, hvad der faktisk sker."},"inPractice":{"en":"The office manager at a small Danish firm installs a free MCP server from the web so an assistant can manage her calendar; it asks for her full account login, and every tool description it sends goes straight to the model.","da":"Kontorchefen i en lille dansk virksomhed installerer en gratis MCP-server fra nettet, så en assistent kan styre hendes kalender; den beder om hele kontoens login, og hver værktøjsbeskrivelse, den sender, går direkte til modellen."},"whyItMatters":{"en":"Each one is outside code with real access running next to your assistant, so a careless or hostile one can leak secrets or steer the model - it deserves the same care as installing any other software.","da":"Hver af dem er fremmed kode med reel adgang, der kører ved siden af ens assistent, så en sjusket eller ondsindet server kan lække hemmeligheder eller styre modellen - den skal installeres med samme omhu som al anden software."}},"deepDive":{"en":"An MCP server exposes up to three server-side primitives. Tools are model-invoked functions, advertised via tools/list with a name, a natural-language description, a JSON Schema inputSchema (JSON Schema 2020-12 is the default dialect) and optionally an outputSchema, and executed via tools/call, which returns content blocks and optionally structuredContent. Resources are application-controlled, URI-addressed data read with resources/read, and prompts are user-selected templates fetched with prompts/get. Tools may also carry annotations such as readOnlyHint, destructiveHint, idempotentHint and openWorldHint; the specification says clients must treat these as untrusted unless the server itself is trusted, because a malicious server can simply lie.\n\nThere are two standard transports. With stdio the host launches the server as a local subprocess and exchanges newline-delimited JSON-RPC over stdin and stdout; the server runs with the user's own operating-system privileges, and the authorization specification says stdio servers should take credentials from the environment rather than run OAuth. With Streamable HTTP the server is a remote endpoint and, when protected, acts as an OAuth 2.1 resource server: it must publish OAuth 2.0 Protected Resource Metadata (RFC 9728), accept only tokens whose audience is itself (RFC 8707 resource indicators), and must not pass tokens it received through to upstream APIs, a rule aimed at the confused-deputy problem. Local HTTP servers must also validate the Origin header to resist DNS rebinding. The 2026-07-28 revision made the protocol stateless: the initialize handshake and the Mcp-Session-Id header are gone, servers must implement server/discover, list results carry ttlMs and cacheScope caching hints, and any cross-call state has to be modelled as explicit handles passed in tool arguments.\n\nMost real-world risk sits in the server ecosystem rather than the wire format. Tool poisoning hides instructions in tool descriptions, which the host feeds verbatim to the model; a \"rug pull\" changes a tool's definition after the user approved it; and with several servers connected, one server's descriptions can shadow or redirect another's tools. Ordinary software flaws apply too: CVE-2025-6514, published in July 2025, was a critical OS command injection in the widely used mcp-remote proxy, triggered by connecting to a malicious server. Validation errors should be returned as tool execution errors (isError) rather than protocol errors so the model can correct its call.\n\nOperationally an MCP server should be treated like any third-party dependency with credentials: pin versions and review source, prefer official or registry-verified servers, grant narrowly scoped tokens, run local servers in a container or sandbox where possible, log every tool call, and have organisations enforce an allowlist of approved servers through managed client configuration.","da":"En MCP-server udstiller op til tre primitiver på serversiden. Tools er funktioner, som modellen kalder; de annonceres via tools/list med et navn, en beskrivelse i naturligt sprog, et JSON Schema i inputSchema (JSON Schema 2020-12 er standarddialekten) og eventuelt et outputSchema og udføres via tools/call, der returnerer indholdsblokke og eventuelt structuredContent. Resources er data, som applikationen styrer, adresseret med URI'er og læst med resources/read, og prompts er skabeloner, som brugeren vælger, hentet med prompts/get. Værktøjer kan også have annotationer som readOnlyHint, destructiveHint, idempotentHint og openWorldHint; specifikationen siger, at klienter skal betragte dem som upålidelige, medmindre selve serveren er betroet, for en ondsindet server kan bare lyve.\n\nDer er to standardtransporter. Med stdio starter værten serveren som en lokal underproces og udveksler linjeopdelt JSON-RPC over stdin og stdout; serveren kører med brugerens egne rettigheder i styresystemet, og autorisationsspecifikationen siger, at stdio-servere bør hente legitimationsoplysninger fra miljøet i stedet for at køre OAuth. Med Streamable HTTP er serveren et fjernendpoint og fungerer, når den er beskyttet, som OAuth 2.1-ressourceserver: Den skal publicere OAuth 2.0 Protected Resource Metadata (RFC 9728), kun acceptere tokens, hvis audience er den selv (resource indicators efter RFC 8707), og må ikke sende modtagne tokens videre til bagvedliggende API'er, en regel rettet mod confused deputy-problemet. Lokale HTTP-servere skal desuden validere Origin-headeren for at modstå DNS rebinding. Revisionen 2026-07-28 gjorde protokollen tilstandsløs: initialize-håndtrykket og headeren Mcp-Session-Id er fjernet, servere skal implementere server/discover, listeresultater har cachehints i ttlMs og cacheScope, og tilstand på tværs af kald skal modelleres som eksplicitte handles, der sendes med i værktøjsargumenterne.\n\nDen største reelle risiko ligger i økosystemet af servere snarere end i selve protokollen. Tool poisoning gemmer instruktioner i værktøjsbeskrivelser, som værten giver ordret videre til modellen; et \"rug pull\" ændrer et værktøjs definition, efter at brugeren har godkendt det; og når flere servere er tilsluttet, kan én servers beskrivelser skygge for eller omdirigere en andens værktøjer. Almindelige softwarefejl gælder også: CVE-2025-6514, offentliggjort i juli 2025, var en kritisk OS command injection i den udbredte proxy mcp-remote, der blev udløst ved forbindelse til en ondsindet server. Valideringsfejl bør returneres som fejl i værktøjsudførelsen (isError) frem for protokolfejl, så modellen kan rette sit kald.\n\nI drift bør en MCP-server behandles som enhver tredjepartsafhængighed med legitimationsoplysninger: Fastlås versioner og gennemgå kildekoden, foretræk officielle eller registerverificerede servere, udsted snævert afgrænsede tokens, kør lokale servere i en container eller sandkasse, hvor det er muligt, log hvert værktøjskald, og lad organisationen håndhæve en tilladelsesliste over godkendte servere via centralt styret klientkonfiguration."},"edges":[{"type":"requires","to":"ai/tool-calling","confidence":"high","strength":"normal"},{"type":"kind-of","to":"cs/server","confidence":"high","strength":"normal"},{"type":"part-of","to":"ai/model-context-protocol","why":{"en":"MCP servers are the side of the protocol that offers tools; the AI app on the other side calls them.","da":"MCP-servere er den side af protokollen, der tilbyder værktøjer; AI-appen på den anden side kalder dem."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"cs/oauth","why":{"en":"The MCP rules for logging in to remote servers build on OAuth 2.1, so a user grants limited access instead of handing over a password.","da":"MCP's regler for login på fjernservere bygger på OAuth 2.1, så en bruger giver begrænset adgang i stedet for at udlevere en adgangskode."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"ai/prompt-injection","why":{"en":"A tool's description is read by the model as trusted text, so a hostile MCP server can hide orders in it - known as tool poisoning.","da":"En værktøjsbeskrivelse læses af modellen som betroet tekst, så en ondsindet MCP-server kan gemme ordrer i den - kendt som tool poisoning."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"platform/secrets-management","why":{"en":"Many MCP servers need API keys or tokens to reach other systems; these belong in a secrets store, not in a plain settings file.","da":"Mange MCP-servere skal bruge API-nøgler eller tokens for at nå andre systemer; de hører hjemme i et hemmelighedslager, ikke i en almindelig indstillingsfil."},"confidence":"high","strength":"normal"}],"depth":6,"sources":[{"title":"Model Context Protocol specification (Server features; Authorization)","tier":"official-doc","publisher":"Model Context Protocol project (Agentic AI Foundation, Linux Foundation)"},{"title":"OWASP Top 10 for LLM Applications 2025 (LLM01 Prompt Injection; LLM06 Excessive Agency)","tier":"reference","publisher":"OWASP"},{"title":"Model Context Protocol specification 2026-07-28 - Authorization","url":"https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization","tier":"official-doc","publisher":"Model Context Protocol project"},{"title":"GitHub Advisory GHSA-6xpm-ggf7-wc3p (CVE-2025-6514) - OS command injection in mcp-remote","url":"https://github.com/advisories/GHSA-6xpm-ggf7-wc3p","tier":"reference","publisher":"GitHub"}],"draft":true}