What is MCP (Model Context Protocol)?

What problem does MCP solve?

MCP gives AI apps one common way to reach outside services. Before a shared protocol, every pairing of an AI app and a service needed its own glue code. With MCP, a service describes its actions once as a list of tools, and any client that understands the protocol can find and call them.

For the person using the assistant, this means you can connect a service in a few clicks and then ask for things in plain language. For the company offering the service, it means one integration works across many AI apps. The specification is published at modelcontextprotocol.io.

How does MCP work?

There are two sides. The client is the AI app, for example Claude, ChatGPT, Claude Code, Codex or Cursor. The server belongs to the service and lists the tools it offers. Each tool has a name, a short description and the inputs it takes, so the model can decide when to use it.

1. You add the server's address to your AI app.
2. The app asks the server which tools it has.
3. When a request needs one, the model calls the tool and reads the result.
4. The model keeps going, calling more tools or answering you.

A server can run in two ways. A hosted server is a URL that clients reach over the Streamable HTTP transport, with nothing to install. A local server runs on your own machine and talks to the client over standard input and output (stdio).

How does an AI app sign in to an MCP server?

Most hosted servers support two methods, and the companies we build show both:

• Sign-in with OAuth. Apps that can open a browser send you to the service's sign-in page, and you approve access. Transformer's server uses OAuth 2.1 with sign-in on X, and access can be revoked in its settings. Sandboxer's server uses OAuth 2.1 too, and lists each connected app so you can disconnect it at once.
• An API key. Headless agents that run without a browser send a key as a bearer token on every request. Good practice is to keep the key in an environment variable rather than in a config file you commit.

The key or sign-in decides what the agent may do. On Sandboxer, a scoped key limits which tools work. On Transformer, one key or connection acts for exactly one brand or creator workspace. On Flagger.gg, an agent token covers one project, a list of environments and specific actions, and lasts 90 days at most.

What can an agent do with MCP in practice?

It depends entirely on the tools a server offers. Three examples from our companies:

• Sandboxer runs a hosted server at https://sandboxer.com/mcp and a local one with sbx mcp. Its tools let an agent create Linux sandboxes, run commands, read and write files, put a port on an HTTPS URL, save snapshots and stop or delete sandboxes.
• Transformer runs a hosted server at https://transformer.gg/mcp. Brand-side tools get suggested creators for the brand, write a short ask for each, send offers and report sales. Creator-side tools accept offers, submit posts for verification and request payouts.
• Flagger.gg runs a hosted server at mcp.flagger.gg and a local one with flagger mcp. Its eleven tools let an agent list, create, roll out, target, kill and revert feature flags. Every write needs a note, and there is no approve tool.

In each case the agent does the same work a person would do in the web dashboard, so nothing is locked behind a screen only humans can use.

Is MCP safe to use?

MCP is a way to connect; how safe it is depends on what you connect and what access you grant. A few habits help:

• Grant the narrowest access that does the job, such as a scoped key or a single workspace.
• Keep keys out of chats and out of files in version control.
• Check the list of connected apps from time to time and remove ones you no longer use.
• Prefer tools whose actions have clear limits. Sandboxer sandboxes stop on their own an hour after they start unless you change that, Transformer only releases a payment once a post is verified, and Flagger.gg shows an agent only the tools its token allows.

How do you write good MCP tools?

Treat each tool's name and description as documentation, because that's what the model reads to decide whether to call it. Name tools after the action, such as create_offer or flag_kill, say in one line what each does and what it returns, and keep inputs few and explicit. Offer only the tools the connection is allowed to use, and make writes leave a trail. Read how to write documentation AI agents can use and see how one agent uses all three servers in how Sandboxer, Flagger.gg and Transformer work together.

Why does MCP matter for companies?

More work is starting inside AI assistants, so a product that agents can use directly is easier to adopt. That is one reason every company we build ships an MCP server alongside its API and CLI. We cover the wider idea in what makes a company AI-native, and the practical checklist in how to make a product AI agents can use.