--- title: "What is an MCP server? How it works - actionlake" description: "An MCP server offers tools, resources and prompts to AI apps over the Model Context Protocol. What it does, local vs remote, and where security has to live." canonical: https://actionlake.com/glossary/mcp-server updated: 2026-10-24 --- Model Context Protocol # MCP server An MCP server is a program that offers tools, resources and prompts to AI applications over the Model Context Protocol, usually by wrapping one system's API, such as a ticket desk or an accounting ledger. Updated 24 October 2026 Also called Model Context Protocol server 4 sources checked **On this page** Connect an agent to every system you run. 100,000 calls free a month. No card. [Start free](https://actionlake.com/console?start=sandbox) ## What it is In the [Model Context Protocol](https://actionlake.com/glossary/mcp), the server is the side that does the work. It declares what it can do, answers `tools/list` with a set of [MCP tools](https://actionlake.com/glossary/mcp-tool), and runs each `tools/call` it receives. Most servers front a single system: a code host, a CRM, a file store, an accounting package. A server runs in one of two places. A **local** server is launched by the client as a subprocess and talks over stdio; it usually serves one client and reads its credentials from the environment. A [remote MCP server](https://actionlake.com/glossary/remote-mcp-server) runs on the internet, talks [Streamable HTTP](https://actionlake.com/glossary/streamable-http), and typically serves many clients. ## Why it matters The server is where control can actually be enforced. The model only proposes a call; the server decides whether to run it. The MCP specification puts four duties on servers that offer tools: they must validate all tool inputs, implement proper access controls, rate limit tool invocations and sanitise tool outputs. ## How it works 1. The client connects and the server states its protocol version and capabilities. 2. The server lists its tools, each with a name, a description and an input schema. 3. For each call, the server checks the caller, validates the arguments, calls the underlying API with its own credential, and returns content or a tool error the model can act on. ## Example An accounting MCP server might offer `list_invoices`, `get_invoice` and `create_invoice`. A model asked "which invoices are overdue?" calls `list_invoices` with a status filter and summarises the result. ## Common pitfalls - **Secrets in configuration files.** Local servers often read API tokens from environment variables or config. The OWASP MCP cheat sheet says never to store OAuth tokens in plaintext in MCP config files. - **One server per system.** Ten systems means ten servers, ten credentials, ten permission models and ten logs, none of which agree. - **Token passthrough.** The specification forbids a server from accepting a token not issued for it and forwarding it downstream; the server must use its own, separately issued credential for the upstream API. - **Too many tools.** A server that maps every endpoint to a tool can push a model past what it can choose between. See [tool overload](https://actionlake.com/glossary/tool-overload). ## How actionlake handles it For every system you connect, actionlake is a single MCP server, which makes it an [MCP gateway](https://actionlake.com/glossary/mcp-gateway). Each system is described by a signed service file (a connector) that declares its actions, authentication and limits; the server refuses an unsigned or altered file. There are 1,000+ connectors and 289,000+ actions (counted 24 October 2026), and the tool list stays at eight however many you add. If a system is missing, your agent can draft a connector from the vendor's documentation, test it and sign it; only actions that passed a live test should be relied on. Browse the [connectors](https://actionlake.com/connectors) or see [how the platform works](https://actionlake.com/platform). ## Questions **Do I need to run my own MCP server for each app?** Not necessarily. You can run one per system, or connect one MCP gateway that fronts many systems behind a single endpoint, one credential store and one log. **What is the difference between a local and a remote MCP server?** A local server runs on your machine as a subprocess of the client and talks over stdio. A remote server runs on the internet, is reached over HTTPS with Streamable HTTP, and usually signs people in with OAuth. **Where should permissions be enforced, in the client or the server?** In the server. The client can ask a person before a call, but only the server holds the credential and sees every call, so it is the one place a refusal always applies. ## Related terms - [MCP The Model Context Protocol (MCP) is an open standard that lets an AI application connect to external systems and discover and call their tools, read their resources and use their prompts through one JSON-RPC message format.](https://actionlake.com/glossary/mcp) - [MCP client An MCP client is the component inside an AI application that holds one connection to one MCP server, fetches that server's tool list and passes the model's tool calls to it.](https://actionlake.com/glossary/mcp-client) - [Remote MCP server A remote MCP server runs on the internet rather than on your computer, and AI clients reach it over HTTPS using the Streamable HTTP transport, usually after an OAuth sign-in.](https://actionlake.com/glossary/remote-mcp-server) - [MCP gateway An MCP gateway is a single MCP endpoint that sits between AI agents and many systems, holding the credentials and enforcing permissions, limits and logging on every tool call that passes through it.](https://actionlake.com/glossary/mcp-gateway) - [MCP tool An MCP tool is a named function that an MCP server offers to AI models, described by a name, a plain-language description and a JSON Schema for its input, and invoked with a tools/call request.](https://actionlake.com/glossary/mcp-tool) - [Credential vault A credential vault for AI agents stores the API keys and OAuth tokens for business systems encrypted outside the agent, and uses them on the agent's behalf only at the moment of each call, so the model, its prompt and its logs never contain a vendor secret.](https://actionlake.com/glossary/credential-vault) ## Sources 1. [Architecture overview](https://modelcontextprotocol.io/docs/learn/architecture) Model Context Protocol · checked 22 October 2026 2. [Server features: Tools (2025-11-25)](https://modelcontextprotocol.io/specification/2025-11-25/server/tools) Model Context Protocol · checked 22 October 2026 3. [Security Best Practices (2025-11-25)](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices) Model Context Protocol · checked 22 October 2026 4. [MCP Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/MCP_Security_Cheat_Sheet.html) OWASP Cheat Sheet Series · checked 22 October 2026 [All 30 glossary terms](https://actionlake.com/glossary) ## Connect an agent. Start free. [Start free](https://actionlake.com/console?start=sandbox) [Read the quickstart](https://actionlake.com/docs/quickstart) 100,000 calls free every month. No card. Hard caps on every key. --- Source: https://actionlake.com/glossary/mcp-server More: https://actionlake.com/llms.txt