Model Context Protocol

The Model Context Protocol (MCP) is an open standard, introduced by Anthropic in November 2024, that defines how an AI application talks to external capabilities. An MCP server exposes tools (actions the model can call), resources (data it can read) and prompts (reusable templates). An MCP client, inside a host such as an IDE assistant or a chat app, discovers those capabilities and lets the model use them. Messages use JSON-RPC 2.0, over standard input/output for local servers or HTTP for remote ones. One server written once works with any client that supports the protocol.

Example: browser automation for an assistant

The Playwright MCP server lets an assistant open pages, read the accessibility tree, click and type. A typical client configuration:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": ["@playwright/mcp@latest"]
    }
  }
}

With that configured, you can ask the assistant to “open the staging login page, sign in as the test user and report any console errors”, and it calls the browser tools step by step. Other servers expose things like a Git host’s issues, a database or an internal API, so the same assistant can read a bug ticket, reproduce it in the browser and draft a test.

Established and emerging

Established: the protocol itself, and broad support across assistants, IDEs and tool vendors. Wrapping an internal tool as an MCP server is a reasonable, well-documented piece of engineering.

Emerging: using MCP-driven agents as part of a test process. Exploratory sessions, reproducing bugs and drafting test code are useful today with a person reviewing the result. Treating an agent’s run as a reliable regression check is not, because its steps are non-deterministic and it can declare success without verifying the right thing. Generated tests should be committed as ordinary code and reviewed like any other.

Risks to keep in mind

• Prompt injection through tools. Page content, tickets and tool output are untrusted text that can steer the model.
• Over-broad permissions. A server with write access to production data or credentials in its environment turns a model mistake into an incident. Give servers the narrowest scope and point them at test environments.
• Untrusted servers. A third-party MCP server runs code on your machine and describes its own tools to the model; review it like any other dependency.