VI EN
AI Agents & Skills

What is MCP? The “USB-C port” connecting AI to databases, GitHub, Slack…

Binh 2 min read Đọc bài này bằng tiếng Việt

TL;DR

MCP (Model Context Protocol) is an open protocol that lets AI applications connect to external tools and data in a standard way. An MCP server (e.g. GitHub, Postgres) built once works with any MCP client such as Claude, Claude Code or Cursor.

Previously, every AI app that wanted to connect to GitHub, a database or Slack had to write its own integration: N apps times M systems meant N×M connectors. MCP (Model Context Protocol) is an open protocol that solves this with a shared standard, often compared to a "USB-C port" for AI: an MCP server (for GitHub, Postgres…) written once works with every MCP-capable client such as Claude, Claude Code or Cursor.

Three roles

ComponentRoleExamples
HostThe application the user interacts withClaude Desktop, Claude Code, IDEs
ClientA 1-to-1 connection to one server, living inside the hostCreated automatically when you add a server
ServerProvides capabilities to the AIGitHub, filesystem, Postgres, Slack

Clients and servers talk JSON-RPC; servers can run locally (over stdio) or remotely (over HTTP).

What does a server provide?

  • Tools: actions the AI can call (create an issue, run a query, send a message).
  • Resources: data to read (files, records, documents).
  • Prompts: prebuilt prompt templates invoked like commands.

Example configuration

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "<least-privilege token>" }
    }
  }
}

Package names and parameters vary per server; read your server's docs. The key point: the token should have only the minimum permissions needed.

Security risks

  • Servers run with your permissions. Only install from trusted sources and read the source code where possible.
  • Least privilege: use narrowly scoped tokens; prefer read-only access to production databases.
  • Prompt injection: data a server returns (an issue, an email) may contain malicious instructions. Avoid combining access to untrusted data, access to sensitive data and the ability to send data out in the same session.
  • Confirm write actions: keep permission prompts on for tools that change data.

Context cost

Every server adds its tool definitions to context. Installing many servers at once bloats context, raises cost and makes the agent more likely to pick the wrong tool. Disable servers you aren't using in the current session.

MCP or a skill?

NeedChoose
Connect an external system, shared across several appsMCP server
A workflow/instructions for one agent, little dependency on external systemsSkill (simpler)
A simple one-off API callPossibly just a script or CLI command

How to apply it

  • Dev: start small; a filesystem or GitHub MCP is enough to see the value.
  • Tech Lead: keep a list of approved servers and conventions for token permissions; review them like dependencies.
  • PM: MCP is the foundation for AI working with Jira, documents and internal data, but it needs a security policy before scaling up.

Sources & references

  1. Architecture overview — Model Context Protocol
More on AI Agents & Skills