MCP Architecture: Hosts, Clients, Servers and Transports

The Model Context Protocol (MCP) is an open standard for connecting AI applications to external tools, data and prompts. Before MCP, every application integrated every service with bespoke code. With MCP, a service exposes one server and any compliant application can use it. Claude Code, Claude Desktop, the Agent SDK and the Messages API MCP connector are all MCP hosts. The exam tests the vocabulary precisely, because the roles are easy to blur.

The three roles

Role	What it is	Examples
Host	The AI application the user interacts with; it creates clients and decides what the model sees	Claude Code, Claude Desktop, your Agent SDK app
Client	A connector inside the host that maintains a one-to-one session with one server	One client per configured server
Server	A program exposing capabilities over MCP	A GitHub server, a database server, a filesystem server

A host with five servers configured runs five clients. Servers never talk to each other through MCP, and the model never talks to a server directly: the host mediates, turning server tool listings into tool definitions the model sees and turning the model's tool_use requests into tools/call messages.

Server primitives

Servers can offer three kinds of capability, each with a distinct intended controller:

• Tools are functions the model may invoke (model-controlled). Each has a name, description and JSON Schema for inputs, and optionally an output schema and annotations such as readOnlyHint or destructiveHint that hosts can use to shape permission prompts.
• Resources are data the application can read and attach to context (application-controlled): files, database rows, documents, identified by URI. Hosts such as Claude Code expose them with an @server:uri mention syntax.
• Prompts are reusable templates the user chooses to invoke (user-controlled). Claude Code surfaces them as slash commands.

The control distinction is deliberate. A tool being model-controlled means the model decides to call it; a resource being application-controlled means the host or user decides to include it, so a server cannot force content into the model's context.

Client primitives

Clients can also offer capabilities to servers: sampling lets a server ask the host's model to complete a prompt (so a server can be agentic without its own API key); roots tell a server which directories it may operate on; and elicitation lets a server ask the user for structured input mid-operation. Hosts advertise which of these they support during initialisation.

The protocol itself

MCP messages are JSON-RPC 2.0: requests with IDs that expect responses, and notifications that do not. A session begins with an initialize request in which both sides declare protocol version and capabilities, followed by an initialized notification; only then do operations such as tools/list, tools/call, resources/read or prompts/get flow. Servers can send notifications/tools/list_changed when their tool set changes, and hosts re-list in response. Capability negotiation means a host never has to guess what a server supports.

Tool errors have two levels. A protocol error (unknown tool, malformed arguments) is a JSON-RPC error response. A tool that ran but failed in its own logic returns a normal result with isError: true and a message in its content, so the model can read and react to it. Confusing the two levels is a common server bug.

Transports

Transport	How it works	Use it when
stdio	The host launches the server as a child process and exchanges newline-delimited JSON over stdin/stdout	Local tools, developer machines, anything with filesystem access
Streamable HTTP	The server is a web endpoint; the client POSTs messages and may receive a response stream (Server-Sent Events) on the same endpoint	Remote or shared servers, multi-user deployments, anything needing auth

Streamable HTTP replaced the earlier separate HTTP+SSE transport, which is now deprecated but still encountered in older servers. Because stdio uses stdout for protocol messages, a stdio server must send all logging to stderr; a stray print() corrupts the stream.

Remote servers authenticate with OAuth 2.1. The server publishes protected-resource metadata pointing at its authorisation server, the client discovers it, and the user completes an authorisation flow in the browser. Hosts such as Claude Code manage token storage and refresh. Local stdio servers typically receive credentials through environment variables instead.

Why architects care

MCP decouples three decisions: who builds the integration (the service owner, once), who hosts it (locally or remotely, with appropriate auth), and who consumes it (any host). The costs are context (every server's tool definitions are presented to the model) and trust (a server's tool results are untrusted input). Both are addressed in the lessons on configuring servers and on tool safety.

Exam focus

• Host, client and server are distinct: the host runs one client per server, and the model never speaks MCP directly.
• Tools are model-controlled, resources are application-controlled, prompts are user-controlled.
• Sampling, roots and elicitation are client capabilities offered to servers, negotiated at initialize.
• MCP is JSON-RPC 2.0; the session starts with initialize and the initialized notification before tools/list or tools/call.
• stdio is for local child processes (log to stderr, never stdout); Streamable HTTP is for remote servers and supports OAuth 2.1.
• A tool-level failure is a result with isError: true, not a JSON-RPC protocol error.