03 — agents & architecture

MCP

Also written Model Context Protocol

An open protocol, introduced by Anthropic in 2024 and now broadly adopted, that standardises how agents connect to external tools and data sources. A server advertises tools, resources and prompts; any compatible host can use them. It is the USB-C of agent tooling — and, like any standard connector, it turns a per-integration problem into a supply-chain problem: an agent may load servers from many authors, each contributing text and capabilities to the same trusted context.

Related terms

  • Tool registration Agents & architecture

    The handshake in which a server tells the host what tools it offers, and the host puts those names, descriptions and schemas into the model's context.

  • Tool poisoning Attack concepts

    Hiding instructions in the metadata an agent reads to learn how to use a tool — an MCP server's tool description, its parameter documentation, its schema…

  • Tool-name shadowing Attack concepts

    A malicious server registers a tool whose name or description collides with a trusted one — the same name, a near-identical name, or a description…

Agents & architecture

Where the attacks above actually land. The vocabulary here is worth precision, because the difference between "the model decided" and "the tool ran" is the difference between a risk and an incident.

MCP is term 4 of 8 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0