Vibe coding tools

What is an MCP server?

An MCP server connects AI assistants and agents to tools and data through the Model Context Protocol. How it works, what it exposes, and how to secure one.

An MCP server is a program that exposes tools, data and prompts to AI applications through the Model Context Protocol, an open standard Anthropic introduced in November 2024 and many AI products now support. An AI client such as Claude, Claude Code or an AI editor connects to it and can call its tools, such as running a scan.

Published 9 November 2026 · Last updated 9 November 2026

By Michal Měřínský. Audit methodology.

What MCP is

Before MCP, every AI app needed a custom integration for every tool. The Model Context Protocol defines one standard way for AI applications, the clients, to connect to external capabilities, the servers. One MCP server can then work with any AI application that supports the protocol.

What a server exposes

Tools: actions the AI can call, such as create_issue, query_database or run_audit, each with a name, description and input schema.
Resources: data the AI can read, such as files, records or documents.
Prompts: reusable templates the user can invoke.

How clients connect

Local servers run on your machine and talk to the client over standard input and output. Common for developer tools.
Remote servers run on the web and talk over HTTP, using the protocol's Streamable HTTP transport, usually with OAuth for authorization. This is how a SaaS product offers its features to AI assistants.

Building one

Official SDKs exist for TypeScript, Python and other languages. A minimal server defines a few tools with clear names, descriptions and input schemas, and returns structured results. Good tool descriptions matter: the model decides when to call a tool based on them.

Security

Prompt injection: content a tool returns, such as a web page or email, can contain instructions that try to steer the AI. Treat tool output as data and design tools so the worst case is limited.
Least privilege: expose only the actions needed, and scope tokens narrowly.
Authorization: remote servers should use OAuth and check permissions on every call, not trust the client.
Confirmation: destructive tools, such as deleting data or sending messages, should require user approval in the client.
Only install MCP servers from sources you trust. A local server runs with your permissions.

An MCP server is an API whose caller is an AI model. Every security rule for APIs applies, plus the assumption that the caller can be manipulated by content.

What a scan can and cannot tell you

WebAuditOS checks the public web surface of a remote MCP server's host like any site: HTTPS, HSTS, CORS settings and error pages that disclose internals.

It does not speak the MCP protocol, test your tools' authorization or check for prompt injection risks.

A remote MCP endpoint is public infrastructure. Treat it with the same care as your main API.

Short answers

Who created MCP? Anthropic introduced it in November 2024 as an open standard.

Which apps support MCP? Many, including Claude, Claude Code and other AI assistants and editors.

Is an MCP server the same as an API? It is a standard interface designed for AI clients, often wrapping an existing API.

Do I need to code to use one? To use an existing server, usually not. To build one, yes.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

sec.cors.wildcard - CORS is not wide open
sec.headers.hsts - Strict-Transport-Security header
sec.https.enabled - Site is served over HTTPS
sec.error-disclosure - Error pages do not leak stack traces

Run a free audit See a full sample report See the whole check library