What an MCP server is, and what it changes if you never run one

An MCP server is a program that publishes one application’s capabilities as a list an AI assistant can read and call, so the assistant can do work inside that application instead of only describing it. It runs on the application’s side of the line rather than yours, operated by the app’s vendor, by your own administrator, or by a connector service, and inside Claude and ChatGPT the thing you actually switch on is labeled a connector rather than a server. So for almost everyone the useful question is not how to build one but whether one already exists for the software you pay for, and what you are willing to let it change.

Who this page is written for. Someone who uses Slack, a CRM, a documents tool and a shared drive every day, does not write code, and is not going to install anything on a machine. If you came here to stand up a server, the protocol’s own documentation at modelcontextprotocol.io is the better door and this page will move too slowly for you.

What is an MCP server, in plain language?

It is a written list of what one application will let an assistant do, in a format the assistant can read, plus the small program that answers those requests when they come. The Model Context Protocol is the open standard that fixes the format of that list, described by its own documentation as an open-source standard for connecting AI applications to external systems (modelcontextprotocol.io, retrieved 2026-08-22). Anthropic published it on 2024-11-25 and made it open rather than proprietary (anthropic.com, 2024-11-25), and in December 2025 donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation, where the existing maintainers keep full autonomy over technical direction (blog.modelcontextprotocol.io, retrieved 2026-08-22). It is no longer one company’s to reprice or retire, which is the difference between learning a feature and learning a standard. It is now on a revision dated 2026-07-28 (modelcontextprotocol.io/specification/latest, checked 2026-08-22).

Three kinds of thing can be on that list. Tools, which are actions the assistant can ask for. Resources, which are pieces of content it can read. Prompts, which are prewritten instructions the app suggests. The reason the list matters more than the plumbing is that it is where the app’s real surface area shows up, and that surface is much wider than the interface you look at every day. In a snapshot of Composio’s connector catalog queried 2026-08-22, the median published application exposes 19 distinct actions retrieved, and the deepest exposes 574. Zendesk exposes 452. Those are actions retrieved from the connector catalog, which is the count the site’s own catalog file publishes; the catalog’s listing advertises a slightly lower figure for 111 of the 1,000 applications, 565 actions lower in total. Nobody who uses Zendesk daily could name fifty things it can be asked to do, because the menus never offered them.

That catalog counts connector actions rather than the tool list of any particular vendor’s MCP server, and the two are not the same census. It is quoted here for the shape it shows: the capability was already in the software, and the path to it used to run through a developer.

Do I have to run one myself?

Almost certainly not, and the word “server” is the part of the term doing the damage. Whoever operates the application operates the server. That is one of three parties, none of them you: the vendor of the app, hosting it themselves so you sign in and it works; your own IT administrator, approving one at the workspace level; or a connector service that holds the connection on your behalf. What is left on your side of the line is a sign-in and a decision about scope.

This is also why almost everything written about the term reads like a manual. On a search results pull for “mcp server” made 2026-08-22, United States, English, the AI Overview cited seven distinct domains across nine reference slots, seven of the nine either the protocol’s own property, a developer publisher, a dev-tooling vendor’s blog, or a community thread about building and securing servers, the two exceptions being a Wikipedia article and a video, and it closed by asking the reader whether they wanted to use an existing server or build one, and in what language. Two of the eleven top slots were server directories and one was a forum thread. Asked the same question through an assistant on the same day, ChatGPT volunteered a section headed “Who is MCP for?” and named three audiences: developers building AI applications, companies connecting AI to internal systems, and tool providers exposing services to assistants (DataForSEO ChatGPT scraper, measured 2026-08-22).

All three of those audiences build or operate systems. The fourth audience, the one whose company already runs the software and who wants to know what changes on Tuesday, has been reading documentation addressed to somebody else.

Why does everyone compare this to USB-C, and what does that get wrong?

Because the protocol’s own documentation uses that comparison, and it spread from there into nearly every explanation of the term. It is accurate about the thing it was chosen to explain, which is standardization: one agreed format instead of a separate custom integration for every pair of app and assistant. It is misleading about three other things, and those three are exactly what a non-technical reader takes away from it.

The port is not on your device. A USB-C socket is on the laptop you own; the MCP interface sits on the application’s side, put there by someone else, and its absence is not a thing you can fix by buying an adapter. The plugging is not yours either. With a cable you supply both ends and the motion; with MCP the only part that belongs to you is permission, which is a smaller job and a more consequential one. And a cable is one connection at a time, while a published list is read and called repeatedly by whatever client has been allowed to.

A closer comparison is a menu. It is written by the people doing the cooking, it is always shorter than what they could actually make, it changes without consulting you, and ordering from it is still entirely your decision. That framing also tells you how to evaluate one: by what is on the list and who wrote it, not by how it is wired.

Does one already exist for the apps I pay for?

For more applications than most people expect, and for most, still no. The way to find out is to look rather than to reason about it. The public MCP registry at registry.modelcontextprotocol.io is a paginated open API whose limit parameter caps at 100 results; walking all 243 pages with version=latest on 2026-08-22 returned 24,221 distinct server names. Counts near 7,100 that circulate, including earlier ones published on this site, came from a walk that stopped before the end.

Joined against a 1,000-application connector catalog by name on the same date, that registry matches between 294 and 318 applications depending on how strictly names are compared, and between 165 and 180 of the 589 applications this site publishes. Those are name matches rather than verified vendor servers. Checked one application at a time, 20 of 41 widely used business applications had a server published by their own vendor and 21 did not: the rows and the evidence are on the best MCP servers page.

The other numbers circulating are smaller than the registry, not larger. The directory at mcpservers.org advertised “9800+ official and community MCP servers” in its own search snippet on 2026-08-22, against the registry’s 24,221. Neither figure is a count of servers published by the vendor of the app, and that distinction is the one that matters over a year.

Registry presence is not vendor endorsement. Two checks settle it, and either is sufficient: a reverse-DNS namespace on the vendor’s own domain, such as app.linear/linear on linear.app or com.notion/mcp on notion.com; or an io.github.<org> namespace where that GitHub organization owns the product’s canonical repository, such as io.github.github/github-mcp-server. The registry’s repository.url field is what corroborates both. A domain comparison on its own is not enough: GitHub, Firecrawl and SAP all publish their own servers under io.github.*, and Sentry publishes under io.github.getsentry rather than under its product name (registry queries, 2026-08-22). A stranger’s server for your CRM will appear in a listing beside the vendor’s, and only the vendor is on the hook when the CRM changes.

The per-application answers live in the app pages on this site rather than on this one. The tools index is the entry point, and the individual pages carry the action surface, the in-product AI verdict, and the date each was checked: Notion, Slack, HubSpot, Asana.

What is the difference between MCP and an MCP server?

MCP is the agreement; a server is one thing built to it. The protocol is the written format that says how a list of capabilities is described and how requests against it are made. A server is a specific program, for a specific application, that publishes such a list and answers those requests. There is one protocol and there are many servers, in the same way there is one postal address format and many buildings.

Two consequences follow for a reader. You never install the protocol, because it is not software; you connect a server, or more likely a connector built on one. And a sentence like “does this app support MCP” is really asking whether anybody has published a server for that app and whether your assistant can reach it, which is a question with a date on it rather than a permanent property.

Where do I find it in the AI I already talk to?

In the ordinary settings, under a different word. On claude.ai you open Customize, then Connectors, choose a service, click Connect, and sign in the way you normally would (Anthropic, Use connectors to extend Claude’s capabilities, retrieved 2026-08-22). Searching your settings for the letters M, C and P finds nothing, and nothing is missing from your plan. MCP is the protocol underneath; a connector is what Anthropic calls the thing built on it (Anthropic, Connectors overview, retrieved 2026-08-22).

Two nearby words mean different things and are worth keeping straight. A desktop extension is a connector that runs on your own computer, for reaching local files or an installed application (Anthropic, When to use desktop and web connectors, retrieved 2026-08-22). A plugin is a package that can bundle connectors together with other material, available in Claude Code and Claude Cowork (Anthropic, Connectors overview, retrieved 2026-08-22).

The naming gap is not confined to Anthropic. Microsoft made MCP integration generally available in Copilot Studio in May 2025 (Microsoft, published May 2025; the exact day was not confirmed). If a tutorial tells you to add a server and your interface offers no such button, you are looking for the local word.

Does ChatGPT use MCP?

Yes. The protocol’s documentation lists ChatGPT among the applications that support MCP, alongside Visual Studio Code and Cursor (modelcontextprotocol.io, retrieved 2026-08-22), and in a measured run on 2026-08-22 ChatGPT’s own answers about MCP cited the protocol’s documentation and its 2026-07-28 specification update (DataForSEO ChatGPT scraper, measured 2026-08-22).

What is not settled by that is which of your options are switched on. Exactly which ChatGPT plans expose which connectors, on which surfaces, was not checked for this page, and it is the kind of detail that moves. Read the client list as evidence that the protocol is not a single-vendor arrangement, not as a promise about what your account can do this afternoon.

The direction of adoption is easier to read in what vendors have shipped than in what people search for. Checked one application at a time on 2026-08-22, twenty widely used business applications had a server published by their own vendor, including Notion, Linear, Atlassian, Figma, Stripe, Airtable and monday.com, and Zoom alone publishes seven (the best MCP servers page carries the rows). The search figures point the same way and sit in the sources at the foot of this page, because search volume measures curiosity rather than whether something matters in the work.

Isn’t this just an API with a new name?

An MCP server sits on top of an API and does a different job with it. An API states how software can call a service, which presumes a programmer who reads the documentation once and writes the calling code. A server states what an assistant can discover and use, which means the list is fetched at the moment of the request and the assistant reads it fresh. The same distinction turned up unprompted in a measured assistant answer on 2026-08-22, phrased as the difference between “here is how software can call my service” and “here is how AI assistants can discover and use my service” (DataForSEO ChatGPT scraper, measured 2026-08-22).

Discovery is the whole of the practical difference. It is why nobody has to ship an integration for the specific pair of your assistant and your CRM, and it is also why the list can grow on the vendor’s schedule without anything on your side being rebuilt. The longer version of the comparison, including the rows in every published comparison table that the July 2026 specification revision made wrong, is on MCP vs API.

Do I have to be good at the app before this is worth anything?

No, and the belief that you do is the most common reason people stop. The assumption is that AI capability sits on top of tool expertise, so you would have to be an expert in an application before an assistant could do anything useful inside it. The dependency runs the other way. What the assistant lacks is not skill with the software, it is knowledge of your work.

Four answers cover most of it, and they are the same four used on every guide on this site.

1. What is this task’s one job?
2. What does a good result look like, specifically enough that someone else could tell?
3. What must never happen without my approval?
4. What supervision does this task need?

None of those is a technical question, and an assistant that has read a half-specified request will ask about the gaps rather than guess.

How much does an MCP server cost?

For the case that covers most people, nothing beyond what you already pay, because the server a vendor publishes for its own product is part of that product. “How much does an MCP server cost” appears in the People Also Ask block for this term, measured 2026-08-22, which suggests the assumption of a separate purchase is widespread. The costs that do exist sit in two other places: the assistant subscription, and the plan tier of the app itself.

The second one is where this gets interesting, because reachability and in-product AI are gated separately. Notion states that Notion AI runs on Business and Enterprise plans, with Free and Plus getting a capped number of complimentary responses (Notion, verified 2026-08-22). That gate is on the AI features Notion built into Notion. It is a different gate from whether your assistant can read and write in your workspace from outside, and the outside route is frequently open on a plan where the inside one is not.

Third-party hosted servers do exist and some of them charge, per seat or per call. None were priced for this page, so treat the “nothing extra” answer as covering the vendor-published and managed-connector cases only.

What can my AI actually do once one is connected?

More reading than changing, and the reading is where most of the surface lives. Across the 589 applications this site publishes there are 26,826 distinct actions retrieved. Counting an action as a read when its name, with the application prefix removed, contains get, list, search, find, retrieve, fetch, or read as a separate word, 13,303 of them qualify, about 50 percent (Composio catalog snapshot, queried 2026-08-22). A different word-boundary rule moves the count by a few hundred and does not move the shape.

The second number is smaller than the category’s reputation suggests. Only 34 of those 589 applications can start work without being asked, and only 38 across all 1,000 entries in the snapshot. The 1,000 is the ceiling of the tool that produced the snapshot, which records the truncation in its own metadata, so it is a floor rather than a count. Almost nothing in an ordinary stack acts on its own. In practice, a connected server means your assistant does the thing you asked, inside the app, at the moment you asked, and then stops.

The median of 19 actions is the figure to hold when you are deciding what to attempt. Most applications expose enough for one bounded job and not enough for an open-ended one, which is a fact about scoping rather than a limitation to work around.

Is it safe to point one at my email or my files?

The standard puts the decision at each individual action. Its security principles state that a host must obtain explicit user consent before invoking any tool, and the same section says that MCP cannot enforce these principles at the protocol level, leaving implementors SHOULD-obliged to build consent and authorization flows into their applications (modelcontextprotocol.io/specification/latest, checked 2026-08-22). So consent is written into the standard as a principle and delivered by whoever built the client you are using. Both halves are worth knowing. In Claude specifically, a connector cannot reach anything your own account in that app cannot already reach, because it inherits your permissions from the connected service (Anthropic, retrieved 2026-08-22). So the question before you click is not what the assistant will be able to see. It is what you want it to be able to change.

How the credential is held is the other half, and it is where a managed connector differs from the older approach of pasting an API key into a configuration file. A managed connector keeps the credential on its own side, refreshes an OAuth token before it expires, and lets a connection be switched off in one place without editing any file, while the provider’s own security settings can still revoke it outright (Composio, checked 2026-08-22). A key in a config file does none of that and keeps working silently until somebody remembers it is in there. This is plumbing, and it is worth understanding for one reason: plumbing you do not understand is plumbing you cannot turn off.

What none of that settles is ownership of the result. Consent at the moment of the call protects the action. It says nothing about who is answerable six months later for what the action produced, and that decision is organizational rather than technical.

How much of a job should I hand over once it works?

That depends on the job, not on how much you have handed over before. There are four shapes this work takes. They are not four levels, there is no order to them, and nobody graduates. People who do this well keep all four in use permanently, because each is wrong for exactly what the others are right for.

A server makes all four possible in an app that used to allow none of them. It does not tell you which one the task in front of you deserves, and that judgment is the part that stays with you.

When is an MCP server the wrong answer?

When the control you want is one the server does not provide. Four cases come up often enough to name.

The application is not reachable at all. Thousands of products have no API worth integrating, no managed connector and no server, which is why they never appear in a catalog like this one. If yours is one of them there is nothing to point an assistant at, and the honest options are to wait or to change tools.

You cannot check the result. This disqualifies the most tempting tasks. If you have no way to look at the output and know whether it is right, connecting a server relocates the error into a place you will find later, at a worse time.

The job happens once. A single read you could do yourself in four minutes is not worth an approval conversation with an administrator. The server pays off on the thing you do weekly.

The server is a stranger’s and the app is a system of record. For anything other people depend on, a third-party server introduces a party who can neither fix the app nor be held to its behavior. Wait for the vendor’s, or use a route where the credential handling is somebody’s stated responsibility. Which applications have a vendor’s own server is on the best MCP servers page.

This page stops at what one person can find out and ask for. Anything that promises a result across a whole team is a different kind of project with a different kind of budget, and it is not what a page like this can deliver.

What could a careful check not establish here?

Every item below is something this page would need in order to be more confident than it is. None is a reason to avoid the subject.

How many tools any specific vendor’s server exposes. The action counts on this page come from a connector catalog, not from reading the tool list of a running MCP server. The two censuses overlap and are not the same, and no per-server tool count was taken.

How many servers exist. Full pagination of the registry returned 24,221 distinct names on 2026-08-22, and a directory advertised “9800+” on the same day. The two count different populations by different rules, and neither reports how many were published by the vendor of the app in question.

What “official” means in the registry. Two checks settle who published a server, a reverse-DNS namespace on the vendor’s domain or an io.github.<org> namespace whose organization owns the canonical repository. Neither establishes that the server is maintained, complete, or safe for a task. A third party can publish a server for a product it has nothing to do with and the registry will list it beside the vendor’s own.

Whether a given action changes anything. The read proportion classifies 26,826 actions by the shape of their names, not by reading what each one does. Some calls that look like reads have side effects and some that look like writes are idempotent. It is a rough shape, not an audit.

Which assistant plans expose which connectors. The protocol documentation’s client list establishes that ChatGPT, VS Code and Cursor support MCP. It does not establish what any individual account can switch on, and that was not checked.

What third-party hosted servers cost. None were priced. The cost answer on this page covers vendor-published servers and managed connectors.

How many reachable applications there are. The catalog snapshot stops at exactly 1,000 because that is the ceiling of the tool that produced it, and the snapshot records the truncation in its own metadata. So 1,000 is a floor and the real figure is unknown.

How many of the 589 a person can turn on unaided. The 589 published applications were not checked for how many are reachable without an administrator enabling something first. That count does not exist yet, and it is the gap between the figures on this page and what a reader can do this afternoon.

Whether any of this saves time, or how much. No measurement was run. Any time saving attached to a connected server, including any figure this site produces later, is an estimate until it is measured against the specific task.

Which action count is canonical. Two columns in the catalog disagree for 111 of the 1,000 applications, 565 actions in total. This page uses the retrieved count, which is what the site’s own catalog file publishes.

Whether the vendor verdicts are still true. All 83 vendor-documentation checks behind this site’s in-product AI verdicts carry a single verification timestamp of 2026-08-22, and none has been re-checked since. A dated claim is more honest than an undated one and it is not the same thing as a current one.

What the search field looks like on any other day. The AI Overview, the People Also Ask block and both assistant answers described here are single live pulls from one moment on 2026-08-22. All three reshuffle.

What did this page check, and when?

Application counts, action counts, read and write proportions, in-product AI verdicts and trigger counts come from a snapshot of Composio’s connector catalog, queried 2026-08-22.

Search results, People Also Ask contents, AI Overview citations and assistant answers were pulled from DataForSEO, United States, English, desktop, on 2026-08-22. Google volume and AI-channel figures were measured 2026-08-21 and 2026-08-22: “mcp server” returns 60,500 reported monthly Google searches at competition index 23 and a $16.64 cost per click, on a twelve-month series whose latest month is 49,500. The reported volume and the latest month are two different figures and are not mixed in one clause anywhere on this site.

One caveat travels with every AI-channel figure above. DataForSEO derives ai_search_volume from People Also Ask data in the search results page. It is a modeled rate rather than a count of assistant queries, and it is not summable: many phrasings of the same question return one identical figure. Read it as a second directional instrument beside Google volume, never as a measurement of what assistants were actually asked.