What an MCP server does

An MCP server is a process that publishes tools and then performs the ones a client is allowed to call. The model is not inside it. The useful part is the publishing.

A client connects and asks what exists. The server answers with names, descriptions, and schemas. That answer is the allowlist. If a tool is not in the answer, there is nothing to call. The prompt does not get to widen the list by being persuasive.

A call is a name plus arguments. The server checks both against what it published. Then it does the thing, and returns a result the client can log. The result should be boring enough to compare with the arguments. If you cannot tell the server's output from the model's narration, the boundary is decorative.

This is why a toy that only echoes is a reasonable first server. Echo has no side effect to hide behind. You can watch a call leave, land, and come back. After that, a dangerous tool is the same shape with a worse body: navigate, write a file, send a message. The protocol did not become safer because the tool became exciting. The safety was the list.

People talk about MCP as a way to give agents hands. The more precise version: it is a way to make the hands enumerable. An enumerable hand can be refused. A hand described only in a prompt is a rumor.

Sample draft. The echo server in the lab is the small version of this idea. It is not a product, and it does not integrate with anyone's company stack.