What is an MCP server? How Model Context Protocol servers work

Editorial team · updated 24 September 2026 · facts checked 24 September 2026

An MCP server is a program that lets an AI application, such as Claude, ChatGPT, Cursor or Claude Code, use an outside system through the Model Context Protocol (MCP). It presents an API or data source as named tools and data. The app connects as a client, and the model decides when to call a tool, such as ClickSend's send-sms or Postmark's listTemplates.

Anthropic open-sourced MCP on 25 November 2024 and donated it in December 2025 to the Agentic AI Foundation, a fund under the Linux Foundation. The specification is Apache 2.0 licensed; the current revision is 2026-07-28. Messages are JSON-RPC 2.0.

Tools, resources and prompts

Servers offer three kinds of features:

Tools are the risky part, since they act: the spec says there "SHOULD always be a human in the loop with the ability to deny tool invocations".

Local (stdio) vs remote (Streamable HTTP) MCP servers

The spec defines two transports:

• stdio (local): the client starts the server as a subprocess, often with npx, and talks over standard input and output. Credentials come from environment variables; the server runs with your permissions.
• Streamable HTTP (remote): the server sits behind one endpoint, such as https://mcp.example.com/mcp, that takes each message as a POST. It replaced HTTP+SSE in the 2025-03-26 revision.

A "remote MCP server" is the second kind. Streamable HTTP servers must validate the Origin header, and a local one should listen only on 127.0.0.1.

How MCP servers handle sign-in: OAuth 2.1 with PKCE

Authorization is optional, and stdio servers "SHOULD NOT" follow it. A remote server that requires sign-in acts as an OAuth 2.1 resource server:

1. A request without a token gets 401; the client then reads the server's protected resource metadata (linked in the WWW-Authenticate header or at a well-known URL) to find its authorization server.
2. The client registers (Dynamic Client Registration is deprecated as of 2026-07-28), and the user approves access in a browser. The client must use PKCE and stop if the authorization server doesn't advertise it.
3. The token is issued for that one server, which must not pass it on to an upstream API.

How to connect an MCP server to Claude Code or Cursor

The first command adds this directory's read-only MCP server: no sign-in, 10 tools that search, compare and rank providers. Illustrative, not run:

claude mcp add --transport http pingmyusers https://pingmyusers.com/mcp
# stdio server: the launch command follows --
claude mcp add example --env API_KEY=your-key -- npx -y @example/mcp-server

The directory's tools declare readOnlyHint; the spec tells clients to trust such hints only from trusted servers. In Claude Code, /mcp handles OAuth sign-in; --scope project writes to .mcp.json, a shared file, so keep keys out of it. Cursor reads .cursor/mcp.json (one project) or ~/.cursor/mcp.json (all projects) and by default asks for approval before it uses an MCP tool:

{
  "mcpServers": {
    "pingmyusers": { "url": "https://pingmyusers.com/mcp" },
    "example": { "command": "npx", "args": ["-y", "@example/mcp-server"], "env": { "API_KEY": "${env:EXAMPLE_API_KEY}" } }
  }
}

Official, community and third-party MCP servers

The directory calls a server official when the provider publishes and maintains it, official, docs only when it only searches documentation, and community or third-party when someone else wrote it.

The official MCP Registry, in preview, verifies namespace ownership, but a brand name in a listing proves nothing: on 24 September 2026 every entry we found for Resend, Mailgun, Brevo, Postmark, Twilio, Mailjet and SendGrid came from a third party. In September 2025 an impostor postmark-mcp npm package added a backdoor that copied emails to an outside server, Postmark reported.

MCP servers for email, SMS and WhatsApp APIs

All 27 providers in our MCP dataset, from CPaaS vendors to single-channel APIs, have some MCP server, though not always their own (checked 24 September 2026). On this page, provider lists follow the Developer & AI score as it stood on 24 September 2026 (methodology); the MCP dataset shows current scores:

• Remote: 12 of the 19 host a server that works with your account. For the other seven it runs only on your machine: Mailgun, Mailtrap, Sinch, Vonage, Postmark, ClickSend and Mailjet (Sinch and Vonage host docs-search servers only).
• OAuth: 10 of those 12 document OAuth sign-in, and Bird, Textmagic, 360dialog and WATI document no other method. Brevo's server advertises OAuth in its metadata but documents only a token; SMTP2GO's takes an API key. The local ones read keys from environment variables.
• Caveats: AWS End User Messaging and Amazon SES use one general AWS server, Twilio's docs server also covers SendGrid, and Mailjet's server only reads.

MCP support also counts in rankings such as transactional email and WhatsApp.

Token scope and prompt injection

A server can do whatever its credential allows, and the spec's security best practices call omnibus scopes such as all a common mistake. On 24 September 2026 the SendPulse, Brevo and WATI MCP servers each offered one OAuth scope (rest at SendPulse, all at the other two), and Infobip's WhatsApp server one product scope, whatsapp:manage, though Infobip API keys can be limited to sending. Telnyx publishes 32 scopes, Textmagic nine and 360dialog 13.

Tool results are text the model reads. An inbound email or WhatsApp reply can carry instructions, and a model holding a send tool may follow them: indirect prompt injection, in OWASP's terms. Keep approval on for tools that send or delete, don't pair inbound reading and sending in one unattended session, and revoke the credential afterwards (vibe coding security checklist).

Related guides

• Email MCP servers
• WhatsApp MCP servers
• OAuth for AI agents and MCP
• What is llms.txt?
• MCP and agent skills dataset

About this guide

The PingMyUsers editorial team wrote this entry. Sensaria AG in Switzerland runs the directory and its MCP server; providers don't pay for placement, and none reviewed this page. Report errors, with a source, to contact@sensaria.ch.

Methodology

On 24 September 2026 we re-read the MCP specification (2026-07-28), Anthropic's announcements and the Claude Code and Cursor docs, and fetched the OAuth metadata and registry entries quoted. Counts come from the directory's dataset, checked that day. We installed no server.

Last updated

24 September 2026: first version. Next re-check: March 2027, or sooner if the specification changes.

Frequently asked questions

What is the difference between an MCP server and an API?

An API is the provider's interface for code; an MCP server wraps APIs as tools a model can call and makes the requests itself.

What is a remote MCP server?

One reached at an HTTPS URL over Streamable HTTP, with nothing to install. Sign-in, if required, uses OAuth 2.1 with PKCE.

Does MCP only work with Claude?

No. The MCP docs list ChatGPT, Visual Studio Code and Cursor among its clients.

Are MCP servers safe to use?

As safe as the code and credential behind them: install from the provider's docs, use the narrowest scope, and keep approval on for sends.

How do I build my own MCP server?

The official server tutorial builds a weather server with two tools, get_alerts and get_forecast, and connects it to Claude for Desktop. It runs over stdio, where a stray print() or console.log() to stdout corrupts the JSON-RPC stream.