Terms
Every term in this hub.
This hub collects the protocol terms in the Prefactor glossary. The MCP core group covers the protocol's building blocks and is the right starting point: what a server exposes, what a client consumes, and how capabilities are discovered and negotiated. The tool calling group covers the adjacent concepts that predate MCP and still matter, from function calling to tool definitions.
The interop group covers what comes after MCP: Agent-to-Agent protocols and the emerging standards for agents that talk to each other rather than just to tools. It is the least settled part of this vocabulary, and the entries say so where a term is still more proposal than practice.
The attacks group deserves its placement in this hub rather than a generic threats page: tool poisoning, rug pulls, and substitution attacks are protocol-specific by nature. They exploit the trust a client extends to a server, and they only make sense once you understand the handshake they abuse. Reading the core group first makes the attacks group twice as useful.
Terms are grouped below from foundation to frontier: MCP core, then tool and function calling, then authentication for protocol connections, then interop, then the attack patterns. Each entry links to its full definition.
MCP core
MCP (Model Context Protocol) Model Context Protocol (MCP) is an open protocol for connecting AI applications and agents to external tools, data sources, and services through a standard interface. MCP (Model-Context-Protocol) Authentication MCP authentication is the process of verifying the identity of an MCP client, server, user, or delegated agent before any tools, resources, or prompts are exchanged. MCP Authorization MCP authorization is the process of determining what an authenticated MCP client or agent is permitted to do once its identity has been verified. MCP Capability Negotiation MCP capability negotiation is the handshake process between an MCP client and server at connection time where each side declares which features and protocol versions it supports. MCP Client An MCP client is the part of an AI application or host environment that connects to MCP servers, authenticates, discovers available capabilities, and invokes tools on behalf of a user or agent workflow. MCP Gateway An MCP gateway is a centralized proxy or control layer that sits in front of MCP servers to enforce authentication, authorization, rate limiting, and policy rules on every agent tool call. MCP Marketplace An MCP marketplace is a curated directory of publicly available MCP servers and tools, allowing AI developers to discover, evaluate, and integrate third-party capabilities. MCP Poisoning MCP poisoning is an attack where a malicious MCP server embeds hidden instructions inside tool descriptions, resource content, or prompt templates that manipulate a connected AI agent into taking unintended actions. MCP Prompt Template An MCP prompt template is a reusable, parameterised message sequence that an MCP server exposes to clients. MCP Resource An MCP resource is a piece of data or content, such as a file, database record, or API response, that an MCP server exposes to AI clients for reading. MCP Resource URI An MCP resource URI is a stable identifier for a data resource, such as a document, database record, or API response, that an MCP server exposes for agents to read. MCP Roots MCP roots are a security mechanism by which an MCP client declares the filesystem paths or resource namespaces that it consents to share with a connected MCP server. MCP Sampling MCP sampling is the mechanism by which an MCP server asks the connected AI client to perform an LLM inference call on its behalf, enabling server-side agentic patterns without the server having direct access to a model. MCP Security MCP security is the discipline of protecting Model Context Protocol deployments from authentication bypass, privilege escalation, prompt injection via tool responses, and unauthorized data access. MCP Server An MCP server is the service that exposes tools, resources, and prompts to AI clients through the Model Context Protocol. MCP Server Discovery MCP server discovery is the process by which an AI client or agent learns which MCP servers are available, what capabilities they expose, and how to connect to them. MCP Server Registry An MCP server registry is a catalogued inventory of available MCP servers within an organisation, recording each server's endpoint, supported tools, required permissions, and governance status. MCP Tool Approval MCP tool approval is the governance process of reviewing and authorising individual MCP server tools before an agent is allowed to invoke them. MCP Tool Definition An MCP tool definition is the machine-readable schema that describes a capability an MCP server exposes to AI clients, including the tool's name, description, input parameters, and type constraints. MCP Tool Schema An MCP tool schema is the machine-readable definition of a tool's input parameters, output format, description, and metadata published by an MCP server. MCP Transport MCP transport is the communication channel used to carry messages between an MCP client and server. MCP Version Pinning MCP version pinning is the practice of specifying a fixed protocol version when connecting to an MCP server rather than accepting the latest version automatically.
Tool & function calling
Protocol authentication
Interop & A2A
A2A Protocol (Agent-to-Agent Protocol) The Agent-to-Agent (A2A) protocol is an emerging open protocol for agents to describe capabilities, exchange tasks, and return results across different frameworks and vendors. Artifact (A2A) An artifact in A2A is a concrete output produced during a task, such as text, a file, or structured data. Content Modality (A2A) Content modality in A2A refers to the type of content agents exchange, such as text, files, audio, images, or structured data. Interoperability (Agent) Agent interoperability is the ability of agents built by different teams, vendors, or frameworks to exchange tasks and results in a consistent way. Message (A2A) A message in A2A is a single exchange between agents within a task. Streaming (A2A) Streaming in A2A is the delivery of partial results and status updates while a task is still running. Task Management (A2A) Task management in A2A is the lifecycle for a unit of work shared between agents.
Protocol attacks
Context Window Poisoning Context window poisoning is an attack in which malicious content is injected into an agent's input context, through a retrieved document, a tool response, or a prior conversation turn, with the intent of overriding the agent's instructions or causing it to take harmful actions. Rug Pull Attack (MCP) A rug pull attack in the MCP context is when a tool or server initially presents benign behaviour to gain user approval and trust, then silently changes its functionality after being whitelisted to perform malicious actions. Tool Poisoning An attack where a malicious MCP tool impersonates a legitimate service or injects hidden instructions into its responses, manipulating agent behavior without the user's knowledge.
More mcp & agent protocol terms
Agent Capability An agent capability is a specific skill or function an agent can perform, such as searching a database, calling an API, writing code, or sending a message. Agent Ecosystem An agent ecosystem is the broader environment of agents, tools, identity systems, protocols, and policies that let many agents operate together. Agent Protocol An agent protocol is a standardised interface that defines how agents communicate, exchange tasks, report status, and share results. AI Agent An AI agent is an autonomous software system that uses a large language model as its reasoning engine to perceive its environment, plan actions, call tools, and complete tasks with minimal human intervention at each step. AI Firewall An AI firewall is a security control layer that inspects AI agent inputs and outputs in real time to detect and block malicious content, policy violations, and anomalous behaviour. API Key (Agent) An API key is a static secret an agent can present to an API. Context Window A context window is the maximum amount of input a model can process in one request, measured in tokens. Exfiltration via Agent Exfiltration via agent is the use of a compromised or manipulated AI agent as a data exfiltration channel, leveraging the agent's legitimate access to sensitive systems to extract and transmit data to an attacker-controlled destination. Governance API A governance API is a programmatic interface that allows agents, orchestrators, and development tools to query policies, submit actions for approval, report events, and retrieve compliance status from a central governance platform. Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open standard developed by Anthropic that defines how AI agents and applications connect to external tools, data sources, and services.
Questions
Common questions.
What is MCP?
The Model Context Protocol is an open standard for connecting AI agents to external tools, data sources, and services through one consistent interface: servers expose capabilities, clients consume them.
What is the difference between MCP and A2A?
MCP connects agents to tools; A2A protocols connect agents to each other, exchanging tasks and results across frameworks. A2A is the newer and less settled of the two.
What are MCP-specific attacks?
Attack patterns that exploit the trust between MCP clients and servers: tool poisoning, rug pulls, and tool substitution. Each has an entry in the attacks group of this hub.