A specification for giving a model access to tools and data, read for what it standardises rather than for what it enables.
what it is: a JSON-RPC protocol with three primitives —
tools (callable), resources (readable), prompts
(templates) — over stdio or HTTP.
what that means practically: a server exposing a
database or an API can be written once and consumed by
any client that speaks the protocol.
what is interesting about it: the authorisation model
is the host's problem, not the protocol's. a server
that exposes a database exposes whatever the credential
it was given can reach.The protocol is small and the security model is delegated, which is the sensible design and puts the entire burden on whoever configures the server. Reading it as a protocol is worth the hour — the interesting question is not what it enables but what a server should refuse to expose, and the specification deliberately has no opinion.