Your coding agent is good at reading and writing files. On its own, though, it can't see your database, your error tracker or your tickets. You end up copying and pasting between tabs, and the agent works from whatever you remembered to paste. So what is MCP, and why does it fix this?
The Model Context Protocol (MCP) fixes that. It's an open standard that lets an AI app connect to outside tools and data through one common interface. This guide covers what MCP is, how to connect your first server in Cursor, Claude Code or Codex, and the safety habits that matter once your agent can act on real systems.
What is MCP? The 30-second version
MCP uses a client-server setup (MCP architecture docs):
- The host is the AI app you use, such as Claude Code, Cursor or VS Code.
- A client is the connection the host opens to one server. The host creates one client per server.
- A server is a program that gives the AI context or abilities, such as access to a filesystem, a database or a SaaS product.
A server can run locally on your machine (using the stdio transport) or remotely (using the Streamable HTTP transport). Remote servers usually sign you in with OAuth. Under the hood, messages are JSON-RPC 2.0. You almost never touch that layer, because SDKs and your editor handle it.
MCP has also moved to neutral governance. In December 2025, Anthropic donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation. MCP became a founding project alongside Block's goose and OpenAI's AGENTS.md (MCP blog, Linux Foundation).
What a server can offer: tools, resources, prompts
The protocol defines three core things a server can expose (architecture docs):
| Primitive | What it is | Example |
|---|---|---|
| Tools | Functions the AI can call to take actions | Run a SQL query, create an issue, deploy a function |
| Resources | Data the AI can read as context | A database schema, a file, an API response |
| Prompts | Reusable templates for interactions | A few-shot prompt for using the server's tools |
Clients discover what's available with */list methods, such as tools/list, so the set can change over time. The spec also lets servers ask you for input partway through a task, through a feature called elicitation. Supabase uses it to ask for confirmation before destructive SQL or a paid action, when your client supports it (Supabase MCP docs).
One thing to know if you build servers: the current protocol revision, 2026-07-28, makes each request self-contained (stateless) and deprecates the older "sampling" feature (architecture docs). If you only use servers, your client handles this for you.
Connect your first MCP server
We'll use the hosted Supabase MCP server as the example, since many vibe-coded apps run on Supabase. Its URL is https://mcp.supabase.com/mcp. You don't need a personal access token: your client opens a browser window and you sign in (Supabase MCP docs).
Cursor. Add this to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for all projects (Cursor docs):
{
"mcpServers": {
"supabase": {
"url": "https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true"
}
}
}
Claude Code. Use the CLI. --scope project writes the config to a .mcp.json file you can commit for your team (Claude Code MCP docs):
claude mcp add --scope project --transport http supabase \
"https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true"
Then run /mcp inside Claude Code to authenticate.
Codex. Supabase documents this command, followed by a login step (Supabase MCP docs):
codex mcp add supabase --url "https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true"
codex mcp login supabase
Notice the two query parameters. project_ref limits the server to one project, and read_only=true runs every query as a read-only Postgres user. Supabase recommends both, and so do we, especially for your first week (Supabase MCP docs).
To check it worked, ask your agent: "What tables are in my database? Use the Supabase MCP tools."
For every config format side by side, see how to add an MCP server to Cursor, Claude Code and Codex, or start from our MCP config starter files.
What it looks like day to day
With a database server connected, prompts like these work without any copy-pasting:
List the tables in my Supabase project and show me which ones
don't have Row Level Security enabled.
Look at the orders table schema, then write a typed query helper
in lib/orders.ts that matches it exactly.
Generate TypeScript types from the current schema and update
types/database.ts.
Supabase's server includes tools such as list_tables, execute_sql, get_advisors (security and performance advisors) and generate_typescript_types (Supabase MCP docs). Other servers work the same way. For example, Claude Code's docs show how to connect GitHub's remote MCP server to review PRs and create issues (Claude Code MCP docs).
Safety: the part you shouldn't skip
An MCP server acts with your permissions. Treat connecting one like giving a new contractor a key.
1. Prompt injection is real. Supabase's docs walk through an attack: a customer writes instructions into a support ticket, a developer asks their agent to read the ticket, and the agent follows the hidden instructions and leaks data. Claude Code's docs give a similar warning: "Servers that fetch external content can expose you to prompt injection risk" (Supabase, Claude Code).
2. Keep approvals on. Cursor asks before using MCP tools by default, and most clients ask you to accept each tool call (Cursor docs, Supabase). Read the arguments before you click approve, especially for anything that writes data.
3. Scope down. Use read-only mode, limit the server to one project, and turn on only the tool groups you need (Supabase supports ?features=database,docs, for example). Don't point an agent at production data unless the task really needs it (Supabase).
4. Never hand your MCP server to customers. Supabase is explicit about this: the server runs with your developer permissions, so use it only as an internal tool.
5. Install from sources you trust. Cursor's guidance is to verify the source, review permissions, use restricted API keys and audit code for critical integrations (Cursor docs).
6. Keep secrets out of config files. Cursor supports ${env:NAME} interpolation in mcp.json, and Claude Code supports ${VAR} expansion in .mcp.json. Use them so tokens don't end up in Git.
For the protocol-level risks behind these habits, read our guide to MCP security best practices.
When to use MCP (and when not to)
Use MCP when you keep pasting data from the same system into chat, or when you want the agent to check its work against something real, like a live schema or an error log.
Skip it when a plain CLI command would do the job. And remember that every connected server adds tools the agent has to consider. Claude Code's /doctor checkup even flags unused MCP servers by how much context they cost (Claude Code skills docs). Connect what you use, and disconnect the rest.
Keep reading
- How to add an MCP server to Cursor, Claude Code and Codex
- MCP security: how to use MCP servers without leaking data
- What are agent skills? How to write your first SKILL.md
FAQ
What is MCP in simple terms?
MCP, the Model Context Protocol, is an open standard that lets AI apps such as Cursor, Claude Code and Codex connect to outside tools and data through one common interface.
Is MCP safe to use?
MCP is as safe as the servers you connect and the permissions you give them. Use trusted servers, keep tool approvals on, prefer read-only and project-scoped access, and keep tokens in environment variables.
Do I need to code to use an MCP server?
No. You add a server to a config file or run one command, such as claude mcp add or codex mcp add, and then sign in. Building your own server is optional.
Who maintains MCP?
Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation, in December 2025.