What Is an MCP Server? Model Context Protocol Explained
An MCP server is the bridge that lets AI like Claude and ChatGPT read files and run tools on your machine. Understand the Model Context Protocol, remote MCP, OAuth 2.1, and how to start safely.
An MCP server is a middleware program that lets AI models such as Claude, ChatGPT, Grok, or Gemini reach external data, tools, and execution environments through one shared standard. The Model Context Protocol (MCP) is an open standard pioneered by Anthropic that acts like a "USB-C port for AI": a single protocol so any AI can plug into any data source or tool, instead of a bespoke integration for each pair.
How does MCP work?
An MCP setup has three parts. The MCP client is the AI side (Claude Desktop, ChatGPT, an agentic IDE...). The MCP server exposes tools and data (read files, run shell, query a database...). The transport layer connects them — over stdio locally or HTTP/SSE remotely.
- ◆Client: the AI model that needs external tools
- ◆Server: where tools are declared and executed
- ◆Transport: stdio (local) or HTTP/SSE (remote)
How do local and remote MCP servers differ?
A local MCP server runs over stdio, bound tightly to one machine and an app like Claude Desktop — convenient, but unreachable from the web or a phone. A remote MCP server exposes an endpoint over HTTP/SSE, so Claude.ai on the web, ChatGPT, or a mobile app can all call it, as long as there is a public HTTPS address.
How do you let Claude.ai or ChatGPT read files and run commands on your machine?
You need three layers. A tunnel such as Tailscale Funnel or Cloudflare Tunnel puts a local port on the internet with HTTPS, without opening router ports. A remote MCP server speaks HTTP/SSE over that tunnel. Finally, authentication ensures only you can call the tools. This is exactly the architecture aki-mcp-sv ships: one npm start turns a machine into an MCP server for Claude, ChatGPT, Grok, Gemini, and Postman.
Is exposing a machine to the internet dangerous?
An MCP server exposing a shell and filesystem to the internet is a real attack surface, so security is not optional. Three core layers: OAuth 2.1 + PKCE so only an authorized client gets a token; a passphrase at the authorization step; and most importantly, a shell whitelist instead of a blocklist.
Why a whitelist? A blocklist (deny-listed commands) is always leaky — no one can enumerate every dangerous command. A whitelist denies everything unless explicitly declared, down to the subcommand. Read more in Whitelist vs blocklist for MCP shells.
The fastest way to understand MCP is to run a real server. aki-mcp-sv is an open-source (MIT) MCP server that bundles the tunnel, OAuth 2.1, and a shell whitelist — letting Claude web, ChatGPT, and Grok read, edit files, and run shell on your machine with no desktop app to install.