How does an MCP server connect with an AI agent? What is the workflow?

How Does an MCP Server Connect with an AI Agent?

MCP uses a client-server architecture over a local protocol (stdio or HTTP/SSE). Here's the complete connection and workflow.

Architecture Overview

textCopy
┌──────────────────────────────────────────────────────────┐
│                    AI Client                             │
│  (Claude Desktop / Claude Code / Cursor / IDE)           │
│                                                          │
│  ┌─────────────────────────────────────────────────┐    │
│  │            MCP Client (built-in)                │    │
│  └──────────────┬──────────────────────────────────┘    │
└─────────────────┼────────────────────────────────────────┘
                  │ stdio (stdin/stdout) or HTTP/SSE
                  │
┌─────────────────┼────────────────────────────────────────┐
│                 │  MCP Server                             │
│  ┌──────────────▼──────────────────────────────────┐    │
│  │  Exposes: Tools | Resources | Prompts            │    │
│  └─────────────────────────────────────────────────┘    │
│         ↕ calls                                          │
│  External services (DB, API, filesystem, browser)        │
└──────────────────────────────────────────────────────────┘

Connection Protocol (Step by Step)

textCopy
1. AI client reads MCP config (e.g., ~/.claude.json)
2. Client launches MCP server process (e.g., npx @mcp/filesystem)
3. Client sends: initialize request
4. Server responds: capabilities (tools list, resource list)
5. Client sends: initialized notification
6. Connection established — ready for tool calls

JSON-RPC Message Format

MCP uses JSON-RPC 2.0 over stdio:

jsonCopy
// Client → Server: List available tools
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list",
  "params": {}
}

// Server → Client: Tool definitions
{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "tools": [
      {
        "name": "read_file",
        "description": "Read a file from the filesystem",
        "inputSchema": {"type": "object", "properties": {"path": {"type": "string"}}}
      }
    ]
  }
}

// Client → Server: Call a tool
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "read_file",
    "arguments": {"path": "/Users/me/document.txt"}
  }
}

// Server → Client: Tool result
{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [{"type": "text", "text": "Document contents here..."}]
  }
}

Complete Agent Workflow

textCopy
User: "Read my config.py and check for security issues"
          ↓
[AI Agent/Claude]
          ↓
1. Agent decides: use filesystem MCP to read file
          ↓
2. MCP tool call: read_file({path: "config.py"})
          ↓
[Filesystem MCP Server] → reads file → returns content
          ↓
3. Agent receives file content
          ↓
4. Agent analyzes: "I see hardcoded credentials on line 15"
          ↓
5. Agent responds to user with security findings

Configuration

jsonCopy
// ~/.claude.json — MCP server registration
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me"],
      "env": {}
    },
    "postgres": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres"],
      "env": {"DATABASE_URL": "postgresql://localhost/mydb"}
    }
  }
}

Transport Types

Security Model

• MCP servers only expose what they explicitly define as tools/resources
• Each server runs as its own process with its own permissions
• Claude cannot directly access anything not exposed through MCP
• Users control which servers are connected via config