[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"portal-settings:stajic:es":3,"public-menus:all":38,"post:mcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits:es":205,"related:post:mcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits:es:1":3524},{"statusCode":4,"data":5,"message":37},200,{"tenantId":6,"lang":7,"defaultLang":8,"siteUrl":9,"contactEmail":10,"brandName":11,"logoUrl":12,"siteName":11,"siteDescription":13,"ogImage":10,"robotsIndex":14,"socialLinks":10,"reservedSlugs":10,"seoPolicy":15},"stajic","es","de","https:\u002F\u002Fstajic.de",null,"Stajic Platform","\u002FLogo_Planet.svg","Stajic Portal",true,{"branding":16,"relatedContent":17,"crossDomainLinks":18},{"logoUrl":12},{"enabled":14},[19,22,25,28,31,34],{"url":20,"label":21,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Ffigure.rocks","figure.rocks",{"url":23,"label":24,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Floving.rocks","loving.rocks",{"url":26,"label":27,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.com","bazify.com",{"url":29,"label":30,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.de","bazify.de",{"url":32,"label":33,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.at","bazify.at",{"url":35,"label":36,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.ba","bazify.ba","Portal settings resolved",[39,45],{"id":40,"name":41,"location":42,"isActive":14,"isDefault":43,"items":44},1,"main-navigation","header",false,[],{"id":46,"name":47,"location":48,"isActive":14,"isDefault":14,"items":49},4,"main-menu","sidebar",[50,66,79,93,103,118,133],{"id":51,"title":52,"url":60,"target":61,"icon":62,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":64,"portfolioId":10,"children":65},"item-18",{"de":53,"en":54,"es":55,"fr":56,"it":54,"ru":57,"sr":58,"zh":59},"Startseite","Home","Inicio","Accueil","Главная","Почетна","首页","\u002Ffull-stack-web-developer-munich-performance-seo-and-maintainable-builds","_self","i-lucide-home","page",111,[],{"id":67,"title":68,"url":75,"target":61,"icon":76,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":77,"portfolioId":10,"children":78},"item-22",{"de":69,"en":69,"es":70,"fr":69,"it":71,"ru":72,"sr":73,"zh":74},"Vision","Visión","Visione","Видение","Визија","想象","\u002Fueber-uns-webdesign-muenchen-webaplikation","i-lucide-eye",113,[],{"id":80,"title":81,"url":89,"target":61,"icon":90,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":91,"portfolioId":10,"children":92},"item-19",{"de":82,"en":83,"es":84,"fr":83,"it":85,"ru":86,"sr":87,"zh":88},"Leistungen","Services","Servicios","Servizi","Услуги","Услуге","服务","\u002Fservices-dienstleistungen-muenchen","i-lucide-wrench",116,[],{"id":94,"title":95,"url":99,"target":61,"icon":100,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":101,"portfolioId":10,"children":102},"item-23",{"de":96,"en":96,"es":96,"fr":96,"it":96,"ru":97,"sr":97,"zh":98},"Blog","Блог","博客","\u002Fblog","i-lucide-book-open",112,[],{"id":104,"title":105,"url":114,"target":61,"icon":115,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":116,"portfolioId":10,"children":117},"item-32",{"de":106,"en":107,"es":108,"fr":109,"it":110,"ru":111,"sr":112,"zh":113},"Neue Technologien","New Technologies","Nuevas tecnologías","Nouvelles technologies","Nuove tecnologie","Новые технологии","Нове технологије","新技术！","\u002Fneue-webtechnologien","i-lucide-sparkles",122,[],{"id":119,"title":120,"url":129,"target":61,"icon":130,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":131,"portfolioId":10,"children":132},"item-20",{"de":121,"en":122,"es":123,"fr":124,"it":125,"ru":126,"sr":127,"zh":128},"Kontakt","Contact us!","Contacto","Contact","Contatto","Контакт","Контактирајте нас","联系我们！","\u002Fcontact","i-lucide-mail",115,[],{"id":134,"title":135,"url":144,"target":61,"icon":145,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":146,"portfolioId":10,"children":147},"item-21",{"de":136,"en":137,"es":138,"fr":139,"it":140,"ru":141,"sr":142,"zh":143},"Unsere Arbeit","Our Work","Nuestro trabajo","Nos réalisations","I nostri lavori","Наши работы","Наши радови","文件夹","\u002Fportfolio","i-lucide-briefcase",114,[148,161,175,181,193],{"id":149,"title":150,"url":144,"target":61,"icon":159,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":146,"portfolioId":10,"children":160},"item-24",{"de":151,"en":152,"es":153,"fr":154,"it":155,"ru":156,"sr":157,"zh":158},"Alle Projekte","All Projects","Todos los proyectos","Tous les projets","Tutti i progetti","Все проекты","Сви пројекти","所有项目","i-lucide-grid-3x3",[],{"id":162,"title":163,"url":171,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":174},"item-29",{"de":164,"en":165,"es":166,"fr":167,"it":168,"ru":169,"sr":170,"zh":143},"Local Roots, Global Reach","Local Roots - Global Reach","Empresa local ","Entreprise locale","Azienda locale","Местная компания","Локално предузеће глобално тржиште","\u002Fportfolio\u002Flocal-roots-global-reach-communication-media-systems-for-modern-business","i-lucide-folder","custom",[],{"id":176,"title":177,"url":179,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":180},"item-28",{"de":178,"en":178,"es":178,"fr":178,"it":178,"ru":178,"sr":178,"zh":178},"Solr Suggester","\u002Fportfolio\u002Fsolr-fuzzy-suggester-und-solr-infix-suggester-abfrage-ueber-ajax-und-filterung",[],{"id":182,"title":183,"url":191,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":192},"item-27",{"de":184,"en":185,"es":186,"fr":187,"it":188,"ru":189,"sr":190,"zh":185},"Firmenwebseite SEO","Company Website SEO","Sitio web corporativo SEO","Site web d’entreprise SEO","Sito web aziendale SEO","Корпоративный сайт SEO","Пословна веб-страница SEO","\u002Fportfolio\u002Fseo-sem-branding-mobile-webseite-muenchen",[],{"id":194,"title":195,"url":203,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":204},"item-31",{"de":196,"en":197,"es":198,"fr":199,"it":200,"ru":201,"sr":202,"zh":197},"Digitalisierungsportal","Digitalization Portal","Portal de digitalización","Portail de numérisation","Portale di digitalizzazione","Портал цифровизации","Портал за дигитализацију","\u002Fportfolio\u002Fdigitalisierungsportal-archiv-museum-bibliothek-ead-lido-mets-mods",[],{"statusCode":4,"data":206,"message":3523},{"id":207,"title":208,"slug":209,"content":210,"contentJson":211,"excerpt":1610,"featuredImage":1611,"featuredImageAlt":1612,"featuredImageCaption":10,"featuredImageTitle":10,"featuredImageCopyright":10,"featuredImageAuthor":10,"featuredImageSourceUrl":10,"featuredImageLicense":10,"featuredImageIsAiGenerated":43,"status":1613,"publishedAt":1614,"createdAt":1615,"updatedAt":1616,"seoLocalePaths":1617,"categories":1626,"author":1643,"translations":1648},"492","MCP explicado: qué conecta, qué no hace y dónde encaja","mcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","\u003Cp>El Protocolo de Contexto de Modelo (MCP) es un protocolo abierto para conectar aplicaciones de IA a capacidades e información externas mediante contratos estandarizados de cliente-servidor. Un servidor MCP puede exponer herramientas, recursos y prompts; un host o cliente compatible con MCP descubre y utiliza esas capacidades en nombre de una aplicación de IA. MCP no requiere que el servidor ejecute su propio modelo de lenguaje, y no reemplaza el entorno de ejecución del agente, la autorización empresarial, el aislamiento de inquilinos, las API de aplicación ni la arquitectura de dominio detrás de las capacidades expuestas.\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--info my-6 rounded-xl border p-5 border-blue-300 bg-blue-50 dark:border-blue-900 dark:bg-blue-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Respuesta directa\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">\u003Cstrong>MCP estandariza el límite entre un host de IA y los proveedores de capacidades externas.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>Un modelo mental útil es:\u003Cbr>\u003Cstrong>Usuario → host de IA \u002F entorno de ejecución del agente → cliente MCP → servidor MCP → aplicación\u002FAPI\u002Fdatos\u002Fherramienta\u003C\u002Fstrong>.\u003Cbr>\u003Cbr>El modelo puede permanecer completamente del lado del host. El servidor MCP puede ser software determinista ordinario que expone capacidades estructuradas.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--success my-6 rounded-xl border p-5 border-emerald-300 bg-emerald-50 dark:border-emerald-900 dark:bg-emerald-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Un servidor MCP no necesita su propio modelo de IA\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Un servidor MCP de sistema de archivos puede listar o leer archivos. Un servidor MCP de base de datos puede ejecutar consultas aprobadas. Un servidor MCP de Jira puede exponer operaciones de incidencias. Ninguno de esos servidores necesita un LLM para cumplir el contrato MCP. Si un servidor utiliza IA internamente, eso es una decisión de implementación detrás del límite del protocolo, no un requisito de MCP.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--warning my-6 rounded-xl border p-5 border-amber-300 bg-amber-50 dark:border-amber-900 dark:bg-amber-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">La capacidad MCP no es autoridad empresarial\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Si un servidor MCP expone \u003Ccode>delete_file\u003C\u002Fcode>, \u003Ccode>refund_order\u003C\u002Fcode> o \u003Ccode>deploy_service\u003C\u002Fcode>, eso solo significa que la capacidad existe. El servidor\u002Faplicación aún debe hacer cumplir la identidad, los permisos, el alcance del inquilino, las reglas de negocio, los requisitos de confirmación y los controles de auditoría. El descubrimiento del protocolo nunca debe convertirse silenciosamente en autorización.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--note my-6 rounded-xl border p-5 border-gray-300 bg-gray-50 dark:border-gray-700 dark:bg-gray-900\u002F40\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Nota de fuente actual — 8 de octubre de 2026\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">La revisión actual de la especificación MCP es \u003Cstrong>2026-07-28\u003C\u002Fstrong>. Su cambio principal es un núcleo de protocolo sin estado con solicitudes autodescriptivas, \u003Ccode>server\u002Fdiscover\u003C\u002Fcode> opcional, encabezados HTTP enrutables, respuestas de lista\u002Frecurso almacenables en caché, endurecimiento de la autorización y un modelo de extensión formal. El SDK de TypeScript v2 es la línea de SDK estable actual que implementa esta revisión. Aún existen clientes y servidores más antiguos de la era de 2025, por lo que la guía de implementación debe seguir siendo consciente de la versión.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Cnav class=\"editorjs-toc\" data-editorjs-toc=\"true\" aria-label=\"Contenido\">\u003Cstrong class=\"editorjs-toc__title\">Contenido\u003C\u002Fstrong>\u003Col class=\"editorjs-toc__list editorjs-toc__list--depth-0\">\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-7\" class=\"editorjs-toc__link\">Qué estandariza realmente MCP\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-11\" class=\"editorjs-toc__link\">El ejemplo más simple\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-16\" class=\"editorjs-toc__link\">Dónde se detiene el ejemplo simple\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-20\" class=\"editorjs-toc__link\">La arquitectura MCP: host, cliente y servidor\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-24\" class=\"editorjs-toc__link\">Las tres primitivas centrales del servidor\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-26\" class=\"editorjs-toc__link\">Herramientas: capacidades invocables\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-30\" class=\"editorjs-toc__link\">Recursos: contexto y datos legibles\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-34\" class=\"editorjs-toc__link\">Prompts: plantillas reutilizables\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-38\" class=\"editorjs-toc__link\">¿Herramienta o recurso?\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-40\" class=\"editorjs-toc__link\">¿Dónde está el modelo de IA?\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-45\" class=\"editorjs-toc__link\">MCP no reemplaza las API\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-49\" class=\"editorjs-toc__link\">MCP vs llamada a funciones\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-52\" class=\"editorjs-toc__link\">MCP no crea el bucle del agente\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-56\" class=\"editorjs-toc__link\">MCP vs A2A\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-61\" class=\"editorjs-toc__link\">El uso local y remoto de MCP tiene realidades de transporte diferentes\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-65\" class=\"editorjs-toc__link\">Por qué importa la conciencia de la versión de MCP\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-69\" class=\"editorjs-toc__link\">Qué cambió en MCP 2026-07-28\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-71\" class=\"editorjs-toc__link\">Roots, sampling y logging ya no son la dirección para nuevas implementaciones\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-75\" class=\"editorjs-toc__link\">El trabajo de larga duración no es lo mismo que la invocación ordinaria de herramientas MCP\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-79\" class=\"editorjs-toc__link\">MCP Apps extiende la capacidad de la interfaz de usuario sin redefinir el protocolo central\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-83\" class=\"editorjs-toc__link\">La autorización MCP no es su modelo de autorización completo\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-88\" class=\"editorjs-toc__link\">La identidad puede cruzar varios límites\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-92\" class=\"editorjs-toc__link\">El aislamiento de inquilinos permanece fuera del descubrimiento de capacidades de MCP\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-96\" class=\"editorjs-toc__link\">MCP no define la Fuente de Verdad\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-100\" class=\"editorjs-toc__link\">MCP e ingeniería de contexto\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-104\" class=\"editorjs-toc__link\">Diseñar herramientas MCP en torno a resultados y límites de riesgo\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-106\" class=\"editorjs-toc__link\">Las aprobaciones pertenecen a la arquitectura de ejecución\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-110\" class=\"editorjs-toc__link\">La observabilidad de MCP debe conectar las llamadas de protocolo con las acciones de dominio\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-114\" class=\"editorjs-toc__link\">Lo que MCP no puede solucionar\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-116\" class=\"editorjs-toc__link\">Evidencia de implementación original: Aaasaasa AI Client\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-124\" class=\"editorjs-toc__link\">Cuándo MCP es una buena opción\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-126\" class=\"editorjs-toc__link\">Cuándo no necesita MCP\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-130\" class=\"editorjs-toc__link\">Lista de verificación de seguridad de MCP\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-132\" class=\"editorjs-toc__link\">Conceptos erróneos comunes\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-134\" class=\"editorjs-toc__link\">Una secuencia práctica de diseño de MCP\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-136\" class=\"editorjs-toc__link\">Lista de verificación de arquitectura de MCP\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-138\" class=\"editorjs-toc__link\">Casos límite y limitaciones\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-144\" class=\"editorjs-toc__link\">¿Qué cambiaría esta respuesta?\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-148\" class=\"editorjs-toc__link\">Conocimiento canónico relacionado\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-153\" class=\"editorjs-toc__link\">Preguntas frecuentes\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-155\" class=\"editorjs-toc__link\">Glosario\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-157\" class=\"editorjs-toc__link\">Conclusión\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-161\" class=\"editorjs-toc__link\">Fuentes primarias y documentación actual\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Fol>\u003C\u002Fnav>\n\u003Ch2 id=\"section-7\">Qué estandariza realmente MCP\u003C\u002Fh2>\n\u003Cp>Antes de MCP, cada aplicación de IA podía integrar sistemas externos mediante su propio esquema de herramientas, formato de complementos, convención de autenticación y código de conexión. El mismo servicio podía necesitar adaptadores diferentes para un cliente de IA de escritorio, un agente de IDE y una aplicación personalizada.\u003C\u002Fp>\n\u003Cp>MCP crea un límite de protocolo reutilizable. El sistema externo expone capacidades a través de un servidor MCP, mientras que los hosts de IA compatibles implementan un cliente MCP. Esto reduce el acoplamiento de integración entre la aplicación de IA y el proveedor subyacente de herramientas o datos.\u003C\u002Fp>\n\u003Cp>El protocolo no estandariza toda la aplicación. Estandariza cómo se describen, descubren e invocan las capacidades a través de ese límite.\u003C\u002Fp>\n\u003Ch2 id=\"section-11\">El ejemplo más simple\u003C\u002Fh2>\n\u003Cp>Supongamos que una aplicación de IA para programar necesita acceso a un directorio de proyecto local. Sin MCP, la aplicación podría implementar su propia integración de sistema de archivos directamente.\u003C\u002Fp>\n\u003Cp>Con MCP, un servidor de sistema de archivos puede exponer capacidades como listar directorios, leer archivos aprobados o escribir dentro de un espacio de trabajo permitido. El host de IA se conecta a través de un cliente MCP y presenta esas capacidades al modelo o al entorno de ejecución del agente.\u003C\u002Fp>\n\u003Cp>El servidor no necesita entender la solicitud en lenguaje natural del usuario. El host\u002Fmodelo decide qué capacidad es útil; el servidor MCP ejecuta la solicitud estructurada bajo sus propias reglas de seguridad.\u003C\u002Fp>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Una llamada básica a herramienta MCP\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">1. El host se conecta al servidor\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">La aplicación compatible con MCP configura el acceso al servidor MCP externo.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">2. Se descubren las capacidades\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">El cliente conoce qué herramientas, recursos o prompts expone el servidor.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">3. El modelo o entorno selecciona una capacidad\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">La aplicación de IA decide que se necesita una capacidad expuesta.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">4. El cliente envía una solicitud estructurada\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Los argumentos se envían a través de MCP al servidor.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">5. El servidor autoriza y ejecuta\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">El servidor valida la solicitud y llama a su sistema subyacente.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">6. El resultado vuelve al host\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">El resultado se convierte en una observación o entrada de contexto.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">7. El host decide qué sucede después\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">El modelo\u002Fentorno puede responder, llamar a otra herramienta o continuar un flujo de trabajo.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-16\">Dónde se detiene el ejemplo simple\u003C\u002Fh2>\n\u003Cp>MCP no define cómo el host elige una herramienta, cómo planifica un agente, cómo se modela un flujo de trabajo empresarial o cómo debería comportarse un objeto de dominio como una factura o un despliegue.\u003C\u002Fp>\n\u003Cp>Un protocolo puede hacer que la integración sea interoperable mientras la aplicación subyacente sigue siendo incorrecta, insegura o mal diseñada. Una solicitud MCP perfectamente válida aún puede llamar a la capacidad empresarial equivocada.\u003C\u002Fp>\n\u003Cp>El límite central es: MCP estandariza la semántica de integración, no la verdad de la aplicación ni la corrección del negocio.\u003C\u002Fp>\n\u003Ch2 id=\"section-20\">La arquitectura MCP: host, cliente y servidor\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Componente\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Responsabilidad\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Host de IA\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Aplicación o entorno de ejecución de IA orientado al usuario que posee la interacción con el modelo, el contexto y el flujo de trabajo general\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Cliente MCP\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Componente del lado del protocolo utilizado por el host para comunicarse con un servidor MCP\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Servidor MCP\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Publica capacidades y gestiona las solicitudes MCP\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sistema subyacente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Aplicación, API, base de datos, sistema de archivos, plataforma SaaS o servicio detrás del servidor MCP\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Modelo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Elige o razona sobre las capacidades según el diseño del host\u002Fentorno de ejecución; no está necesariamente dentro del servidor MCP\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autorización\u002Fpolítica de negocio\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Determina si una operación solicitada está realmente permitida\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>Un host puede conectarse a múltiples servidores MCP, y un servidor MCP puede estar frente a uno o varios sistemas subyacentes. El host sigue siendo responsable de integrar los resultados de MCP en la aplicación de IA más amplia.\u003C\u002Fp>\n\u003Cp>El servidor puede ser local al host, ejecutarse como un proceso separado o ser remoto a través de un transporte de red. La topología de alojamiento y la ubicación del modelo son decisiones independientes.\u003C\u002Fp>\n\u003Ch2 id=\"section-24\">Las tres primitivas centrales del servidor\u003C\u002Fh2>\n\u003Csection class=\"editorjs-comparison my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Herramientas, recursos y prompts resuelven necesidades diferentes\u003C\u002Fh3>\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left dark:border-gray-700 dark:bg-gray-900\">\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Herramientas\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Recursos\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Prompts\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Propósito principal\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Interacción típica\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Ejemplo\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Riesgo típico\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-26\">Herramientas: capacidades invocables\u003C\u002Fh2>\n\u003Cp>Las herramientas son operaciones estructuradas que un servidor MCP pone a disposición del host. Una herramienta tiene un nombre, una descripción y un esquema de entrada; las implementaciones modernas también pueden proporcionar salida estructurada.\u003C\u002Fp>\n\u003Cp>Los ejemplos incluyen buscar en un repositorio, leer un registro de cliente, crear un ticket, ejecutar una compilación o enviar un mensaje. Las herramientas pueden ser de solo lectura o tener efectos secundarios.\u003C\u002Fp>\n\u003Cp>Una buena superficie de herramientas MCP debería representar objetivos coherentes del usuario o del agente en lugar de reflejar mecánicamente cada punto final de API interno. Las operaciones con diferentes permisos, requisitos de confirmación o radio de impacto generalmente deberían ser herramientas separadas.\u003C\u002Fp>\n\u003Ch2 id=\"section-30\">Recursos: contexto y datos legibles\u003C\u002Fh2>\n\u003Cp>Los recursos exponen datos o contenido que un cliente puede listar o leer. Encajan naturalmente cuando la operación semántica es «dame este artefacto o información» en lugar de «realiza esta acción».\u003C\u002Fp>\n\u003Cp>Un URI de recurso no es una concesión de autorización. El servidor sigue siendo el propietario del control de acceso y debe verificar qué principal puede leer el objeto subyacente.\u003C\u002Fp>\n\u003Cp>La revisión del protocolo del 28-07-2026 añade semántica de caché para las respuestas de listado y lectura de recursos, incluida la frescura y el alcance de la caché, lo que hace que el comportamiento de almacenamiento en caché sea más explícito.\u003C\u002Fp>\n\u003Ch2 id=\"section-34\">Prompts: plantillas reutilizables\u003C\u002Fh2>\n\u003Cp>Los prompts MCP permiten que un servidor publique plantillas de prompts reutilizables para clientes compatibles. Esto puede mantener las instrucciones específicas del dominio cerca del proveedor de capacidades.\u003C\u002Fp>\n\u003Cp>Un prompt proporcionado por un servidor MCP no supera automáticamente las instrucciones del sistema o de seguridad del host. El host decide cómo el material del prompt entra en su jerarquía de contexto.\u003C\u002Fp>\n\u003Cp>Por lo tanto, el contenido de los prompts proporcionado por el protocolo debe tratarse como datos de capacidad con semántica de confianza explícita, no como autoridad de instrucción sin restricciones.\u003C\u002Fp>\n\u003Ch2 id=\"section-38\">¿Herramienta o recurso?\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Necesidad\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Preferir\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Realizar una acción con argumentos estructurados\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramienta\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Leer un artefacto estable específico\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Recurso\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Buscar o calcular dinámicamente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Generalmente herramienta\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Modificar el estado externo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramienta\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Empaquetar instrucciones de prompt reutilizables\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Prompt\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ejecución asíncrona de larga duración\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramienta más manejo de tareas de aplicación\u002Fruntime o una extensión MCP\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-40\">¿Dónde está el modelo de IA?\u003C\u002Fh2>\n\u003Cp>MCP no requiere que el modelo se ejecute en el servidor MCP. El modelo puede estar alojado en la nube, alojado localmente, integrado en la aplicación de escritorio o accedido a través de otro proveedor.\u003C\u002Fp>\n\u003Cp>El host normalmente posee la interacción con el modelo. El servidor MCP expone capacidad externa. Por lo tanto, un servidor MCP local puede ser utilizado por un host cuyo modelo se ejecuta en la nube, y un servidor MCP remoto puede ser utilizado por un host cuyo modelo se ejecuta localmente.\u003C\u002Fp>\n\u003Cp>Si el propio servidor MCP llama internamente a un LLM, ese modelo forma parte de la implementación del servidor detrás del límite del protocolo; MCP no lo requiere.\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--success my-6 rounded-xl border p-5 border-emerald-300 bg-emerald-50 dark:border-emerald-900 dark:bg-emerald-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Ubicación del protocolo ≠ ubicación de la inferencia\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">\u003Cstrong>MCP local no implica inferencia local, y MCP remoto no implica inferencia remota.\u003C\u002Fstrong> La ubicación de la conexión, la ubicación de ejecución de la herramienta y la ubicación del modelo\u002Fproveedor son dimensiones arquitectónicas separadas.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Ch2 id=\"section-45\">MCP no reemplaza las API\u003C\u002Fh2>\n\u003Cp>Un servidor MCP a menudo envuelve API o servicios existentes. REST, GraphQL, SQL, llamadas a SDK y contratos de servicios internos pueden permanecer exactamente donde están.\u003C\u002Fp>\n\u003Cp>MCP añade una capa de interoperabilidad orientada a la IA. La API de dominio subyacente puede seguir siendo el contrato de aplicación autoritativo para clientes deterministas ordinarios.\u003C\u002Fp>\n\u003Cp>Por lo tanto, la arquitectura habitual es primero API\u002Fservicio, segundo capacidad seleccionada orientada a la IA — no “reemplazar cada API con MCP”.\u003C\u002Fp>\n\u003Ch2 id=\"section-49\">MCP vs llamada a funciones\u003C\u002Fh2>\n\u003Csection class=\"editorjs-comparison my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">La llamada a funciones y MCP están relacionadas pero no son idénticas\u003C\u002Fh3>\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left dark:border-gray-700 dark:bg-gray-900\">\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Llamada a funciones\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">MCP\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Alcance\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Definición de herramienta\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Portabilidad\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">¿Pueden coexistir?\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Cp>OpenAI actualmente expone servidores MCP remotos como un tipo de herramienta junto con la llamada a funciones ordinaria, búsqueda web, shell y otras herramientas. Esa implementación ilustra la relación arquitectónica: la conectividad MCP y la interfaz de llamada a herramientas del propio modelo pueden componerse.\u003C\u002Fp>\n\u003Ch2 id=\"section-52\">MCP no crea el bucle del agente\u003C\u002Fh2>\n\u003Cp>Un agente de IA necesita un runtime que pueda decidir, invocar herramientas, observar resultados, actualizar el estado y continuar o detenerse. MCP puede proporcionar algunas de las herramientas y datos utilizados por ese bucle.\u003C\u002Fp>\n\u003Cp>El servidor MCP no se convierte automáticamente en el planificador, el sistema de memoria o el orquestador. Esas responsabilidades normalmente permanecen en el host o en el runtime del agente.\u003C\u002Fp>\n\u003Cp>Una aplicación no agéntica también puede usar MCP. Una llamada determinista a una herramienta MCP no requiere un agente autónomo de varios pasos.\u003C\u002Fp>\n\u003Ch2 id=\"section-56\">MCP vs A2A\u003C\u002Fh2>\n\u003Cp>MCP conecta principalmente un host de IA o un agente con capacidades como herramientas, recursos y datos. A2A se orienta a la colaboración entre sistemas de agentes independientes.\u003C\u002Fp>\n\u003Cp>Un agente remoto puede usar MCP internamente para acceder a bases de datos y herramientas mientras expone una interfaz A2A a otros agentes. Por lo tanto, los protocolos pueden estratificarse en lugar de sustituirse.\u003C\u002Fp>\n\u003Cp>El artículo existente sobre la pila de protocolos es el responsable de la comparación más amplia entre MCP\u002FA2A\u002FUCP\u002FAP2\u002FA2UI; G02 sigue siendo la definición canónica de MCP.\u003C\u002Fp>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fde\u002Fblog\u002Fmcp-vs-a2a-vs-ucp-vs-ap2-vs-a2ui-the-agent-protocol-stack-explained\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">MCP vs A2A vs UCP vs AP2 vs A2UI: La pila de protocolos de agentes explicada\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">Un mapa de responsabilidades más amplio que muestra cómo MCP se compone con la colaboración de agentes, el comercio, la autoridad de pago y los protocolos de interfaz de usuario impulsados por agentes.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Leer la pila de protocolos →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Ch2 id=\"section-61\">El uso local y remoto de MCP tiene realidades de transporte diferentes\u003C\u002Fh2>\n\u003Cp>MCP puede conectarse a servidores locales y remotos. Las integraciones de escritorio locales suelen usar transportes a nivel de proceso como stdio; los servidores remotos usan transporte orientado a HTTP.\u003C\u002Fp>\n\u003Cp>La revisión del 2026-07-28 hace que el núcleo del protocolo sea sin estado. Las solicitudes llevan la información necesaria para el manejo del protocolo en lugar de depender del modelo de sesión anterior a nivel de protocolo.\u003C\u002Fp>\n\u003Cp>La revisión actual también coloca los nombres de métodos y capacidades en encabezados HTTP para que las pasarelas, WAF, limitadores de velocidad y balanceadores de carga puedan enrutar y medir el tráfico MCP de forma más natural.\u003C\u002Fp>\n\u003Ch2 id=\"section-65\">Por qué importa la conciencia de la versión de MCP\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Era del protocolo\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Característica operativa\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">2025-11-25 y anteriores\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ciclo de vida orientado a handshake\u002Fsesión y comportamiento anterior de Streamable HTTP\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">2026-07-28\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Núcleo sin estado, descubrimiento opcional del servidor, solicitudes autodescriptivas, encabezados de enrutamiento, sugerencias de caché, MRTR y endurecimiento de la autorización\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Extensiones\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Capacidades como Tasks y MCP Apps pueden versionarse por separado del protocolo base\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>La versión del SDK y la versión del protocolo también son cosas diferentes. El SDK actual de TypeScript v2 es la línea estable para la revisión del 2026-07-28, mientras que el anterior v1.x sigue siendo una línea de mantenimiento para el comportamiento de la era 2025.\u003C\u002Fp>\n\u003Cp>La documentación de arquitectura debe registrar tanto la versión del SDK\u002Fbiblioteca como la revisión del protocolo cuando el comportamiento de interoperabilidad dependa de ellas.\u003C\u002Fp>\n\u003Ch2 id=\"section-69\">Qué cambió en MCP 2026-07-28\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Cambio\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Por qué importa\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Núcleo sin estado\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los servidores remotos pueden escalar detrás de balanceadores de carga ordinarios sin sesiones persistentes a nivel de protocolo\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">server\u002Fdiscover\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los clientes pueden inspeccionar las capacidades del servidor cuando sea necesario\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Solicitudes autodescriptivas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La versión del protocolo y los metadatos de capacidad del cliente viajan por solicitud\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Encabezados Mcp-Method \u002F Mcp-Name\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las pasarelas pueden enrutar, medir y aplicar políticas sin analizar los cuerpos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sugerencias de caché\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las listas\u002Flecturas de recursos comunican la frescura y el alcance de compartición\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Solicitudes de múltiples rondas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los servidores pueden requerir entrada adicional sin el modelo anterior de solicitud bidireccional\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Endurecimiento de la autorización\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La validación del emisor y el enlace de credenciales refuerzan el comportamiento de autenticación remota\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Marco de extensiones\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Tasks, MCP Apps y otras capacidades pueden evolucionar por separado\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-71\">Roots, sampling y logging ya no son la dirección para nuevas implementaciones\u003C\u002Fh2>\n\u003Cp>La versión 2026-07-28 marca roots, sampling y logging como capacidades de protocolo obsoletas con una ventana de compatibilidad definida.\u003C\u002Fp>\n\u003Cp>Los tutoriales más antiguos pueden seguir mostrando estas características como primitivas centrales. El nuevo trabajo de implementación debe seguir la especificación actual en lugar de copiar ciegamente diagramas de ciclo de vida antiguos.\u003C\u002Fp>\n\u003Cp>La deprecación no significa eliminación inmediata. Significa que los nuevos sistemas deben evitar dependencias nuevas innecesarias sobre capacidades de las que el protocolo se está alejando.\u003C\u002Fp>\n\u003Ch2 id=\"section-75\">El trabajo de larga duración no es lo mismo que la invocación ordinaria de herramientas MCP\u003C\u002Fh2>\n\u003Cp>Las operaciones de larga duración necesitan semántica de ciclo de vida más allá de un simple resultado inmediato de herramienta. En el ecosistema actual, Tasks se trasladó a una extensión MCP dedicada.\u003C\u002Fp>\n\u003Cp>Esto refuerza un principio de diseño útil: el protocolo base no necesita absorber todas las preocupaciones del tiempo de ejecución del agente.\u003C\u002Fp>\n\u003Cp>Una aplicación también puede mantener la propiedad del flujo de trabajo de larga duración enteramente en su propio tiempo de ejecución y usar herramientas MCP ordinarias como operaciones subyacentes.\u003C\u002Fp>\n\u003Ch2 id=\"section-79\">MCP Apps extiende la capacidad de la interfaz de usuario sin redefinir el protocolo central\u003C\u002Fh2>\n\u003Cp>MCP Apps asocia experiencias de interfaz de usuario interactivas más ricas con herramientas MCP a través del modelo de extensión.\u003C\u002Fp>\n\u003Cp>El host sigue controlando cómo se incrusta, se aísla y se protege esa interfaz de usuario.\u003C\u002Fp>\n\u003Cp>Por lo tanto, el intercambio de capacidades centrales y la representación de la interfaz de usuario deben seguir siendo responsabilidades arquitectónicas separadas.\u003C\u002Fp>\n\u003Ch2 id=\"section-83\">La autorización MCP no es su modelo de autorización completo\u003C\u002Fh2>\n\u003Cp>MCP remoto necesita mecanismos de autenticación y autorización a nivel de protocolo para que los clientes y servidores puedan establecer acceso confiable. La especificación actual continúa fortaleciendo el comportamiento relacionado con OAuth\u002FOIDC.\u003C\u002Fp>\n\u003Cp>Esa capa responde si un cliente tiene permitido conectarse o solicitar ámbitos de protocolo. No responde automáticamente si Alice puede reembolsar el pedido 123, si un agente puede escribir configuración de producción o si el Inquilino A puede leer datos del Inquilino B.\u003C\u002Fp>\n\u003Cp>Esas decisiones de dominio pertenecen al modelo de autorización del servidor\u002Faplicación y deben aplicarse antes de invocar la operación subyacente.\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--warning my-6 rounded-xl border p-5 border-amber-300 bg-amber-50 dark:border-amber-900 dark:bg-amber-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Nunca asigne "cliente MCP autenticado" a "confiable para todas las herramientas"\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">La confianza de conexión, la visibilidad de herramientas, el permiso de herramientas, la autorización del usuario, el aislamiento de inquilinos y la aprobación comercial son controles diferentes. Manténgalos separados.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Ch2 id=\"section-88\">La identidad puede cruzar varios límites\u003C\u002Fh2>\n\u003Cp>Una solicitud MCP puede involucrar la aplicación cliente MCP, el humano que inició sesión, una identidad de agente\u002Fsesión y una cuenta de servicio posterior.\u003C\u002Fp>\n\u003Cp>El servidor necesita una política explícita sobre en nombre de qué principal se realiza la operación. De lo contrario, una credencial de servicio poderosa puede convertirse en una ruta de diputado confundido.\u003C\u002Fp>\n\u003Cp>Para uso empresarial, la correlación entre la identidad del usuario, la identidad del agente, la conexión MCP y la autorización posterior es tan importante como la compatibilidad del protocolo.\u003C\u002Fp>\n\u003Ch2 id=\"section-92\">El aislamiento de inquilinos permanece fuera del descubrimiento de capacidades de MCP\u003C\u002Fh2>\n\u003Cp>Un servidor MCP multiinquilino debe aplicar el alcance del inquilino cuando lee o modifica recursos propiedad del inquilino. Devolver una herramienta llamada search_documents no define a qué inquilino pertenecen los documentos elegibles.\u003C\u002Fp>\n\u003Cp>El alcance del inquilino debe derivarse de una identidad o membresía confiable y trasladarse a bases de datos, cachés, búsqueda vectorial, almacenamiento de objetos y API posteriores.\u003C\u002Fp>\n\u003Cp>Recuperar contenido entre inquilinos y pedirle al modelo que no lo use ya es un fallo de aislamiento.\u003C\u002Fp>\n\u003Ch2 id=\"section-96\">MCP no define la Fuente de Verdad\u003C\u002Fh2>\n\u003Cp>Un servidor MCP puede exponer una base de datos, un repositorio de documentos, un servicio de búsqueda web o un resumen generado por IA. El protocolo no declara qué fuente es autoritativa para una afirmación.\u003C\u002Fp>\n\u003Cp>Las reglas de Fuente de Verdad pertenecen a la arquitectura de la aplicación o del dominio. El host o el servidor pueden codificar la autoridad mediante el diseño de herramientas, metadatos, políticas de acceso o validación, pero MCP por sí mismo no hace que una capacidad sea “verdadera”.\u003C\u002Fp>\n\u003Cp>Por lo tanto, una herramienta puede ser perfectamente invocable a través de MCP y aun así devolver información obsoleta, secundaria o no autoritativa.\u003C\u002Fp>\n\u003Ch2 id=\"section-100\">MCP e ingeniería de contexto\u003C\u002Fh2>\n\u003Cp>MCP puede aumentar las capacidades y la información disponibles para una aplicación de IA, pero la ingeniería de contexto sigue determinando qué llega al modelo.\u003C\u002Fp>\n\u003Cp>Los catálogos de herramientas consumen contexto visible para el modelo en muchos hosts. Los resultados de las herramientas pueden ser grandes. Los recursos pueden ser numerosos. Un host necesita selección, filtrado, carga dinámica y compactación en lugar de exponer todo en cada turno.\u003C\u002Fp>\n\u003Cp>Por lo tanto, la disponibilidad de capacidades y el contexto visible para el modelo deben tratarse como capas separadas.\u003C\u002Fp>\n\u003Ch2 id=\"section-104\">Diseñar herramientas MCP en torno a resultados y límites de riesgo\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Diseño de herramienta débil\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Diseño de herramienta más sólido\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">execute_api(method,url,body)\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramientas de dominio estrechas con operaciones validadas\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Una herramienta de administración para todas las acciones\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Operaciones separadas de lectura\u002Fescritura\u002Faprobación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">API interna sin procesar replicada 1:1\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Contrato orientado a la IA en torno a objetivos de usuario coherentes\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Una herramienta de sistema de archivos amplia\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Operaciones de lectura\u002Fescritura con alcance de espacio de trabajo\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Política de seguridad solo en la descripción\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El servidor aplica la política en el código\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Respuesta sin procesar sin límites\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Salida estructurada relevante para la decisión\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Eliminar\u002Factualizar mezclado con lectura\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramientas de efectos secundarios separadas con política de confirmación\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-106\">Las aprobaciones pertenecen a la arquitectura de ejecución\u003C\u002Fh2>\n\u003Cp>Un host puede requerir la aprobación del usuario antes de invocar herramientas MCP seleccionadas. La integración MCP actual de OpenAI admite patrones de ejecución automática o con aprobación explícita.\u003C\u002Fp>\n\u003Cp>La aprobación del host es útil, pero no debería ser la única protección del servidor, porque otro cliente MCP compatible puede usar un modelo de aprobación diferente.\u003C\u002Fp>\n\u003Cp>Para acciones destructivas o con consecuencias financieras, utilice defensa en profundidad: contrato de herramienta claro, aprobación en tiempo de ejecución cuando corresponda, autorización del lado del servidor, validación de negocio y auditoría.\u003C\u002Fp>\n\u003Ch2 id=\"section-110\">La observabilidad de MCP debe conectar las llamadas de protocolo con las acciones de dominio\u003C\u002Fh2>\n\u003Cp>Un rastro de MCP es más útil cuando puede correlacionarse con la llamada de aplicación subyacente, el cambio de base de datos o la transacción de negocio.\u003C\u002Fp>\n\u003Cp>El ecosistema de 2026-07-28 estandariza las convenciones de propagación de W3C Trace Context, lo que facilita seguir una solicitud a través del host, cliente, servidor y servicios posteriores.\u003C\u002Fp>\n\u003Cp>Los registros de protocolo por sí solos no son suficientes para operaciones con consecuencias. La evidencia de auditoría también debe registrar el principal relevante, el inquilino, el recurso objetivo, la aprobación y el cambio de estado resultante.\u003C\u002Fp>\n\u003Ch2 id=\"section-114\">Lo que MCP no puede solucionar\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Problema\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Por qué MCP no lo resuelve\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">API de negocio deficiente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">MCP puede exponer la API deficiente de forma más consistente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Datos incorrectos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La validez del protocolo no crea corrección fáctica\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Aislamiento de inquilinos ausente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El descubrimiento de herramientas no impone la propiedad de los recursos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Privilegios excesivos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Una herramienta estandarizada aún puede tener privilegios excesivos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Planificación deficiente del agente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">MCP expone capacidades; el tiempo de ejecución o el modelo aún elige cómo usarlas\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Diseño deficiente de reintentos o idempotencia\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las llamadas de protocolo no hacen que los efectos secundarios sean seguros\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sin fuente de verdad\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">MCP no decide qué sistema posee un hecho\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Evaluación débil\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La interoperabilidad no demuestra el éxito de la tarea\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sin política de auditoría\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los rastros de transporte no definen la retención ni la responsabilidad\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Incompatibilidad de protocolo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las versiones antiguas o nuevas aún pueden requerir migración o manejo de compatibilidad\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-116\">Evidencia de implementación original: Aaasaasa AI Client\u003C\u002Fh2>\n\u003Caside class=\"editorjs-callout editorjs-callout--note my-6 rounded-xl border p-5 border-gray-300 bg-gray-50 dark:border-gray-700 dark:bg-gray-900\u002F40\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Evidencia de implementación\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Aaasaasa AI Client contiene un conector o broker MCP local autenticado para directorios locales aprobados e integración a través de Secure MCP Tunnel. Esta es evidencia de implementación concreta para el límite del protocolo y la arquitectura de permisos, no una afirmación de una plataforma MCP comercial de propósito general.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Cp>La aplicación puede ejecutar un endpoint MCP Streamable HTTP autenticado en loopback. El endpoint expone solo directorios seleccionados a través del broker central de permisos del espacio de trabajo.\u003C\u002Fp>\n\u003Cp>El endpoint local y la ruta remota son preocupaciones separadas: el conector local puede enlazarse solo a loopback, mientras que un Secure MCP Tunnel puede hacer que el servicio MCP aprobado sea accesible para un cliente de IA externo permitido sin exponer toda la máquina local.\u003C\u002Fp>\n\u003Cp>El modelo central de permisos distingue perfiles de solo chat, solo lectura, escritura de proyecto y directorio personalizado. Direct Chat no tiene acceso al sistema de archivos ni al shell; los tiempos de ejecución de agentes con capacidad de herramientas utilizan el perfil de permisos seleccionado.\u003C\u002Fp>\n\u003Cp>Esta es una implementación directa del límite G02: MCP proporciona la conexión de capacidad estandarizada, mientras que el broker de permisos propiedad de la aplicación decide qué directorios puede exponer el servidor.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Elemento implementado\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Evidencia de arquitectura\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Endpoint MCP local autenticado\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El servidor MCP puede ser un servicio de capacidad determinista local\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Enlace a loopback\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La exposición de red y la capacidad de protocolo son decisiones separadas\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Integración con Secure MCP Tunnel\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">MCP privado o local puede puentearse a través de una ruta controlada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Broker central de permisos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La capacidad de MCP está restringida por la política de la aplicación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Alcance de directorio seleccionado\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La visibilidad del sistema de archivos está explícitamente delimitada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Direct Chat sin herramientas del sistema operativo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El acceso al modelo no implica automáticamente acceso a herramientas\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Caside class=\"editorjs-callout editorjs-callout--warning my-6 rounded-xl border p-5 border-amber-300 bg-amber-50 dark:border-amber-900 dark:bg-amber-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Límite de la evidencia\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">La implementación demuestra conectividad MCP y exposición de directorios locales con alcance de permisos. No implica que cada primitiva MCP, cada característica de 2026-07-28 o cada extensión de autorización empresarial esté implementada.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Ch2 id=\"section-124\">Cuándo MCP es una buena opción\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">MCP es una opción sólida cuando\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Una integración directa puede ser más simple cuando\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La misma capacidad debe ser reutilizable en múltiples hosts de IA\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Una sola aplicación posee ambos lados y la portabilidad tiene poco valor\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Un sistema externo quiere publicar herramientas o recursos descubribles orientados a IA\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Una única llamada API interna estable es suficiente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Se desea un límite estándar alrededor de herramientas o datos locales\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">No existe un requisito de interoperabilidad orientado a IA\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los proveedores de herramientas y los clientes de IA evolucionan de forma independiente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La integración es intencionalmente privada y estrechamente acoplada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Se desea descubrimiento de capacidades compatible con el ecosistema\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El conjunto de capacidades es pequeño y fijo en el código de la aplicación\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-126\">Cuándo no necesita MCP\u003C\u002Fh2>\n\u003Cp>No agregues MCP solo porque la aplicación use IA. Si tu backend ya llama a una API interna y ningún cliente MCP independiente necesita esa capacidad, una función o llamada de servicio ordinaria puede ser más clara.\u003C\u002Fp>\n\u003Cp>MCP aporta valor en un límite de interoperabilidad. Sin ese límite, el protocolo puede convertirse en una capa de adaptador innecesaria.\u003C\u002Fp>\n\u003Cp>La pregunta arquitectónica no es \"¿Este proyecto tiene IA?\" sino \"¿Se benefician hosts de IA y proveedores de capacidades que evolucionan de forma independiente de un contrato estándar?\"\u003C\u002Fp>\n\u003Ch2 id=\"section-130\">Lista de verificación de seguridad de MCP\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Límite\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Pregunta\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Identidad del servidor\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿A qué servidor MCP estoy realmente conectado?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Identidad del cliente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué aplicación\u002Fcliente solicita acceso?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Identidad del usuario final\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿En nombre de quién se realiza la operación?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Lista de herramientas permitidas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué capacidades puede descubrir y llamar este host\u002Fagente?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Permiso de negocio\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede este principal realizar esta operación?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Alcance del inquilino\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué límite de inquilino\u002Frecurso aplica?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Aislamiento de credenciales\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Están las credenciales vinculadas correctamente y mantenidas fuera del contexto del modelo?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Aprobación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué efectos secundarios requieren confirmación humana?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Validación de entrada\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Se validan los argumentos de las herramientas independientemente de la salida del modelo?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Confianza en la salida\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede el contenido devuelto contener instrucciones no confiables o datos sensibles?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Exposición de red\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Está un servidor local expuesto accidentalmente más allá de las interfaces previstas?\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Auditoría\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Se puede correlacionar una llamada al protocolo con la acción posterior?\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-132\">Conceptos erróneos comunes\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Concepto erróneo\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Corrección\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"Un servidor MCP es un servidor de IA.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Puede ser software determinista ordinario que expone capacidades.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"Necesito mi propio LLM en el servidor MCP.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">No. El modelo puede residir completamente en el lado del host.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"MCP reemplaza las API REST.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">MCP a menudo envuelve API existentes para la interoperabilidad orientada a IA.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"MCP es un framework de agentes.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">MCP proporciona capacidades; un runtime de agente gestiona la iteración y el estado.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"MCP y el function calling compiten.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Un host puede conectar capacidades MCP a su interfaz de herramientas del modelo.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"MCP reemplaza A2A.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">MCP se centra en la integración de capacidades; A2A se centra en la colaboración entre agentes.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"Si una herramienta está listada, el usuario puede llamarla.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El descubrimiento no es autorización.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"OAuth resuelve los permisos de negocio.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La autorización de conexión no reemplaza la autorización de dominio ni el aislamiento de inquilinos.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"MCP local significa IA local.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La ubicación del servidor de herramientas y la ubicación de la inferencia son independientes.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"MCP hace que la salida de las herramientas sea confiable.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La calidad de los datos, la autoridad y la procedencia siguen perteneciendo a la fuente\u002Faplicación.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"Una herramienta genérica gigante es flexible.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las herramientas demasiado amplias debilitan los permisos, la validación y la observabilidad.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">\"Los tutoriales antiguos están actualizados en implementación.\"\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La revisión del 2026-07-28 cambió sustancialmente el ciclo de vida y el comportamiento del transporte.\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-134\">Una secuencia práctica de diseño de MCP\u003C\u002Fh2>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Diseña el límite antes de implementar el servidor\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">1. Identifica el límite de interoperabilidad\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Confirma que los hosts de IA independientes realmente necesitan acceso reutilizable.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">2. Mantén la API de dominio como autoritativa\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Preserva el contrato real de la aplicación\u002Fservicio detrás de MCP.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">3. Elige las primitivas deliberadamente\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Usa herramientas, recursos y prompts según su semántica.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">4. Divide por riesgo y permiso\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Separa operaciones de lectura, escritura, destructivas y que requieren aprobación.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">5. Define la propagación de identidad\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Conoce qué cliente, usuario, agente y principal posterior representa cada llamada.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">6. Aplica la autorización de negocio\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Valida permisos, alcance del inquilino y propiedad del objetivo.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">7. Elige transporte local o remoto\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Ajusta la topología de despliegue a la necesidad real.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">8. Fija las expectativas de protocolo\u002FSDK\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Documenta la compatibilidad de 2026-07-28 frente a versiones anteriores.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">9\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">9. Agrega aprobaciones para acciones trascendentales\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Usa controles de confirmación apropiados al riesgo.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">10\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">10. Diseña salidas estructuradas\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Devuelve resultados concisos y utilizables por máquinas.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">11\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">11. Agrega trazabilidad y correlación de auditoría\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Conecta las llamadas MCP con eventos posteriores de servicio\u002Fnegocio.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">12\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">12. Prueba la portabilidad\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Verifica más de un cliente donde la interoperabilidad sea un requisito declarado.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-136\">Lista de verificación de arquitectura de MCP\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Pregunta\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Respuesta esperada\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Por qué se necesita MCP?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Un límite real de interoperabilidad orientado a IA\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué expone el servidor?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramientas\u002Frecursos\u002Fprompts explícitos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Dónde se ejecuta el modelo?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Decisión independiente del host\u002Fproveedor\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Dónde se ejecuta la herramienta?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ubicación nombrada del servidor\u002Fruntime\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué revisión del protocolo se espera?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Contrato consciente de la versión\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Quién es el principal solicitante?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Modelo de identidad de cliente\u002Fusuario\u002Fagente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué herramientas pueden descubrirse?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Política de lista de permitidos\u002Fcapacidades\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué operaciones pueden ejecutarse?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autorización de negocio del lado del servidor\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se aplica el alcance de inquilino\u002Frecurso?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Comprobaciones confiables de propiedad de inquilino\u002Frecurso\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué acciones necesitan aprobación?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Política de confirmación basada en riesgo\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se protegen las credenciales?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Almacenamiento en runtime confiable, no secretos visibles para el modelo\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se limita la salida?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Contrato de resultado estructurado y relevante\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se rastrean las llamadas?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Correlación a través de MCP hasta la acción posterior\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué sucede si MCP no está disponible?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Comportamiento de respaldo\u002Ffallo definido\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede otro host compatible usarlo?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Portabilidad validada donde sea necesario\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-138\">Casos límite y limitaciones\u003C\u002Fh2>\n\u003Cp>Un servidor MCP local por stdio puede tener poca exposición de red y seguir siendo peligroso si el proceso en sí tiene permisos excesivos de sistema de archivos o shell.\u003C\u002Fp>\n\u003Cp>Un servidor MCP remoto puede exponer solo documentación pública o acciones empresariales altamente sensibles. \"MCP remoto\" dice poco sobre el riesgo sin el contexto de capacidad y autorización.\u003C\u002Fp>\n\u003Cp>Algunos servidores pueden usar solo herramientas e ignorar recursos\u002Fprompts. La compatibilidad con MCP no requiere que cada primitiva opcional sea igualmente importante.\u003C\u002Fp>\n\u003Cp>Un host puede traducir entre su propio modelo interno de herramientas y MCP. Es posible que los usuarios nunca vean directamente el límite del protocolo, lo cual es aceptable si la seguridad y la atribución siguen siendo claras.\u003C\u002Fp>\n\u003Cp>MCP sigue evolucionando rápidamente. Las extensiones, los patrones de autorización, las API de los SDK y las convenciones del ecosistema pueden cambiar más rápido que la distinción arquitectónica central.\u003C\u002Fp>\n\u003Ch2 id=\"section-144\">¿Qué cambiaría esta respuesta?\u003C\u002Fh2>\n\u003Cp>Las futuras revisiones de MCP pueden cambiar el ciclo de vida, los transportes, la autorización y los mecanismos de extensión. La revisión de julio de 2026 ya demuestra por qué las afirmaciones específicas de una implementación deben estar fechadas.\u003C\u002Fp>\n\u003Cp>El límite canónico solo cambiaría si MCP se expandiera de un protocolo de interoperabilidad a un estándar de arquitectura de aplicación\u002Fagente de extremo a extremo. Eso no es lo que define el protocolo actual.\u003C\u002Fp>\n\u003Cp>Para el trabajo de implementación, consulte siempre la especificación actual y la línea exacta del SDK en lugar de copiar ejemplos sensibles a la versión de tutoriales más antiguos.\u003C\u002Fp>\n\u003Ch2 id=\"section-148\">Conocimiento canónico relacionado\u003C\u002Fh2>\n\u003Cp>MCP pertenece a la parte posterior de Agentic AI: primero comprenda el límite agente\u002Ftiempo de ejecución\u002Fherramienta, luego use MCP cuando las capacidades externas necesiten un contrato de protocolo portátil.\u003C\u002Fp>\n\u003Cp>MCP también depende de RBAC y del aislamiento de inquilinos porque la exposición de capacidades a nivel de protocolo no determina la autorización de la aplicación.\u003C\u002Fp>\n\u003Cp>El artículo más amplio sobre la pila de protocolos explica dónde se sitúa MCP junto a A2A, UCP, AP2 y A2UI. G02 sigue siendo la fuente canónica para MCP en sí.\u003C\u002Fp>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">Fiabilidad de los agentes de IA: por qué la respuesta final no es suficiente\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">Las llamadas a herramientas MCP pasan a formar parte de una trayectoria de agente; los sistemas fiables deben evaluar acciones y observaciones, no solo el texto final.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Leer el artículo sobre fiabilidad de agentes →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Ch2 id=\"section-153\">Preguntas frecuentes\u003C\u002Fh2>\n\u003Csection class=\"editorjs-faq my-6 rounded-xl border border-gray-200 p-5 dark:border-gray-700\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Preguntas frecuentes sobre Model Context Protocol\u003C\u002Fh3>\u003Cdiv id=\"faq1\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Qué es MCP?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">El Model Context Protocol es un protocolo abierto cliente-servidor para conectar aplicaciones de IA con herramientas, recursos, prompts y proveedores de capacidades externos mediante un contrato estandarizado.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq2\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Un servidor MCP necesita un modelo de IA?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. Un servidor MCP puede ser software completamente determinista. El modelo normalmente se ejecuta en el host de IA o en el tiempo de ejecución del agente, aunque un servidor puede usar IA internamente de forma opcional.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq3\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Cuál es la diferencia entre un cliente y un servidor MCP?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">El cliente es el componente del protocolo que utiliza un host de IA para comunicarse con los proveedores de capacidades. El servidor publica y ejecuta las capacidades que expone.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq4\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿MCP reemplaza el function calling?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. El function\u002Ftool calling es cómo un modelo invoca capacidades configuradas. MCP estandariza el descubrimiento y la comunicación con servidores de capacidades externos. Un host puede conectar ambos.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq5\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿MCP reemplaza las API REST?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. Los servidores MCP con frecuencia envuelven API REST, GraphQL, bases de datos o servicios existentes y proporcionan una capa de interoperabilidad orientada a la IA.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq6\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿MCP es un framework de agentes?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. MCP expone capacidades. La planificación del agente, el estado, la memoria, la gestión del contexto, los reintentos, la orquestación y la detención pertenecen al tiempo de ejecución circundante.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq7\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Cuál es la diferencia entre MCP y A2A?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">MCP conecta principalmente un host de IA o agente con herramientas y proveedores de datos. A2A conecta sistemas de agentes independientes para la colaboración y la delegación.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq8\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿MCP gestiona la autorización?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">MCP incluye mecanismos de autorización a nivel de protocolo, especialmente para servidores remotos, pero la aplicación aún debe hacer cumplir los permisos empresariales, la propiedad de los recursos y el aislamiento de inquilinos.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq9\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Puede MCP funcionar con modelos locales?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Sí. La ubicación del modelo es independiente de MCP. Un host con modelo local puede llamar a servidores MCP locales o remotos, y un host con modelo en la nube puede usar servidores MCP locales o remotos aprobados mediante una arquitectura de conexión adecuada.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq10\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Cuál es la versión actual de la especificación MCP?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">A 8 de octubre de 2026, la revisión actual de la especificación es 2026-07-28. Las implementaciones más antiguas de la era de 2025 siguen en uso, por lo que debe verificarse la compatibilidad.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-155\">Glosario\u003C\u002Fh2>\n\u003Csection class=\"editorjs-glossary my-6 rounded-xl border border-gray-200 dark:border-gray-700 p-5\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Términos clave de MCP\u003C\u002Fh3>\u003Cdl>\u003Cdiv id=\"mcp\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">MCP\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Model Context Protocol, un protocolo abierto para conexiones interoperables entre hosts\u002Fclientes de IA y servidores de capacidades externos.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"mcp-host\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Host MCP\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">La aplicación de IA o el tiempo de ejecución que posee la interacción con el modelo y utiliza clientes MCP para conectarse a los servidores.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"mcp-client\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Cliente MCP\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Componente del protocolo del lado del host que se comunica con un servidor MCP.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"mcp-server\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Servidor MCP\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Proveedor de capacidades que implementa MCP y expone herramientas, recursos, prompts o extensiones compatibles.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"mcp-tool\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Herramienta\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Capacidad estructurada invocable expuesta por un servidor MCP.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"mcp-resource\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Recurso\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Datos o contenido legible expuesto a través de los métodos de recursos de MCP.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"mcp-prompt\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Prompt\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Plantilla de prompt reutilizable expuesta por un servidor MCP para hosts compatibles.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"streamable-http\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Streamable HTTP\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Transporte MCP orientado a HTTP utilizado para la comunicación con servidores remotos o en red.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"stdio\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">stdio\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Transporte de entrada\u002Fsalida estándar de procesos que se usa comúnmente para integraciones locales de servidores MCP.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"server-discover\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">server\u002Fdiscover\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Método moderno de MCP que permite a un cliente inspeccionar las capacidades del servidor en la era del protocolo 2026-07-28.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"mrtr\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">MRTR\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Multi Round-Trip Requests, un mecanismo para obtener información adicional durante una solicitud en la era del protocolo 2026-07-28.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"mcp-extension\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Extensión MCP\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Capacidad que se compone con el protocolo base y puede evolucionar\u002Fversionarse por separado, como Tasks o MCP Apps.\u003C\u002Fdd>\u003C\u002Fdiv>\u003C\u002Fdl>\u003C\u002Fsection>\n\u003Ch2 id=\"section-157\">Conclusión\u003C\u002Fh2>\n\u003Cp>MCP es más fácil de entender cuando su límite se mantiene estrecho: conecta aplicaciones de IA con capacidades externas a través de un protocolo estándar.\u003C\u002Fp>\n\u003Cp>El modelo no tiene que residir en el servidor MCP. El servidor no se convierte en el tiempo de ejecución del agente. Una herramienta listada no se convierte en una acción empresarial autorizada. Y MCP no reemplaza la API subyacente, la Fuente de Verdad, el aislamiento de inquilinos ni la arquitectura de dominio.\u003C\u002Fp>\n\u003Cp>Esa estrechez es la fortaleza del protocolo. MCP puede estandarizar cómo los sistemas de IA acceden a herramientas y datos, dejando la propiedad de la aplicación, la seguridad, la semántica empresarial y la elección del modelo en las capas que realmente las poseen.\u003C\u002Fp>\n\u003Ch2 id=\"section-161\">Fuentes primarias y documentación actual\u003C\u002Fh2>\n\u003Cp>MCP evoluciona rápidamente, por lo que las afirmaciones sensibles a la versión en este artículo están vinculadas al estado del 8 de octubre de 2026. La sección Aaasaasa AI Client es evidencia de implementación original y está explícitamente limitada al alcance verificado del conector MCP y del intermediario de permisos.\u003C\u002Fp>\n\u003Ca href=\"https:\u002F\u002Fts.sdk.modelcontextprotocol.io\u002Fv2\u002F\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Model Context Protocol — SDK de TypeScript v2\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Documentación actual del SDK estable de TypeScript que implementa la especificación MCP 2026-07-28 y las primitivas de servidor\u002Fcliente.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fblog.modelcontextprotocol.io\u002Fposts\u002F2026-07-28\u002F\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Model Context Protocol — Lanzamiento de la especificación 2026-07-28\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Explicación oficial del lanzamiento de la revisión actual del protocolo MCP, incluidos el núcleo sin estado, MRTR, enrutamiento, almacenamiento en caché, refuerzo de autorización, extensiones y obsolescencias.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fts.sdk.modelcontextprotocol.io\u002Fv2\u002Fmigration\u002Fsupport-2026-07-28\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">SDK de TypeScript de MCP — Compatibilidad con la revisión del protocolo 2026-07-28\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía de implementación específica de la versión para la revisión actual del protocolo y la compatibilidad con épocas anteriores.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Ftools-connectors-mcp\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">OpenAI — Servidores MCP\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía actual de OpenAI para conectar modelos a servidores MCP remotos y servidores MCP locales\u002Fprivados a través de Secure MCP Tunnel.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Fagents-api\u002Ftools\u002Fmcp\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">OpenAI — Conexiones MCP para la API de Agents\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía actual de conexión MCP que cubre ubicaciones de servicio, entorno y stdio, además de controles de herramientas permitidas.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Ftools\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">OpenAI — Herramientas\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Descripción general actual que sitúa los servidores MCP remotos junto al llamamiento de funciones, la búsqueda web, el shell y otras herramientas del modelo.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdevelopers.openai.com\u002Fplugins\u002Fconcepts\u002Fmcp-server\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">OpenAI — Concepto de servidor MCP\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Descripción actual de los servidores MCP que exponen herramientas, recursos y prompts para integraciones con servicios externos.\u003C\u002Fp>\u003C\u002Fa>",{"time":212,"blocks":213,"version":1609},1791486830576,[214,220,228,235,242,249,257,262,267,272,277,282,287,292,297,326,331,336,341,346,351,378,383,388,393,427,432,437,442,447,452,457,462,467,472,477,482,487,492,517,522,527,532,537,543,548,553,558,563,568,597,602,607,612,617,622,627,632,637,642,651,656,661,666,671,676,693,698,703,708,740,745,750,755,760,765,770,775,780,785,790,795,800,805,810,815,820,826,831,836,841,846,851,856,861,866,871,876,881,886,891,896,901,906,911,940,945,950,955,960,965,970,975,980,985,1023,1028,1034,1039,1044,1049,1054,1080,1086,1091,1114,1119,1124,1129,1134,1139,1183,1188,1232,1237,1279,1284,1336,1341,1346,1351,1356,1361,1366,1371,1376,1381,1386,1391,1396,1401,1406,1414,1419,1465,1470,1515,1520,1525,1530,1535,1540,1545,1555,1564,1573,1582,1591,1600],{"id":215,"data":216,"type":218,"tunes":219},"intro",{"text":217},"El Protocolo de Contexto de Modelo (MCP) es un protocolo abierto para conectar aplicaciones de IA a capacidades e información externas mediante contratos estandarizados de cliente-servidor. Un servidor MCP puede exponer herramientas, recursos y prompts; un host o cliente compatible con MCP descubre y utiliza esas capacidades en nombre de una aplicación de IA. MCP no requiere que el servidor ejecute su propio modelo de lenguaje, y no reemplaza el entorno de ejecución del agente, la autorización empresarial, el aislamiento de inquilinos, las API de aplicación ni la arquitectura de dominio detrás de las capacidades expuestas.","paragraph",{},{"id":221,"data":222,"type":226,"tunes":227},"direct",{"body":223,"title":224,"variant":225},"\u003Cstrong>MCP estandariza el límite entre un host de IA y los proveedores de capacidades externas.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>Un modelo mental útil es:\u003Cbr>\u003Cstrong>Usuario → host de IA \u002F entorno de ejecución del agente → cliente MCP → servidor MCP → aplicación\u002FAPI\u002Fdatos\u002Fherramienta\u003C\u002Fstrong>.\u003Cbr>\u003Cbr>El modelo puede permanecer completamente del lado del host. El servidor MCP puede ser software determinista ordinario que expone capacidades estructuradas.","Respuesta directa","info","callout",{},{"id":229,"data":230,"type":226,"tunes":234},"server-no-ai",{"body":231,"title":232,"variant":233},"Un servidor MCP de sistema de archivos puede listar o leer archivos. Un servidor MCP de base de datos puede ejecutar consultas aprobadas. Un servidor MCP de Jira puede exponer operaciones de incidencias. Ninguno de esos servidores necesita un LLM para cumplir el contrato MCP. Si un servidor utiliza IA internamente, eso es una decisión de implementación detrás del límite del protocolo, no un requisito de MCP.","Un servidor MCP no necesita su propio modelo de IA","success",{},{"id":236,"data":237,"type":226,"tunes":241},"boundary",{"body":238,"title":239,"variant":240},"Si un servidor MCP expone \u003Ccode>delete_file\u003C\u002Fcode>, \u003Ccode>refund_order\u003C\u002Fcode> o \u003Ccode>deploy_service\u003C\u002Fcode>, eso solo significa que la capacidad existe. El servidor\u002Faplicación aún debe hacer cumplir la identidad, los permisos, el alcance del inquilino, las reglas de negocio, los requisitos de confirmación y los controles de auditoría. El descubrimiento del protocolo nunca debe convertirse silenciosamente en autorización.","La capacidad MCP no es autoridad empresarial","warning",{},{"id":243,"data":244,"type":226,"tunes":248},"current",{"body":245,"title":246,"variant":247},"La revisión actual de la especificación MCP es \u003Cstrong>2026-07-28\u003C\u002Fstrong>. Su cambio principal es un núcleo de protocolo sin estado con solicitudes autodescriptivas, \u003Ccode>server\u002Fdiscover\u003C\u002Fcode> opcional, encabezados HTTP enrutables, respuestas de lista\u002Frecurso almacenables en caché, endurecimiento de la autorización y un modelo de extensión formal. El SDK de TypeScript v2 es la línea de SDK estable actual que implementa esta revisión. Aún existen clientes y servidores más antiguos de la era de 2025, por lo que la guía de implementación debe seguir siendo consciente de la versión.","Nota de fuente actual — 8 de octubre de 2026","note",{},{"id":250,"data":251,"type":255,"tunes":256},"toc",{"title":252,"maxLevel":253,"minLevel":254},"Contenido",3,2,"tableOfContents",{},{"id":258,"data":259,"type":42,"tunes":261},"h-meaning",{"text":260,"level":254},"Qué estandariza realmente MCP",{},{"id":263,"data":264,"type":218,"tunes":266},"p-meaning-1",{"text":265},"Antes de MCP, cada aplicación de IA podía integrar sistemas externos mediante su propio esquema de herramientas, formato de complementos, convención de autenticación y código de conexión. El mismo servicio podía necesitar adaptadores diferentes para un cliente de IA de escritorio, un agente de IDE y una aplicación personalizada.",{},{"id":268,"data":269,"type":218,"tunes":271},"p-meaning-2",{"text":270},"MCP crea un límite de protocolo reutilizable. El sistema externo expone capacidades a través de un servidor MCP, mientras que los hosts de IA compatibles implementan un cliente MCP. Esto reduce el acoplamiento de integración entre la aplicación de IA y el proveedor subyacente de herramientas o datos.",{},{"id":273,"data":274,"type":218,"tunes":276},"p-meaning-3",{"text":275},"El protocolo no estandariza toda la aplicación. Estandariza cómo se describen, descubren e invocan las capacidades a través de ese límite.",{},{"id":278,"data":279,"type":42,"tunes":281},"h-simple",{"text":280,"level":254},"El ejemplo más simple",{},{"id":283,"data":284,"type":218,"tunes":286},"p-simple-1",{"text":285},"Supongamos que una aplicación de IA para programar necesita acceso a un directorio de proyecto local. Sin MCP, la aplicación podría implementar su propia integración de sistema de archivos directamente.",{},{"id":288,"data":289,"type":218,"tunes":291},"p-simple-2",{"text":290},"Con MCP, un servidor de sistema de archivos puede exponer capacidades como listar directorios, leer archivos aprobados o escribir dentro de un espacio de trabajo permitido. El host de IA se conecta a través de un cliente MCP y presenta esas capacidades al modelo o al entorno de ejecución del agente.",{},{"id":293,"data":294,"type":218,"tunes":296},"p-simple-3",{"text":295},"El servidor no necesita entender la solicitud en lenguaje natural del usuario. El host\u002Fmodelo decide qué capacidad es útil; el servidor MCP ejecuta la solicitud estructurada bajo sus propias reglas de seguridad.",{},{"id":298,"data":299,"type":324,"tunes":325},"simple-flow",{"steps":300,"title":322,"orientation":323},[301,304,307,310,313,316,319],{"label":302,"description":303},"1. El host se conecta al servidor","La aplicación compatible con MCP configura el acceso al servidor MCP externo.",{"label":305,"description":306},"2. Se descubren las capacidades","El cliente conoce qué herramientas, recursos o prompts expone el servidor.",{"label":308,"description":309},"3. El modelo o entorno selecciona una capacidad","La aplicación de IA decide que se necesita una capacidad expuesta.",{"label":311,"description":312},"4. El cliente envía una solicitud estructurada","Los argumentos se envían a través de MCP al servidor.",{"label":314,"description":315},"5. El servidor autoriza y ejecuta","El servidor valida la solicitud y llama a su sistema subyacente.",{"label":317,"description":318},"6. El resultado vuelve al host","El resultado se convierte en una observación o entrada de contexto.",{"label":320,"description":321},"7. El host decide qué sucede después","El modelo\u002Fentorno puede responder, llamar a otra herramienta o continuar un flujo de trabajo.","Una llamada básica a herramienta MCP","auto","processFlow",{},{"id":327,"data":328,"type":42,"tunes":330},"h-stops",{"text":329,"level":254},"Dónde se detiene el ejemplo simple",{},{"id":332,"data":333,"type":218,"tunes":335},"p-stops-1",{"text":334},"MCP no define cómo el host elige una herramienta, cómo planifica un agente, cómo se modela un flujo de trabajo empresarial o cómo debería comportarse un objeto de dominio como una factura o un despliegue.",{},{"id":337,"data":338,"type":218,"tunes":340},"p-stops-2",{"text":339},"Un protocolo puede hacer que la integración sea interoperable mientras la aplicación subyacente sigue siendo incorrecta, insegura o mal diseñada. Una solicitud MCP perfectamente válida aún puede llamar a la capacidad empresarial equivocada.",{},{"id":342,"data":343,"type":218,"tunes":345},"p-stops-3",{"text":344},"El límite central es: MCP estandariza la semántica de integración, no la verdad de la aplicación ni la corrección del negocio.",{},{"id":347,"data":348,"type":42,"tunes":350},"h-architecture",{"text":349,"level":254},"La arquitectura MCP: host, cliente y servidor",{},{"id":352,"data":353,"type":376,"tunes":377},"architecture-table",{"content":354,"stretched":43,"withHeadings":14},[355,358,361,364,367,370,373],[356,357],"Componente","Responsabilidad",[359,360],"Host de IA","Aplicación o entorno de ejecución de IA orientado al usuario que posee la interacción con el modelo, el contexto y el flujo de trabajo general",[362,363],"Cliente MCP","Componente del lado del protocolo utilizado por el host para comunicarse con un servidor MCP",[365,366],"Servidor MCP","Publica capacidades y gestiona las solicitudes MCP",[368,369],"Sistema subyacente","Aplicación, API, base de datos, sistema de archivos, plataforma SaaS o servicio detrás del servidor MCP",[371,372],"Modelo","Elige o razona sobre las capacidades según el diseño del host\u002Fentorno de ejecución; no está necesariamente dentro del servidor MCP",[374,375],"Autorización\u002Fpolítica de negocio","Determina si una operación solicitada está realmente permitida","table",{},{"id":379,"data":380,"type":218,"tunes":382},"p-architecture-1",{"text":381},"Un host puede conectarse a múltiples servidores MCP, y un servidor MCP puede estar frente a uno o varios sistemas subyacentes. El host sigue siendo responsable de integrar los resultados de MCP en la aplicación de IA más amplia.",{},{"id":384,"data":385,"type":218,"tunes":387},"p-architecture-2",{"text":386},"El servidor puede ser local al host, ejecutarse como un proceso separado o ser remoto a través de un transporte de red. La topología de alojamiento y la ubicación del modelo son decisiones independientes.",{},{"id":389,"data":390,"type":42,"tunes":392},"h-primitives",{"text":391,"level":254},"Las tres primitivas centrales del servidor",{},{"id":394,"data":395,"type":425,"tunes":426},"primitives-comparison",{"rows":396,"title":414,"layout":376,"columns":415},[397,402,406,410],{"id":398,"label":399,"values":400},"purpose","Propósito principal",[401,401,401],"",{"id":403,"label":404,"values":405},"interaction","Interacción típica",[401,401,401],{"id":407,"label":408,"values":409},"example","Ejemplo",[401,401,401],{"id":411,"label":412,"values":413},"risk","Riesgo típico",[401,401,401],"Herramientas, recursos y prompts resuelven necesidades diferentes",[416,419,422],{"id":417,"label":418},"tools","Herramientas",{"id":420,"label":421},"resources","Recursos",{"id":423,"label":424},"prompts","Prompts","comparison",{},{"id":428,"data":429,"type":42,"tunes":431},"h-tools",{"text":430,"level":254},"Herramientas: capacidades invocables",{},{"id":433,"data":434,"type":218,"tunes":436},"p-tools-1",{"text":435},"Las herramientas son operaciones estructuradas que un servidor MCP pone a disposición del host. Una herramienta tiene un nombre, una descripción y un esquema de entrada; las implementaciones modernas también pueden proporcionar salida estructurada.",{},{"id":438,"data":439,"type":218,"tunes":441},"p-tools-2",{"text":440},"Los ejemplos incluyen buscar en un repositorio, leer un registro de cliente, crear un ticket, ejecutar una compilación o enviar un mensaje. Las herramientas pueden ser de solo lectura o tener efectos secundarios.",{},{"id":443,"data":444,"type":218,"tunes":446},"p-tools-3",{"text":445},"Una buena superficie de herramientas MCP debería representar objetivos coherentes del usuario o del agente en lugar de reflejar mecánicamente cada punto final de API interno. Las operaciones con diferentes permisos, requisitos de confirmación o radio de impacto generalmente deberían ser herramientas separadas.",{},{"id":448,"data":449,"type":42,"tunes":451},"h-resources",{"text":450,"level":254},"Recursos: contexto y datos legibles",{},{"id":453,"data":454,"type":218,"tunes":456},"p-res-1",{"text":455},"Los recursos exponen datos o contenido que un cliente puede listar o leer. Encajan naturalmente cuando la operación semántica es «dame este artefacto o información» en lugar de «realiza esta acción».",{},{"id":458,"data":459,"type":218,"tunes":461},"p-res-2",{"text":460},"Un URI de recurso no es una concesión de autorización. El servidor sigue siendo el propietario del control de acceso y debe verificar qué principal puede leer el objeto subyacente.",{},{"id":463,"data":464,"type":218,"tunes":466},"p-res-3",{"text":465},"La revisión del protocolo del 28-07-2026 añade semántica de caché para las respuestas de listado y lectura de recursos, incluida la frescura y el alcance de la caché, lo que hace que el comportamiento de almacenamiento en caché sea más explícito.",{},{"id":468,"data":469,"type":42,"tunes":471},"h-prompts",{"text":470,"level":254},"Prompts: plantillas reutilizables",{},{"id":473,"data":474,"type":218,"tunes":476},"p-prompts-1",{"text":475},"Los prompts MCP permiten que un servidor publique plantillas de prompts reutilizables para clientes compatibles. Esto puede mantener las instrucciones específicas del dominio cerca del proveedor de capacidades.",{},{"id":478,"data":479,"type":218,"tunes":481},"p-prompts-2",{"text":480},"Un prompt proporcionado por un servidor MCP no supera automáticamente las instrucciones del sistema o de seguridad del host. El host decide cómo el material del prompt entra en su jerarquía de contexto.",{},{"id":483,"data":484,"type":218,"tunes":486},"p-prompts-3",{"text":485},"Por lo tanto, el contenido de los prompts proporcionado por el protocolo debe tratarse como datos de capacidad con semántica de confianza explícita, no como autoridad de instrucción sin restricciones.",{},{"id":488,"data":489,"type":42,"tunes":491},"h-tool-vs-resource",{"text":490,"level":254},"¿Herramienta o recurso?",{},{"id":493,"data":494,"type":376,"tunes":516},"tool-resource-table",{"content":495,"stretched":43,"withHeadings":14},[496,499,502,505,508,510,513],[497,498],"Necesidad","Preferir",[500,501],"Realizar una acción con argumentos estructurados","Herramienta",[503,504],"Leer un artefacto estable específico","Recurso",[506,507],"Buscar o calcular dinámicamente","Generalmente herramienta",[509,501],"Modificar el estado externo",[511,512],"Empaquetar instrucciones de prompt reutilizables","Prompt",[514,515],"Ejecución asíncrona de larga duración","Herramienta más manejo de tareas de aplicación\u002Fruntime o una extensión MCP",{},{"id":518,"data":519,"type":42,"tunes":521},"h-model-location",{"text":520,"level":254},"¿Dónde está el modelo de IA?",{},{"id":523,"data":524,"type":218,"tunes":526},"p-location-1",{"text":525},"MCP no requiere que el modelo se ejecute en el servidor MCP. El modelo puede estar alojado en la nube, alojado localmente, integrado en la aplicación de escritorio o accedido a través de otro proveedor.",{},{"id":528,"data":529,"type":218,"tunes":531},"p-location-2",{"text":530},"El host normalmente posee la interacción con el modelo. El servidor MCP expone capacidad externa. Por lo tanto, un servidor MCP local puede ser utilizado por un host cuyo modelo se ejecuta en la nube, y un servidor MCP remoto puede ser utilizado por un host cuyo modelo se ejecuta localmente.",{},{"id":533,"data":534,"type":218,"tunes":536},"p-location-3",{"text":535},"Si el propio servidor MCP llama internamente a un LLM, ese modelo forma parte de la implementación del servidor detrás del límite del protocolo; MCP no lo requiere.",{},{"id":538,"data":539,"type":226,"tunes":542},"location-rule",{"body":540,"title":541,"variant":233},"\u003Cstrong>MCP local no implica inferencia local, y MCP remoto no implica inferencia remota.\u003C\u002Fstrong> La ubicación de la conexión, la ubicación de ejecución de la herramienta y la ubicación del modelo\u002Fproveedor son dimensiones arquitectónicas separadas.","Ubicación del protocolo ≠ ubicación de la inferencia",{},{"id":544,"data":545,"type":42,"tunes":547},"h-mcp-vs-api",{"text":546,"level":254},"MCP no reemplaza las API",{},{"id":549,"data":550,"type":218,"tunes":552},"p-api-1",{"text":551},"Un servidor MCP a menudo envuelve API o servicios existentes. REST, GraphQL, SQL, llamadas a SDK y contratos de servicios internos pueden permanecer exactamente donde están.",{},{"id":554,"data":555,"type":218,"tunes":557},"p-api-2",{"text":556},"MCP añade una capa de interoperabilidad orientada a la IA. La API de dominio subyacente puede seguir siendo el contrato de aplicación autoritativo para clientes deterministas ordinarios.",{},{"id":559,"data":560,"type":218,"tunes":562},"p-api-3",{"text":561},"Por lo tanto, la arquitectura habitual es primero API\u002Fservicio, segundo capacidad seleccionada orientada a la IA — no “reemplazar cada API con MCP”.",{},{"id":564,"data":565,"type":42,"tunes":567},"h-function-calling",{"text":566,"level":254},"MCP vs llamada a funciones",{},{"id":569,"data":570,"type":425,"tunes":596},"function-comparison",{"rows":571,"title":588,"layout":376,"columns":589},[572,576,580,584],{"id":573,"label":574,"values":575},"scope","Alcance",[401,401],{"id":577,"label":578,"values":579},"definition","Definición de herramienta",[401,401],{"id":581,"label":582,"values":583},"portability","Portabilidad",[401,401],{"id":585,"label":586,"values":587},"coexist","¿Pueden coexistir?",[401,401],"La llamada a funciones y MCP están relacionadas pero no son idénticas",[590,593],{"id":591,"label":592},"function","Llamada a funciones",{"id":594,"label":595},"mcp","MCP",{},{"id":598,"data":599,"type":218,"tunes":601},"p-function-1",{"text":600},"OpenAI actualmente expone servidores MCP remotos como un tipo de herramienta junto con la llamada a funciones ordinaria, búsqueda web, shell y otras herramientas. Esa implementación ilustra la relación arquitectónica: la conectividad MCP y la interfaz de llamada a herramientas del propio modelo pueden componerse.",{},{"id":603,"data":604,"type":42,"tunes":606},"h-agent",{"text":605,"level":254},"MCP no crea el bucle del agente",{},{"id":608,"data":609,"type":218,"tunes":611},"p-agent-1",{"text":610},"Un agente de IA necesita un runtime que pueda decidir, invocar herramientas, observar resultados, actualizar el estado y continuar o detenerse. MCP puede proporcionar algunas de las herramientas y datos utilizados por ese bucle.",{},{"id":613,"data":614,"type":218,"tunes":616},"p-agent-2",{"text":615},"El servidor MCP no se convierte automáticamente en el planificador, el sistema de memoria o el orquestador. Esas responsabilidades normalmente permanecen en el host o en el runtime del agente.",{},{"id":618,"data":619,"type":218,"tunes":621},"p-agent-3",{"text":620},"Una aplicación no agéntica también puede usar MCP. Una llamada determinista a una herramienta MCP no requiere un agente autónomo de varios pasos.",{},{"id":623,"data":624,"type":42,"tunes":626},"h-a2a",{"text":625,"level":254},"MCP vs A2A",{},{"id":628,"data":629,"type":218,"tunes":631},"p-a2a-1",{"text":630},"MCP conecta principalmente un host de IA o un agente con capacidades como herramientas, recursos y datos. A2A se orienta a la colaboración entre sistemas de agentes independientes.",{},{"id":633,"data":634,"type":218,"tunes":636},"p-a2a-2",{"text":635},"Un agente remoto puede usar MCP internamente para acceder a bases de datos y herramientas mientras expone una interfaz A2A a otros agentes. Por lo tanto, los protocolos pueden estratificarse en lugar de sustituirse.",{},{"id":638,"data":639,"type":218,"tunes":641},"p-a2a-3",{"text":640},"El artículo existente sobre la pila de protocolos es el responsable de la comparación más amplia entre MCP\u002FA2A\u002FUCP\u002FAP2\u002FA2UI; G02 sigue siendo la definición canónica de MCP.",{},{"id":643,"data":644,"type":649,"tunes":650},"ref-protocol-stack",{"url":645,"title":646,"excerpt":647,"ctaLabel":648},"https:\u002F\u002Fstajic.de\u002Fde\u002Fblog\u002Fmcp-vs-a2a-vs-ucp-vs-ap2-vs-a2ui-the-agent-protocol-stack-explained","MCP vs A2A vs UCP vs AP2 vs A2UI: La pila de protocolos de agentes explicada","Un mapa de responsabilidades más amplio que muestra cómo MCP se compone con la colaboración de agentes, el comercio, la autoridad de pago y los protocolos de interfaz de usuario impulsados por agentes.","Leer la pila de protocolos","referralArticle",{},{"id":652,"data":653,"type":42,"tunes":655},"h-transport",{"text":654,"level":254},"El uso local y remoto de MCP tiene realidades de transporte diferentes",{},{"id":657,"data":658,"type":218,"tunes":660},"p-transport-1",{"text":659},"MCP puede conectarse a servidores locales y remotos. Las integraciones de escritorio locales suelen usar transportes a nivel de proceso como stdio; los servidores remotos usan transporte orientado a HTTP.",{},{"id":662,"data":663,"type":218,"tunes":665},"p-transport-2",{"text":664},"La revisión del 2026-07-28 hace que el núcleo del protocolo sea sin estado. Las solicitudes llevan la información necesaria para el manejo del protocolo en lugar de depender del modelo de sesión anterior a nivel de protocolo.",{},{"id":667,"data":668,"type":218,"tunes":670},"p-transport-3",{"text":669},"La revisión actual también coloca los nombres de métodos y capacidades en encabezados HTTP para que las pasarelas, WAF, limitadores de velocidad y balanceadores de carga puedan enrutar y medir el tráfico MCP de forma más natural.",{},{"id":672,"data":673,"type":42,"tunes":675},"h-version",{"text":674,"level":254},"Por qué importa la conciencia de la versión de MCP",{},{"id":677,"data":678,"type":376,"tunes":692},"version-table",{"content":679,"stretched":43,"withHeadings":14},[680,683,686,689],[681,682],"Era del protocolo","Característica operativa",[684,685],"2025-11-25 y anteriores","Ciclo de vida orientado a handshake\u002Fsesión y comportamiento anterior de Streamable HTTP",[687,688],"2026-07-28","Núcleo sin estado, descubrimiento opcional del servidor, solicitudes autodescriptivas, encabezados de enrutamiento, sugerencias de caché, MRTR y endurecimiento de la autorización",[690,691],"Extensiones","Capacidades como Tasks y MCP Apps pueden versionarse por separado del protocolo base",{},{"id":694,"data":695,"type":218,"tunes":697},"p-version-1",{"text":696},"La versión del SDK y la versión del protocolo también son cosas diferentes. El SDK actual de TypeScript v2 es la línea estable para la revisión del 2026-07-28, mientras que el anterior v1.x sigue siendo una línea de mantenimiento para el comportamiento de la era 2025.",{},{"id":699,"data":700,"type":218,"tunes":702},"p-version-2",{"text":701},"La documentación de arquitectura debe registrar tanto la versión del SDK\u002Fbiblioteca como la revisión del protocolo cuando el comportamiento de interoperabilidad dependa de ellas.",{},{"id":704,"data":705,"type":42,"tunes":707},"h-modern",{"text":706,"level":254},"Qué cambió en MCP 2026-07-28",{},{"id":709,"data":710,"type":376,"tunes":739},"modern-table",{"content":711,"stretched":43,"withHeadings":14},[712,715,718,721,724,727,730,733,736],[713,714],"Cambio","Por qué importa",[716,717],"Núcleo sin estado","Los servidores remotos pueden escalar detrás de balanceadores de carga ordinarios sin sesiones persistentes a nivel de protocolo",[719,720],"server\u002Fdiscover","Los clientes pueden inspeccionar las capacidades del servidor cuando sea necesario",[722,723],"Solicitudes autodescriptivas","La versión del protocolo y los metadatos de capacidad del cliente viajan por solicitud",[725,726],"Encabezados Mcp-Method \u002F Mcp-Name","Las pasarelas pueden enrutar, medir y aplicar políticas sin analizar los cuerpos",[728,729],"Sugerencias de caché","Las listas\u002Flecturas de recursos comunican la frescura y el alcance de compartición",[731,732],"Solicitudes de múltiples rondas","Los servidores pueden requerir entrada adicional sin el modelo anterior de solicitud bidireccional",[734,735],"Endurecimiento de la autorización","La validación del emisor y el enlace de credenciales refuerzan el comportamiento de autenticación remota",[737,738],"Marco de extensiones","Tasks, MCP Apps y otras capacidades pueden evolucionar por separado",{},{"id":741,"data":742,"type":42,"tunes":744},"h-deprecations",{"text":743,"level":254},"Roots, sampling y logging ya no son la dirección para nuevas implementaciones",{},{"id":746,"data":747,"type":218,"tunes":749},"p-dep-1",{"text":748},"La versión 2026-07-28 marca roots, sampling y logging como capacidades de protocolo obsoletas con una ventana de compatibilidad definida.",{},{"id":751,"data":752,"type":218,"tunes":754},"p-dep-2",{"text":753},"Los tutoriales más antiguos pueden seguir mostrando estas características como primitivas centrales. El nuevo trabajo de implementación debe seguir la especificación actual en lugar de copiar ciegamente diagramas de ciclo de vida antiguos.",{},{"id":756,"data":757,"type":218,"tunes":759},"p-dep-3",{"text":758},"La deprecación no significa eliminación inmediata. Significa que los nuevos sistemas deben evitar dependencias nuevas innecesarias sobre capacidades de las que el protocolo se está alejando.",{},{"id":761,"data":762,"type":42,"tunes":764},"h-tasks",{"text":763,"level":254},"El trabajo de larga duración no es lo mismo que la invocación ordinaria de herramientas MCP",{},{"id":766,"data":767,"type":218,"tunes":769},"p-task-1",{"text":768},"Las operaciones de larga duración necesitan semántica de ciclo de vida más allá de un simple resultado inmediato de herramienta. En el ecosistema actual, Tasks se trasladó a una extensión MCP dedicada.",{},{"id":771,"data":772,"type":218,"tunes":774},"p-task-2",{"text":773},"Esto refuerza un principio de diseño útil: el protocolo base no necesita absorber todas las preocupaciones del tiempo de ejecución del agente.",{},{"id":776,"data":777,"type":218,"tunes":779},"p-task-3",{"text":778},"Una aplicación también puede mantener la propiedad del flujo de trabajo de larga duración enteramente en su propio tiempo de ejecución y usar herramientas MCP ordinarias como operaciones subyacentes.",{},{"id":781,"data":782,"type":42,"tunes":784},"h-apps",{"text":783,"level":254},"MCP Apps extiende la capacidad de la interfaz de usuario sin redefinir el protocolo central",{},{"id":786,"data":787,"type":218,"tunes":789},"p-apps-1",{"text":788},"MCP Apps asocia experiencias de interfaz de usuario interactivas más ricas con herramientas MCP a través del modelo de extensión.",{},{"id":791,"data":792,"type":218,"tunes":794},"p-apps-2",{"text":793},"El host sigue controlando cómo se incrusta, se aísla y se protege esa interfaz de usuario.",{},{"id":796,"data":797,"type":218,"tunes":799},"p-apps-3",{"text":798},"Por lo tanto, el intercambio de capacidades centrales y la representación de la interfaz de usuario deben seguir siendo responsabilidades arquitectónicas separadas.",{},{"id":801,"data":802,"type":42,"tunes":804},"h-auth",{"text":803,"level":254},"La autorización MCP no es su modelo de autorización completo",{},{"id":806,"data":807,"type":218,"tunes":809},"p-auth-1",{"text":808},"MCP remoto necesita mecanismos de autenticación y autorización a nivel de protocolo para que los clientes y servidores puedan establecer acceso confiable. La especificación actual continúa fortaleciendo el comportamiento relacionado con OAuth\u002FOIDC.",{},{"id":811,"data":812,"type":218,"tunes":814},"p-auth-2",{"text":813},"Esa capa responde si un cliente tiene permitido conectarse o solicitar ámbitos de protocolo. No responde automáticamente si Alice puede reembolsar el pedido 123, si un agente puede escribir configuración de producción o si el Inquilino A puede leer datos del Inquilino B.",{},{"id":816,"data":817,"type":218,"tunes":819},"p-auth-3",{"text":818},"Esas decisiones de dominio pertenecen al modelo de autorización del servidor\u002Faplicación y deben aplicarse antes de invocar la operación subyacente.",{},{"id":821,"data":822,"type":226,"tunes":825},"auth-rule",{"body":823,"title":824,"variant":240},"La confianza de conexión, la visibilidad de herramientas, el permiso de herramientas, la autorización del usuario, el aislamiento de inquilinos y la aprobación comercial son controles diferentes. Manténgalos separados.","Nunca asigne \"cliente MCP autenticado\" a \"confiable para todas las herramientas\"",{},{"id":827,"data":828,"type":42,"tunes":830},"h-identity",{"text":829,"level":254},"La identidad puede cruzar varios límites",{},{"id":832,"data":833,"type":218,"tunes":835},"p-id-1",{"text":834},"Una solicitud MCP puede involucrar la aplicación cliente MCP, el humano que inició sesión, una identidad de agente\u002Fsesión y una cuenta de servicio posterior.",{},{"id":837,"data":838,"type":218,"tunes":840},"p-id-2",{"text":839},"El servidor necesita una política explícita sobre en nombre de qué principal se realiza la operación. De lo contrario, una credencial de servicio poderosa puede convertirse en una ruta de diputado confundido.",{},{"id":842,"data":843,"type":218,"tunes":845},"p-id-3",{"text":844},"Para uso empresarial, la correlación entre la identidad del usuario, la identidad del agente, la conexión MCP y la autorización posterior es tan importante como la compatibilidad del protocolo.",{},{"id":847,"data":848,"type":42,"tunes":850},"h-tenant",{"text":849,"level":254},"El aislamiento de inquilinos permanece fuera del descubrimiento de capacidades de MCP",{},{"id":852,"data":853,"type":218,"tunes":855},"p-tenant-1",{"text":854},"Un servidor MCP multiinquilino debe aplicar el alcance del inquilino cuando lee o modifica recursos propiedad del inquilino. Devolver una herramienta llamada search_documents no define a qué inquilino pertenecen los documentos elegibles.",{},{"id":857,"data":858,"type":218,"tunes":860},"p-tenant-2",{"text":859},"El alcance del inquilino debe derivarse de una identidad o membresía confiable y trasladarse a bases de datos, cachés, búsqueda vectorial, almacenamiento de objetos y API posteriores.",{},{"id":862,"data":863,"type":218,"tunes":865},"p-tenant-3",{"text":864},"Recuperar contenido entre inquilinos y pedirle al modelo que no lo use ya es un fallo de aislamiento.",{},{"id":867,"data":868,"type":42,"tunes":870},"h-source",{"text":869,"level":254},"MCP no define la Fuente de Verdad",{},{"id":872,"data":873,"type":218,"tunes":875},"p-source-1",{"text":874},"Un servidor MCP puede exponer una base de datos, un repositorio de documentos, un servicio de búsqueda web o un resumen generado por IA. El protocolo no declara qué fuente es autoritativa para una afirmación.",{},{"id":877,"data":878,"type":218,"tunes":880},"p-source-2",{"text":879},"Las reglas de Fuente de Verdad pertenecen a la arquitectura de la aplicación o del dominio. El host o el servidor pueden codificar la autoridad mediante el diseño de herramientas, metadatos, políticas de acceso o validación, pero MCP por sí mismo no hace que una capacidad sea “verdadera”.",{},{"id":882,"data":883,"type":218,"tunes":885},"p-source-3",{"text":884},"Por lo tanto, una herramienta puede ser perfectamente invocable a través de MCP y aun así devolver información obsoleta, secundaria o no autoritativa.",{},{"id":887,"data":888,"type":42,"tunes":890},"h-context",{"text":889,"level":254},"MCP e ingeniería de contexto",{},{"id":892,"data":893,"type":218,"tunes":895},"p-context-1",{"text":894},"MCP puede aumentar las capacidades y la información disponibles para una aplicación de IA, pero la ingeniería de contexto sigue determinando qué llega al modelo.",{},{"id":897,"data":898,"type":218,"tunes":900},"p-context-2",{"text":899},"Los catálogos de herramientas consumen contexto visible para el modelo en muchos hosts. Los resultados de las herramientas pueden ser grandes. Los recursos pueden ser numerosos. Un host necesita selección, filtrado, carga dinámica y compactación en lugar de exponer todo en cada turno.",{},{"id":902,"data":903,"type":218,"tunes":905},"p-context-3",{"text":904},"Por lo tanto, la disponibilidad de capacidades y el contexto visible para el modelo deben tratarse como capas separadas.",{},{"id":907,"data":908,"type":42,"tunes":910},"h-tool-design",{"text":909,"level":254},"Diseñar herramientas MCP en torno a resultados y límites de riesgo",{},{"id":912,"data":913,"type":376,"tunes":939},"tool-design-table",{"content":914,"stretched":43,"withHeadings":14},[915,918,921,924,927,930,933,936],[916,917],"Diseño de herramienta débil","Diseño de herramienta más sólido",[919,920],"execute_api(method,url,body)","Herramientas de dominio estrechas con operaciones validadas",[922,923],"Una herramienta de administración para todas las acciones","Operaciones separadas de lectura\u002Fescritura\u002Faprobación",[925,926],"API interna sin procesar replicada 1:1","Contrato orientado a la IA en torno a objetivos de usuario coherentes",[928,929],"Una herramienta de sistema de archivos amplia","Operaciones de lectura\u002Fescritura con alcance de espacio de trabajo",[931,932],"Política de seguridad solo en la descripción","El servidor aplica la política en el código",[934,935],"Respuesta sin procesar sin límites","Salida estructurada relevante para la decisión",[937,938],"Eliminar\u002Factualizar mezclado con lectura","Herramientas de efectos secundarios separadas con política de confirmación",{},{"id":941,"data":942,"type":42,"tunes":944},"h-approvals",{"text":943,"level":254},"Las aprobaciones pertenecen a la arquitectura de ejecución",{},{"id":946,"data":947,"type":218,"tunes":949},"p-approve-1",{"text":948},"Un host puede requerir la aprobación del usuario antes de invocar herramientas MCP seleccionadas. La integración MCP actual de OpenAI admite patrones de ejecución automática o con aprobación explícita.",{},{"id":951,"data":952,"type":218,"tunes":954},"p-approve-2",{"text":953},"La aprobación del host es útil, pero no debería ser la única protección del servidor, porque otro cliente MCP compatible puede usar un modelo de aprobación diferente.",{},{"id":956,"data":957,"type":218,"tunes":959},"p-approve-3",{"text":958},"Para acciones destructivas o con consecuencias financieras, utilice defensa en profundidad: contrato de herramienta claro, aprobación en tiempo de ejecución cuando corresponda, autorización del lado del servidor, validación de negocio y auditoría.",{},{"id":961,"data":962,"type":42,"tunes":964},"h-observability",{"text":963,"level":254},"La observabilidad de MCP debe conectar las llamadas de protocolo con las acciones de dominio",{},{"id":966,"data":967,"type":218,"tunes":969},"p-obs-1",{"text":968},"Un rastro de MCP es más útil cuando puede correlacionarse con la llamada de aplicación subyacente, el cambio de base de datos o la transacción de negocio.",{},{"id":971,"data":972,"type":218,"tunes":974},"p-obs-2",{"text":973},"El ecosistema de 2026-07-28 estandariza las convenciones de propagación de W3C Trace Context, lo que facilita seguir una solicitud a través del host, cliente, servidor y servicios posteriores.",{},{"id":976,"data":977,"type":218,"tunes":979},"p-obs-3",{"text":978},"Los registros de protocolo por sí solos no son suficientes para operaciones con consecuencias. La evidencia de auditoría también debe registrar el principal relevante, el inquilino, el recurso objetivo, la aprobación y el cambio de estado resultante.",{},{"id":981,"data":982,"type":42,"tunes":984},"h-failure",{"text":983,"level":254},"Lo que MCP no puede solucionar",{},{"id":986,"data":987,"type":376,"tunes":1022},"failure-table",{"content":988,"stretched":43,"withHeadings":14},[989,992,995,998,1001,1004,1007,1010,1013,1016,1019],[990,991],"Problema","Por qué MCP no lo resuelve",[993,994],"API de negocio deficiente","MCP puede exponer la API deficiente de forma más consistente",[996,997],"Datos incorrectos","La validez del protocolo no crea corrección fáctica",[999,1000],"Aislamiento de inquilinos ausente","El descubrimiento de herramientas no impone la propiedad de los recursos",[1002,1003],"Privilegios excesivos","Una herramienta estandarizada aún puede tener privilegios excesivos",[1005,1006],"Planificación deficiente del agente","MCP expone capacidades; el tiempo de ejecución o el modelo aún elige cómo usarlas",[1008,1009],"Diseño deficiente de reintentos o idempotencia","Las llamadas de protocolo no hacen que los efectos secundarios sean seguros",[1011,1012],"Sin fuente de verdad","MCP no decide qué sistema posee un hecho",[1014,1015],"Evaluación débil","La interoperabilidad no demuestra el éxito de la tarea",[1017,1018],"Sin política de auditoría","Los rastros de transporte no definen la retención ni la responsabilidad",[1020,1021],"Incompatibilidad de protocolo","Las versiones antiguas o nuevas aún pueden requerir migración o manejo de compatibilidad",{},{"id":1024,"data":1025,"type":42,"tunes":1027},"h-implementation",{"text":1026,"level":254},"Evidencia de implementación original: Aaasaasa AI Client",{},{"id":1029,"data":1030,"type":226,"tunes":1033},"impl-note",{"body":1031,"title":1032,"variant":247},"Aaasaasa AI Client contiene un conector o broker MCP local autenticado para directorios locales aprobados e integración a través de Secure MCP Tunnel. Esta es evidencia de implementación concreta para el límite del protocolo y la arquitectura de permisos, no una afirmación de una plataforma MCP comercial de propósito general.","Evidencia de implementación",{},{"id":1035,"data":1036,"type":218,"tunes":1038},"p-impl-1",{"text":1037},"La aplicación puede ejecutar un endpoint MCP Streamable HTTP autenticado en loopback. El endpoint expone solo directorios seleccionados a través del broker central de permisos del espacio de trabajo.",{},{"id":1040,"data":1041,"type":218,"tunes":1043},"p-impl-2",{"text":1042},"El endpoint local y la ruta remota son preocupaciones separadas: el conector local puede enlazarse solo a loopback, mientras que un Secure MCP Tunnel puede hacer que el servicio MCP aprobado sea accesible para un cliente de IA externo permitido sin exponer toda la máquina local.",{},{"id":1045,"data":1046,"type":218,"tunes":1048},"p-impl-3",{"text":1047},"El modelo central de permisos distingue perfiles de solo chat, solo lectura, escritura de proyecto y directorio personalizado. Direct Chat no tiene acceso al sistema de archivos ni al shell; los tiempos de ejecución de agentes con capacidad de herramientas utilizan el perfil de permisos seleccionado.",{},{"id":1050,"data":1051,"type":218,"tunes":1053},"p-impl-4",{"text":1052},"Esta es una implementación directa del límite G02: MCP proporciona la conexión de capacidad estandarizada, mientras que el broker de permisos propiedad de la aplicación decide qué directorios puede exponer el servidor.",{},{"id":1055,"data":1056,"type":376,"tunes":1079},"impl-table",{"content":1057,"stretched":43,"withHeadings":14},[1058,1061,1064,1067,1070,1073,1076],[1059,1060],"Elemento implementado","Evidencia de arquitectura",[1062,1063],"Endpoint MCP local autenticado","El servidor MCP puede ser un servicio de capacidad determinista local",[1065,1066],"Enlace a loopback","La exposición de red y la capacidad de protocolo son decisiones separadas",[1068,1069],"Integración con Secure MCP Tunnel","MCP privado o local puede puentearse a través de una ruta controlada",[1071,1072],"Broker central de permisos","La capacidad de MCP está restringida por la política de la aplicación",[1074,1075],"Alcance de directorio seleccionado","La visibilidad del sistema de archivos está explícitamente delimitada",[1077,1078],"Direct Chat sin herramientas del sistema operativo","El acceso al modelo no implica automáticamente acceso a herramientas",{},{"id":1081,"data":1082,"type":226,"tunes":1085},"impl-boundary",{"body":1083,"title":1084,"variant":240},"La implementación demuestra conectividad MCP y exposición de directorios locales con alcance de permisos. No implica que cada primitiva MCP, cada característica de 2026-07-28 o cada extensión de autorización empresarial esté implementada.","Límite de la evidencia",{},{"id":1087,"data":1088,"type":42,"tunes":1090},"h-use",{"text":1089,"level":254},"Cuándo MCP es una buena opción",{},{"id":1092,"data":1093,"type":376,"tunes":1113},"use-table",{"content":1094,"stretched":43,"withHeadings":14},[1095,1098,1101,1104,1107,1110],[1096,1097],"MCP es una opción sólida cuando","Una integración directa puede ser más simple cuando",[1099,1100],"La misma capacidad debe ser reutilizable en múltiples hosts de IA","Una sola aplicación posee ambos lados y la portabilidad tiene poco valor",[1102,1103],"Un sistema externo quiere publicar herramientas o recursos descubribles orientados a IA","Una única llamada API interna estable es suficiente",[1105,1106],"Se desea un límite estándar alrededor de herramientas o datos locales","No existe un requisito de interoperabilidad orientado a IA",[1108,1109],"Los proveedores de herramientas y los clientes de IA evolucionan de forma independiente","La integración es intencionalmente privada y estrechamente acoplada",[1111,1112],"Se desea descubrimiento de capacidades compatible con el ecosistema","El conjunto de capacidades es pequeño y fijo en el código de la aplicación",{},{"id":1115,"data":1116,"type":42,"tunes":1118},"h-not-need",{"text":1117,"level":254},"Cuándo no necesita MCP",{},{"id":1120,"data":1121,"type":218,"tunes":1123},"p-not-1",{"text":1122},"No agregues MCP solo porque la aplicación use IA. Si tu backend ya llama a una API interna y ningún cliente MCP independiente necesita esa capacidad, una función o llamada de servicio ordinaria puede ser más clara.",{},{"id":1125,"data":1126,"type":218,"tunes":1128},"p-not-2",{"text":1127},"MCP aporta valor en un límite de interoperabilidad. Sin ese límite, el protocolo puede convertirse en una capa de adaptador innecesaria.",{},{"id":1130,"data":1131,"type":218,"tunes":1133},"p-not-3",{"text":1132},"La pregunta arquitectónica no es \"¿Este proyecto tiene IA?\" sino \"¿Se benefician hosts de IA y proveedores de capacidades que evolucionan de forma independiente de un contrato estándar?\"",{},{"id":1135,"data":1136,"type":42,"tunes":1138},"h-security",{"text":1137,"level":254},"Lista de verificación de seguridad de MCP",{},{"id":1140,"data":1141,"type":376,"tunes":1182},"security-table",{"content":1142,"stretched":43,"withHeadings":14},[1143,1146,1149,1152,1155,1158,1161,1164,1167,1170,1173,1176,1179],[1144,1145],"Límite","Pregunta",[1147,1148],"Identidad del servidor","¿A qué servidor MCP estoy realmente conectado?",[1150,1151],"Identidad del cliente","¿Qué aplicación\u002Fcliente solicita acceso?",[1153,1154],"Identidad del usuario final","¿En nombre de quién se realiza la operación?",[1156,1157],"Lista de herramientas permitidas","¿Qué capacidades puede descubrir y llamar este host\u002Fagente?",[1159,1160],"Permiso de negocio","¿Puede este principal realizar esta operación?",[1162,1163],"Alcance del inquilino","¿Qué límite de inquilino\u002Frecurso aplica?",[1165,1166],"Aislamiento de credenciales","¿Están las credenciales vinculadas correctamente y mantenidas fuera del contexto del modelo?",[1168,1169],"Aprobación","¿Qué efectos secundarios requieren confirmación humana?",[1171,1172],"Validación de entrada","¿Se validan los argumentos de las herramientas independientemente de la salida del modelo?",[1174,1175],"Confianza en la salida","¿Puede el contenido devuelto contener instrucciones no confiables o datos sensibles?",[1177,1178],"Exposición de red","¿Está un servidor local expuesto accidentalmente más allá de las interfaces previstas?",[1180,1181],"Auditoría","¿Se puede correlacionar una llamada al protocolo con la acción posterior?",{},{"id":1184,"data":1185,"type":42,"tunes":1187},"h-misconceptions",{"text":1186,"level":254},"Conceptos erróneos comunes",{},{"id":1189,"data":1190,"type":376,"tunes":1231},"misconceptions-table",{"content":1191,"stretched":43,"withHeadings":14},[1192,1195,1198,1201,1204,1207,1210,1213,1216,1219,1222,1225,1228],[1193,1194],"Concepto erróneo","Corrección",[1196,1197],"\"Un servidor MCP es un servidor de IA.\"","Puede ser software determinista ordinario que expone capacidades.",[1199,1200],"\"Necesito mi propio LLM en el servidor MCP.\"","No. El modelo puede residir completamente en el lado del host.",[1202,1203],"\"MCP reemplaza las API REST.\"","MCP a menudo envuelve API existentes para la interoperabilidad orientada a IA.",[1205,1206],"\"MCP es un framework de agentes.\"","MCP proporciona capacidades; un runtime de agente gestiona la iteración y el estado.",[1208,1209],"\"MCP y el function calling compiten.\"","Un host puede conectar capacidades MCP a su interfaz de herramientas del modelo.",[1211,1212],"\"MCP reemplaza A2A.\"","MCP se centra en la integración de capacidades; A2A se centra en la colaboración entre agentes.",[1214,1215],"\"Si una herramienta está listada, el usuario puede llamarla.\"","El descubrimiento no es autorización.",[1217,1218],"\"OAuth resuelve los permisos de negocio.\"","La autorización de conexión no reemplaza la autorización de dominio ni el aislamiento de inquilinos.",[1220,1221],"\"MCP local significa IA local.\"","La ubicación del servidor de herramientas y la ubicación de la inferencia son independientes.",[1223,1224],"\"MCP hace que la salida de las herramientas sea confiable.\"","La calidad de los datos, la autoridad y la procedencia siguen perteneciendo a la fuente\u002Faplicación.",[1226,1227],"\"Una herramienta genérica gigante es flexible.\"","Las herramientas demasiado amplias debilitan los permisos, la validación y la observabilidad.",[1229,1230],"\"Los tutoriales antiguos están actualizados en implementación.\"","La revisión del 2026-07-28 cambió sustancialmente el ciclo de vida y el comportamiento del transporte.",{},{"id":1233,"data":1234,"type":42,"tunes":1236},"h-design",{"text":1235,"level":254},"Una secuencia práctica de diseño de MCP",{},{"id":1238,"data":1239,"type":324,"tunes":1278},"design-flow",{"steps":1240,"title":1277,"orientation":323},[1241,1244,1247,1250,1253,1256,1259,1262,1265,1268,1271,1274],{"label":1242,"description":1243},"1. Identifica el límite de interoperabilidad","Confirma que los hosts de IA independientes realmente necesitan acceso reutilizable.",{"label":1245,"description":1246},"2. Mantén la API de dominio como autoritativa","Preserva el contrato real de la aplicación\u002Fservicio detrás de MCP.",{"label":1248,"description":1249},"3. Elige las primitivas deliberadamente","Usa herramientas, recursos y prompts según su semántica.",{"label":1251,"description":1252},"4. Divide por riesgo y permiso","Separa operaciones de lectura, escritura, destructivas y que requieren aprobación.",{"label":1254,"description":1255},"5. Define la propagación de identidad","Conoce qué cliente, usuario, agente y principal posterior representa cada llamada.",{"label":1257,"description":1258},"6. Aplica la autorización de negocio","Valida permisos, alcance del inquilino y propiedad del objetivo.",{"label":1260,"description":1261},"7. Elige transporte local o remoto","Ajusta la topología de despliegue a la necesidad real.",{"label":1263,"description":1264},"8. Fija las expectativas de protocolo\u002FSDK","Documenta la compatibilidad de 2026-07-28 frente a versiones anteriores.",{"label":1266,"description":1267},"9. Agrega aprobaciones para acciones trascendentales","Usa controles de confirmación apropiados al riesgo.",{"label":1269,"description":1270},"10. Diseña salidas estructuradas","Devuelve resultados concisos y utilizables por máquinas.",{"label":1272,"description":1273},"11. Agrega trazabilidad y correlación de auditoría","Conecta las llamadas MCP con eventos posteriores de servicio\u002Fnegocio.",{"label":1275,"description":1276},"12. Prueba la portabilidad","Verifica más de un cliente donde la interoperabilidad sea un requisito declarado.","Diseña el límite antes de implementar el servidor",{},{"id":1280,"data":1281,"type":42,"tunes":1283},"h-checklist",{"text":1282,"level":254},"Lista de verificación de arquitectura de MCP",{},{"id":1285,"data":1286,"type":376,"tunes":1335},"checklist-table",{"content":1287,"stretched":43,"withHeadings":14},[1288,1290,1293,1296,1299,1302,1305,1308,1311,1314,1317,1320,1323,1326,1329,1332],[1145,1289],"Respuesta esperada",[1291,1292],"¿Por qué se necesita MCP?","Un límite real de interoperabilidad orientado a IA",[1294,1295],"¿Qué expone el servidor?","Herramientas\u002Frecursos\u002Fprompts explícitos",[1297,1298],"¿Dónde se ejecuta el modelo?","Decisión independiente del host\u002Fproveedor",[1300,1301],"¿Dónde se ejecuta la herramienta?","Ubicación nombrada del servidor\u002Fruntime",[1303,1304],"¿Qué revisión del protocolo se espera?","Contrato consciente de la versión",[1306,1307],"¿Quién es el principal solicitante?","Modelo de identidad de cliente\u002Fusuario\u002Fagente",[1309,1310],"¿Qué herramientas pueden descubrirse?","Política de lista de permitidos\u002Fcapacidades",[1312,1313],"¿Qué operaciones pueden ejecutarse?","Autorización de negocio del lado del servidor",[1315,1316],"¿Cómo se aplica el alcance de inquilino\u002Frecurso?","Comprobaciones confiables de propiedad de inquilino\u002Frecurso",[1318,1319],"¿Qué acciones necesitan aprobación?","Política de confirmación basada en riesgo",[1321,1322],"¿Cómo se protegen las credenciales?","Almacenamiento en runtime confiable, no secretos visibles para el modelo",[1324,1325],"¿Cómo se limita la salida?","Contrato de resultado estructurado y relevante",[1327,1328],"¿Cómo se rastrean las llamadas?","Correlación a través de MCP hasta la acción posterior",[1330,1331],"¿Qué sucede si MCP no está disponible?","Comportamiento de respaldo\u002Ffallo definido",[1333,1334],"¿Puede otro host compatible usarlo?","Portabilidad validada donde sea necesario",{},{"id":1337,"data":1338,"type":42,"tunes":1340},"h-edge",{"text":1339,"level":254},"Casos límite y limitaciones",{},{"id":1342,"data":1343,"type":218,"tunes":1345},"p-edge-1",{"text":1344},"Un servidor MCP local por stdio puede tener poca exposición de red y seguir siendo peligroso si el proceso en sí tiene permisos excesivos de sistema de archivos o shell.",{},{"id":1347,"data":1348,"type":218,"tunes":1350},"p-edge-2",{"text":1349},"Un servidor MCP remoto puede exponer solo documentación pública o acciones empresariales altamente sensibles. \"MCP remoto\" dice poco sobre el riesgo sin el contexto de capacidad y autorización.",{},{"id":1352,"data":1353,"type":218,"tunes":1355},"p-edge-3",{"text":1354},"Algunos servidores pueden usar solo herramientas e ignorar recursos\u002Fprompts. La compatibilidad con MCP no requiere que cada primitiva opcional sea igualmente importante.",{},{"id":1357,"data":1358,"type":218,"tunes":1360},"p-edge-4",{"text":1359},"Un host puede traducir entre su propio modelo interno de herramientas y MCP. Es posible que los usuarios nunca vean directamente el límite del protocolo, lo cual es aceptable si la seguridad y la atribución siguen siendo claras.",{},{"id":1362,"data":1363,"type":218,"tunes":1365},"p-edge-5",{"text":1364},"MCP sigue evolucionando rápidamente. Las extensiones, los patrones de autorización, las API de los SDK y las convenciones del ecosistema pueden cambiar más rápido que la distinción arquitectónica central.",{},{"id":1367,"data":1368,"type":42,"tunes":1370},"h-change",{"text":1369,"level":254},"¿Qué cambiaría esta respuesta?",{},{"id":1372,"data":1373,"type":218,"tunes":1375},"p-change-1",{"text":1374},"Las futuras revisiones de MCP pueden cambiar el ciclo de vida, los transportes, la autorización y los mecanismos de extensión. La revisión de julio de 2026 ya demuestra por qué las afirmaciones específicas de una implementación deben estar fechadas.",{},{"id":1377,"data":1378,"type":218,"tunes":1380},"p-change-2",{"text":1379},"El límite canónico solo cambiaría si MCP se expandiera de un protocolo de interoperabilidad a un estándar de arquitectura de aplicación\u002Fagente de extremo a extremo. Eso no es lo que define el protocolo actual.",{},{"id":1382,"data":1383,"type":218,"tunes":1385},"p-change-3",{"text":1384},"Para el trabajo de implementación, consulte siempre la especificación actual y la línea exacta del SDK en lugar de copiar ejemplos sensibles a la versión de tutoriales más antiguos.",{},{"id":1387,"data":1388,"type":42,"tunes":1390},"h-related",{"text":1389,"level":254},"Conocimiento canónico relacionado",{},{"id":1392,"data":1393,"type":218,"tunes":1395},"p-related-1",{"text":1394},"MCP pertenece a la parte posterior de Agentic AI: primero comprenda el límite agente\u002Ftiempo de ejecución\u002Fherramienta, luego use MCP cuando las capacidades externas necesiten un contrato de protocolo portátil.",{},{"id":1397,"data":1398,"type":218,"tunes":1400},"p-related-2",{"text":1399},"MCP también depende de RBAC y del aislamiento de inquilinos porque la exposición de capacidades a nivel de protocolo no determina la autorización de la aplicación.",{},{"id":1402,"data":1403,"type":218,"tunes":1405},"p-related-3",{"text":1404},"El artículo más amplio sobre la pila de protocolos explica dónde se sitúa MCP junto a A2A, UCP, AP2 y A2UI. G02 sigue siendo la fuente canónica para MCP en sí.",{},{"id":1407,"data":1408,"type":649,"tunes":1413},"ref-reliability",{"url":1409,"title":1410,"excerpt":1411,"ctaLabel":1412},"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough","Fiabilidad de los agentes de IA: por qué la respuesta final no es suficiente","Las llamadas a herramientas MCP pasan a formar parte de una trayectoria de agente; los sistemas fiables deben evaluar acciones y observaciones, no solo el texto final.","Leer el artículo sobre fiabilidad de agentes",{},{"id":1415,"data":1416,"type":42,"tunes":1418},"h-faq",{"text":1417,"level":254},"Preguntas frecuentes",{},{"id":1420,"data":1421,"type":1420,"tunes":1464},"faq",{"items":1422,"title":1463},[1423,1427,1431,1435,1439,1443,1447,1451,1455,1459],{"id":1424,"answer":1425,"question":1426},"faq1","El Model Context Protocol es un protocolo abierto cliente-servidor para conectar aplicaciones de IA con herramientas, recursos, prompts y proveedores de capacidades externos mediante un contrato estandarizado.","¿Qué es MCP?",{"id":1428,"answer":1429,"question":1430},"faq2","No. Un servidor MCP puede ser software completamente determinista. El modelo normalmente se ejecuta en el host de IA o en el tiempo de ejecución del agente, aunque un servidor puede usar IA internamente de forma opcional.","¿Un servidor MCP necesita un modelo de IA?",{"id":1432,"answer":1433,"question":1434},"faq3","El cliente es el componente del protocolo que utiliza un host de IA para comunicarse con los proveedores de capacidades. El servidor publica y ejecuta las capacidades que expone.","¿Cuál es la diferencia entre un cliente y un servidor MCP?",{"id":1436,"answer":1437,"question":1438},"faq4","No. El function\u002Ftool calling es cómo un modelo invoca capacidades configuradas. MCP estandariza el descubrimiento y la comunicación con servidores de capacidades externos. Un host puede conectar ambos.","¿MCP reemplaza el function calling?",{"id":1440,"answer":1441,"question":1442},"faq5","No. Los servidores MCP con frecuencia envuelven API REST, GraphQL, bases de datos o servicios existentes y proporcionan una capa de interoperabilidad orientada a la IA.","¿MCP reemplaza las API REST?",{"id":1444,"answer":1445,"question":1446},"faq6","No. MCP expone capacidades. La planificación del agente, el estado, la memoria, la gestión del contexto, los reintentos, la orquestación y la detención pertenecen al tiempo de ejecución circundante.","¿MCP es un framework de agentes?",{"id":1448,"answer":1449,"question":1450},"faq7","MCP conecta principalmente un host de IA o agente con herramientas y proveedores de datos. A2A conecta sistemas de agentes independientes para la colaboración y la delegación.","¿Cuál es la diferencia entre MCP y A2A?",{"id":1452,"answer":1453,"question":1454},"faq8","MCP incluye mecanismos de autorización a nivel de protocolo, especialmente para servidores remotos, pero la aplicación aún debe hacer cumplir los permisos empresariales, la propiedad de los recursos y el aislamiento de inquilinos.","¿MCP gestiona la autorización?",{"id":1456,"answer":1457,"question":1458},"faq9","Sí. La ubicación del modelo es independiente de MCP. Un host con modelo local puede llamar a servidores MCP locales o remotos, y un host con modelo en la nube puede usar servidores MCP locales o remotos aprobados mediante una arquitectura de conexión adecuada.","¿Puede MCP funcionar con modelos locales?",{"id":1460,"answer":1461,"question":1462},"faq10","A 8 de octubre de 2026, la revisión actual de la especificación es 2026-07-28. Las implementaciones más antiguas de la era de 2025 siguen en uso, por lo que debe verificarse la compatibilidad.","¿Cuál es la versión actual de la especificación MCP?","Preguntas frecuentes sobre Model Context Protocol",{},{"id":1466,"data":1467,"type":42,"tunes":1469},"h-glossary",{"text":1468,"level":254},"Glosario",{},{"id":1471,"data":1472,"type":1471,"tunes":1514},"glossary",{"title":1473,"entries":1474},"Términos clave de MCP",[1475,1477,1481,1484,1487,1490,1493,1496,1500,1503,1506,1510],{"term":595,"anchor":594,"definition":1476},"Model Context Protocol, un protocolo abierto para conexiones interoperables entre hosts\u002Fclientes de IA y servidores de capacidades externos.",{"term":1478,"anchor":1479,"definition":1480},"Host MCP","mcp-host","La aplicación de IA o el tiempo de ejecución que posee la interacción con el modelo y utiliza clientes MCP para conectarse a los servidores.",{"term":362,"anchor":1482,"definition":1483},"mcp-client","Componente del protocolo del lado del host que se comunica con un servidor MCP.",{"term":365,"anchor":1485,"definition":1486},"mcp-server","Proveedor de capacidades que implementa MCP y expone herramientas, recursos, prompts o extensiones compatibles.",{"term":501,"anchor":1488,"definition":1489},"mcp-tool","Capacidad estructurada invocable expuesta por un servidor MCP.",{"term":504,"anchor":1491,"definition":1492},"mcp-resource","Datos o contenido legible expuesto a través de los métodos de recursos de MCP.",{"term":512,"anchor":1494,"definition":1495},"mcp-prompt","Plantilla de prompt reutilizable expuesta por un servidor MCP para hosts compatibles.",{"term":1497,"anchor":1498,"definition":1499},"Streamable HTTP","streamable-http","Transporte MCP orientado a HTTP utilizado para la comunicación con servidores remotos o en red.",{"term":1501,"anchor":1501,"definition":1502},"stdio","Transporte de entrada\u002Fsalida estándar de procesos que se usa comúnmente para integraciones locales de servidores MCP.",{"term":719,"anchor":1504,"definition":1505},"server-discover","Método moderno de MCP que permite a un cliente inspeccionar las capacidades del servidor en la era del protocolo 2026-07-28.",{"term":1507,"anchor":1508,"definition":1509},"MRTR","mrtr","Multi Round-Trip Requests, un mecanismo para obtener información adicional durante una solicitud en la era del protocolo 2026-07-28.",{"term":1511,"anchor":1512,"definition":1513},"Extensión MCP","mcp-extension","Capacidad que se compone con el protocolo base y puede evolucionar\u002Fversionarse por separado, como Tasks o MCP Apps.",{},{"id":1516,"data":1517,"type":42,"tunes":1519},"h-conclusion",{"text":1518,"level":254},"Conclusión",{},{"id":1521,"data":1522,"type":218,"tunes":1524},"p-conclusion-1",{"text":1523},"MCP es más fácil de entender cuando su límite se mantiene estrecho: conecta aplicaciones de IA con capacidades externas a través de un protocolo estándar.",{},{"id":1526,"data":1527,"type":218,"tunes":1529},"p-conclusion-2",{"text":1528},"El modelo no tiene que residir en el servidor MCP. El servidor no se convierte en el tiempo de ejecución del agente. Una herramienta listada no se convierte en una acción empresarial autorizada. Y MCP no reemplaza la API subyacente, la Fuente de Verdad, el aislamiento de inquilinos ni la arquitectura de dominio.",{},{"id":1531,"data":1532,"type":218,"tunes":1534},"p-conclusion-3",{"text":1533},"Esa estrechez es la fortaleza del protocolo. MCP puede estandarizar cómo los sistemas de IA acceden a herramientas y datos, dejando la propiedad de la aplicación, la seguridad, la semántica empresarial y la elección del modelo en las capas que realmente las poseen.",{},{"id":1536,"data":1537,"type":42,"tunes":1539},"h-sources",{"text":1538,"level":254},"Fuentes primarias y documentación actual",{},{"id":1541,"data":1542,"type":218,"tunes":1544},"p-sources-note",{"text":1543},"MCP evoluciona rápidamente, por lo que las afirmaciones sensibles a la versión en este artículo están vinculadas al estado del 8 de octubre de 2026. La sección Aaasaasa AI Client es evidencia de implementación original y está explícitamente limitada al alcance verificado del conector MCP y del intermediario de permisos.",{},{"id":1546,"data":1547,"type":1553,"tunes":1554},"src-mcp-ts",{"link":1548,"meta":1549},"https:\u002F\u002Fts.sdk.modelcontextprotocol.io\u002Fv2\u002F",{"image":1550,"title":1551,"description":1552},{"url":401},"Model Context Protocol — SDK de TypeScript v2","Documentación actual del SDK estable de TypeScript que implementa la especificación MCP 2026-07-28 y las primitivas de servidor\u002Fcliente.","linkTool",{},{"id":1556,"data":1557,"type":1553,"tunes":1563},"src-mcp-release",{"link":1558,"meta":1559},"https:\u002F\u002Fblog.modelcontextprotocol.io\u002Fposts\u002F2026-07-28\u002F",{"image":1560,"title":1561,"description":1562},{"url":401},"Model Context Protocol — Lanzamiento de la especificación 2026-07-28","Explicación oficial del lanzamiento de la revisión actual del protocolo MCP, incluidos el núcleo sin estado, MRTR, enrutamiento, almacenamiento en caché, refuerzo de autorización, extensiones y obsolescencias.",{},{"id":1565,"data":1566,"type":1553,"tunes":1572},"src-mcp-migration",{"link":1567,"meta":1568},"https:\u002F\u002Fts.sdk.modelcontextprotocol.io\u002Fv2\u002Fmigration\u002Fsupport-2026-07-28",{"image":1569,"title":1570,"description":1571},{"url":401},"SDK de TypeScript de MCP — Compatibilidad con la revisión del protocolo 2026-07-28","Guía de implementación específica de la versión para la revisión actual del protocolo y la compatibilidad con épocas anteriores.",{},{"id":1574,"data":1575,"type":1553,"tunes":1581},"src-openai-mcp",{"link":1576,"meta":1577},"https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Ftools-connectors-mcp",{"image":1578,"title":1579,"description":1580},{"url":401},"OpenAI — Servidores MCP","Guía actual de OpenAI para conectar modelos a servidores MCP remotos y servidores MCP locales\u002Fprivados a través de Secure MCP Tunnel.",{},{"id":1583,"data":1584,"type":1553,"tunes":1590},"src-openai-agent-mcp",{"link":1585,"meta":1586},"https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Fagents-api\u002Ftools\u002Fmcp",{"image":1587,"title":1588,"description":1589},{"url":401},"OpenAI — Conexiones MCP para la API de Agents","Guía actual de conexión MCP que cubre ubicaciones de servicio, entorno y stdio, además de controles de herramientas permitidas.",{},{"id":1592,"data":1593,"type":1553,"tunes":1599},"src-openai-tools",{"link":1594,"meta":1595},"https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Ftools",{"image":1596,"title":1597,"description":1598},{"url":401},"OpenAI — Herramientas","Descripción general actual que sitúa los servidores MCP remotos junto al llamamiento de funciones, la búsqueda web, el shell y otras herramientas del modelo.",{},{"id":1601,"data":1602,"type":1553,"tunes":1608},"src-openai-plugin-mcp",{"link":1603,"meta":1604},"https:\u002F\u002Fdevelopers.openai.com\u002Fplugins\u002Fconcepts\u002Fmcp-server",{"image":1605,"title":1606,"description":1607},{"url":401},"OpenAI — Concepto de servidor MCP","Descripción actual de los servidores MCP que exponen herramientas, recursos y prompts para integraciones con servicios externos.",{},"2.31","El Protocolo de Contexto de Modelo conecta aplicaciones de IA con herramientas, recursos y prompts externos a través de un límite estándar cliente-servidor. Aprende qué hace MCP, qué no hace y dónde encaja en la arquitectura de agentes.","\u002Fuploads\u002F2026\u002F10\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits-1791486640275-7ub1cq.webp","mcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits-1791486640275-7ub1cq","PUBLISHED","2026-10-08T15:09:00.000Z","2026-10-08T19:09:09.976Z","2026-10-08T19:18:07.694Z",{"en":1618,"de":1619,"sr":1620,"es":1621,"fr":1622,"it":1623,"ru":1624,"zh":1625},"\u002Fblog\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","\u002Fde\u002Fblog\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","\u002Fsr\u002Fblog\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","\u002Fes\u002Fblog\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","\u002Ffr\u002Fblog\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","\u002Fit\u002Fblog\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","\u002Fru\u002Fblog\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","\u002Fzh\u002Fblog\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits",[1627,1631,1635,1639],{"id":1628,"name":1629,"slug":1630},84,"Política y límites de datos","policy-and-data",{"id":1632,"name":1633,"slug":1634},57,"Límites de datos","data-boundaries",{"id":1636,"name":1637,"slug":1638},48,"Capacidades","capabilities",{"id":1640,"name":1641,"slug":1642},49,"Controles y evidencias","controls",{"id":1644,"login":1645,"email":1646,"displayName":1647},"20","rooth8233","aleksandar@stajic.de","Aleksandar Stajić",[1649,2817],{"lang":1650,"title":1651,"content":1652,"contentJson":1653,"excerpt":2816},"en","MCP Explained: What It Connects, What It Does Not Do and Where It Fits","{\"time\":1791486641380,\"blocks\":[{\"id\":\"intro\",\"type\":\"paragraph\",\"data\":{\"text\":\"The Model Context Protocol (MCP) is an open protocol for connecting AI applications to external capabilities and information through standardized client-server contracts. An MCP server can expose tools, resources and prompts; an MCP-compatible host or client discovers and uses those capabilities on behalf of an AI application. MCP does not require the server to run its own language model, and it does not replace the agent runtime, business authorization, tenant isolation, application APIs or domain architecture behind the exposed capabilities.\"},\"tunes\":{}},{\"id\":\"direct\",\"type\":\"callout\",\"data\":{\"variant\":\"info\",\"title\":\"Direct answer\",\"body\":\"\u003Cstrong>MCP standardizes the boundary between an AI host and external capability providers.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>A useful mental model is:\u003Cbr>\u003Cstrong>User → AI host \u002F agent runtime → MCP client → MCP server → application\u002FAPI\u002Fdata\u002Ftool\u003C\u002Fstrong>.\u003Cbr>\u003Cbr>The model can remain entirely on the host side. The MCP server may be ordinary deterministic software that exposes structured capabilities.\"},\"tunes\":{}},{\"id\":\"server-no-ai\",\"type\":\"callout\",\"data\":{\"variant\":\"success\",\"title\":\"An MCP server does not need its own AI model\",\"body\":\"A filesystem MCP server can list or read files. A database MCP server can run approved queries. A Jira MCP server can expose issue operations. None of those servers needs an LLM to satisfy the MCP contract. If a server internally uses AI, that is an implementation choice behind the protocol boundary, not an MCP requirement.\"},\"tunes\":{}},{\"id\":\"boundary\",\"type\":\"callout\",\"data\":{\"variant\":\"warning\",\"title\":\"MCP capability is not business authority\",\"body\":\"If an MCP server exposes \u003Ccode>delete_file\u003C\u002Fcode>, \u003Ccode>refund_order\u003C\u002Fcode> or \u003Ccode>deploy_service\u003C\u002Fcode>, that only means the capability exists. The server\u002Fapplication must still enforce identity, permissions, tenant scope, business rules, confirmation requirements and audit controls. Protocol discovery must never silently become authorization.\"},\"tunes\":{}},{\"id\":\"current\",\"type\":\"callout\",\"data\":{\"variant\":\"note\",\"title\":\"Current-source note — 8 October 2026\",\"body\":\"The current MCP specification revision is \u003Cstrong>2026-07-28\u003C\u002Fstrong>. Its major change is a stateless protocol core with self-describing requests, optional \u003Ccode>server\u002Fdiscover\u003C\u002Fcode>, routable HTTP headers, cacheable list\u002Fresource responses, authorization hardening and a formal extension model. The TypeScript SDK v2 is the current stable SDK line implementing this revision. Older 2025-era clients and servers still exist, so implementation guidance must remain version-aware.\"},\"tunes\":{}},{\"id\":\"toc\",\"type\":\"tableOfContents\",\"data\":{\"title\":\"Contents\",\"minLevel\":2,\"maxLevel\":3},\"tunes\":{}},{\"id\":\"h-meaning\",\"type\":\"header\",\"data\":{\"text\":\"What MCP really standardizes\",\"level\":2},\"tunes\":{}},{\"id\":\"p-meaning-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Before MCP, every AI application could integrate external systems through its own tool schema, plugin format, authentication convention and connection code. The same service could need different adapters for a desktop AI client, an IDE agent and a custom application.\"},\"tunes\":{}},{\"id\":\"p-meaning-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP creates a reusable protocol boundary. The external system exposes capabilities through an MCP server, while compatible AI hosts implement an MCP client. This reduces integration coupling between the AI application and the underlying tool or data provider.\"},\"tunes\":{}},{\"id\":\"p-meaning-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The protocol does not standardize the entire application. It standardizes how capabilities are described, discovered and invoked across that boundary.\"},\"tunes\":{}},{\"id\":\"h-simple\",\"type\":\"header\",\"data\":{\"text\":\"The simplest example\",\"level\":2},\"tunes\":{}},{\"id\":\"p-simple-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Suppose an AI coding application needs access to a local project directory. Without MCP, the application might implement its own filesystem integration directly.\"},\"tunes\":{}},{\"id\":\"p-simple-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"With MCP, a filesystem server can expose capabilities such as listing directories, reading approved files or writing inside an allowed workspace. The AI host connects through an MCP client and presents those capabilities to the model or agent runtime.\"},\"tunes\":{}},{\"id\":\"p-simple-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The server does not need to understand the user's natural-language request. The host\u002Fmodel decides which capability is useful; the MCP server executes the structured request under its own security rules.\"},\"tunes\":{}},{\"id\":\"simple-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"A basic MCP tool call\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"1. Host connects to server\",\"description\":\"The MCP-capable application configures access to the external MCP server.\"},{\"label\":\"2. Capabilities are discovered\",\"description\":\"The client learns which tools, resources or prompts the server exposes.\"},{\"label\":\"3. Model or runtime selects a capability\",\"description\":\"The AI application decides that one exposed capability is needed.\"},{\"label\":\"4. Client sends structured request\",\"description\":\"Arguments are sent through MCP to the server.\"},{\"label\":\"5. Server authorizes and executes\",\"description\":\"The server validates the request and calls its underlying system.\"},{\"label\":\"6. Result returns to host\",\"description\":\"The result becomes an observation or context input.\"},{\"label\":\"7. Host decides what happens next\",\"description\":\"The model\u002Fruntime may answer, call another tool or continue a workflow.\"}]},\"tunes\":{}},{\"id\":\"h-stops\",\"type\":\"header\",\"data\":{\"text\":\"Where the simple example stops\",\"level\":2},\"tunes\":{}},{\"id\":\"p-stops-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP does not define how the host chooses a tool, how an agent plans, how a business workflow is modeled or how a domain object such as an invoice or deployment should behave.\"},\"tunes\":{}},{\"id\":\"p-stops-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A protocol can make the integration interoperable while the underlying application remains incorrect, insecure or badly designed. A perfectly valid MCP request can still call the wrong business capability.\"},\"tunes\":{}},{\"id\":\"p-stops-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The central boundary is: MCP standardizes integration semantics, not application truth or business correctness.\"},\"tunes\":{}},{\"id\":\"h-architecture\",\"type\":\"header\",\"data\":{\"text\":\"The MCP architecture: host, client and server\",\"level\":2},\"tunes\":{}},{\"id\":\"architecture-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Component\",\"Responsibility\"],[\"AI host\",\"User-facing AI application or runtime that owns model interaction, context and overall workflow\"],[\"MCP client\",\"Protocol-side component used by the host to communicate with an MCP server\"],[\"MCP server\",\"Publishes capabilities and handles MCP requests\"],[\"Underlying system\",\"Application, API, database, filesystem, SaaS platform or service behind the MCP server\"],[\"Model\",\"Chooses or reasons about capabilities according to the host\u002Fruntime design; it is not necessarily inside the MCP server\"],[\"Authorization\u002Fbusiness policy\",\"Determines whether a requested operation is actually permitted\"]]},\"tunes\":{}},{\"id\":\"p-architecture-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A host can connect to multiple MCP servers, and one MCP server can front one or several underlying systems. The host remains responsible for integrating MCP results into the broader AI application.\"},\"tunes\":{}},{\"id\":\"p-architecture-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The server can be local to the host, run as a separate process or be remote over a network transport. Hosting topology and model location are independent decisions.\"},\"tunes\":{}},{\"id\":\"h-primitives\",\"type\":\"header\",\"data\":{\"text\":\"The three core server primitives\",\"level\":2},\"tunes\":{}},{\"id\":\"primitives-comparison\",\"type\":\"comparison\",\"data\":{\"title\":\"Tools, resources and prompts solve different needs\",\"layout\":\"table\",\"columns\":[{\"id\":\"tools\",\"label\":\"Tools\"},{\"id\":\"resources\",\"label\":\"Resources\"},{\"id\":\"prompts\",\"label\":\"Prompts\"}],\"rows\":[{\"id\":\"purpose\",\"label\":\"Primary purpose\",\"values\":[\"\",\"\",\"\"]},{\"id\":\"interaction\",\"label\":\"Typical interaction\",\"values\":[\"\",\"\",\"\"]},{\"id\":\"example\",\"label\":\"Example\",\"values\":[\"\",\"\",\"\"]},{\"id\":\"risk\",\"label\":\"Typical risk\",\"values\":[\"\",\"\",\"\"]}]},\"tunes\":{}},{\"id\":\"h-tools\",\"type\":\"header\",\"data\":{\"text\":\"Tools: callable capabilities\",\"level\":2},\"tunes\":{}},{\"id\":\"p-tools-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Tools are structured operations an MCP server makes available to the host. A tool has a name, description and input schema; modern implementations can also provide structured output.\"},\"tunes\":{}},{\"id\":\"p-tools-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Examples include searching a repository, reading a customer record, creating a ticket, running a build or sending a message. Tools can be read-only or have side effects.\"},\"tunes\":{}},{\"id\":\"p-tools-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"A good MCP tool surface should represent coherent user or agent goals rather than mechanically mirror every internal API endpoint. Operations with different permissions, confirmation requirements or blast radius should usually be separate tools.\"},\"tunes\":{}},{\"id\":\"h-resources\",\"type\":\"header\",\"data\":{\"text\":\"Resources: readable context and data\",\"level\":2},\"tunes\":{}},{\"id\":\"p-res-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Resources expose data or content that a client can list or read. They fit naturally when the semantic operation is “give me this artifact or information” rather than “perform this action.”\"},\"tunes\":{}},{\"id\":\"p-res-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A resource URI is not an authorization grant. The server still owns access control and must verify which principal may read the underlying object.\"},\"tunes\":{}},{\"id\":\"p-res-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The 2026-07-28 protocol revision adds cache semantics for list and resource-read responses, including freshness and cache scope, making caching behavior more explicit.\"},\"tunes\":{}},{\"id\":\"h-prompts\",\"type\":\"header\",\"data\":{\"text\":\"Prompts: reusable templates\",\"level\":2},\"tunes\":{}},{\"id\":\"p-prompts-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP prompts let a server publish reusable prompt templates to compatible clients. This can keep domain-specific instructions close to the capability provider.\"},\"tunes\":{}},{\"id\":\"p-prompts-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A prompt supplied by an MCP server does not automatically outrank the host's system or security instructions. The host decides how prompt material enters its context hierarchy.\"},\"tunes\":{}},{\"id\":\"p-prompts-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Protocol-provided prompt content should therefore be treated as capability data with explicit trust semantics, not as unrestricted instruction authority.\"},\"tunes\":{}},{\"id\":\"h-tool-vs-resource\",\"type\":\"header\",\"data\":{\"text\":\"Tool or resource?\",\"level\":2},\"tunes\":{}},{\"id\":\"tool-resource-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Need\",\"Prefer\"],[\"Perform an action with structured arguments\",\"Tool\"],[\"Read a specific stable artifact\",\"Resource\"],[\"Search or calculate dynamically\",\"Usually tool\"],[\"Modify external state\",\"Tool\"],[\"Package reusable prompt instructions\",\"Prompt\"],[\"Long-running asynchronous execution\",\"Tool plus application\u002Fruntime task handling or an MCP extension\"]]},\"tunes\":{}},{\"id\":\"h-model-location\",\"type\":\"header\",\"data\":{\"text\":\"Where is the AI model?\",\"level\":2},\"tunes\":{}},{\"id\":\"p-location-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP does not require the model to run on the MCP server. The model can be cloud-hosted, locally hosted, embedded in the desktop application or reached through another provider.\"},\"tunes\":{}},{\"id\":\"p-location-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The host normally owns the model interaction. The MCP server exposes external capability. A local MCP server can therefore be used by a host whose model runs in the cloud, and a remote MCP server can be used by a host whose model runs locally.\"},\"tunes\":{}},{\"id\":\"p-location-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"If the MCP server itself calls an LLM internally, that model is part of the server's implementation behind the protocol boundary; it is not required by MCP.\"},\"tunes\":{}},{\"id\":\"location-rule\",\"type\":\"callout\",\"data\":{\"variant\":\"success\",\"title\":\"Protocol location ≠ inference location\",\"body\":\"\u003Cstrong>Local MCP does not imply local inference, and remote MCP does not imply remote inference.\u003C\u002Fstrong> Connection location, tool-execution location and model\u002Fprovider location are separate architecture dimensions.\"},\"tunes\":{}},{\"id\":\"h-mcp-vs-api\",\"type\":\"header\",\"data\":{\"text\":\"MCP does not replace APIs\",\"level\":2},\"tunes\":{}},{\"id\":\"p-api-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An MCP server often wraps existing APIs or services. REST, GraphQL, SQL, SDK calls and internal service contracts can remain exactly where they are.\"},\"tunes\":{}},{\"id\":\"p-api-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP adds an AI-facing interoperability layer. The underlying domain API can remain the authoritative application contract for ordinary deterministic clients.\"},\"tunes\":{}},{\"id\":\"p-api-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The usual architecture is therefore API\u002Fservice first, selected AI-facing capability second — not “replace every API with MCP.”\"},\"tunes\":{}},{\"id\":\"h-function-calling\",\"type\":\"header\",\"data\":{\"text\":\"MCP vs function calling\",\"level\":2},\"tunes\":{}},{\"id\":\"function-comparison\",\"type\":\"comparison\",\"data\":{\"title\":\"Function calling and MCP are related but not identical\",\"layout\":\"table\",\"columns\":[{\"id\":\"function\",\"label\":\"Function calling\"},{\"id\":\"mcp\",\"label\":\"MCP\"}],\"rows\":[{\"id\":\"scope\",\"label\":\"Scope\",\"values\":[\"\",\"\"]},{\"id\":\"definition\",\"label\":\"Tool definition\",\"values\":[\"\",\"\"]},{\"id\":\"portability\",\"label\":\"Portability\",\"values\":[\"\",\"\"]},{\"id\":\"coexist\",\"label\":\"Can they coexist?\",\"values\":[\"\",\"\"]}]},\"tunes\":{}},{\"id\":\"p-function-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"OpenAI currently exposes remote MCP servers as one tool type alongside ordinary function calling, web search, shell and other tools. That implementation illustrates the architectural relationship: MCP connectivity and the model's own tool-call interface can be composed.\"},\"tunes\":{}},{\"id\":\"h-agent\",\"type\":\"header\",\"data\":{\"text\":\"MCP does not create the agent loop\",\"level\":2},\"tunes\":{}},{\"id\":\"p-agent-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An AI agent needs a runtime that can decide, invoke tools, observe results, update state and continue or stop. MCP can supply some of the tools and data used by that loop.\"},\"tunes\":{}},{\"id\":\"p-agent-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The MCP server does not automatically become the planner, memory system or orchestrator. Those responsibilities normally remain in the host or agent runtime.\"},\"tunes\":{}},{\"id\":\"p-agent-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"A non-agentic application can also use MCP. One deterministic MCP tool call does not require an autonomous multi-step agent.\"},\"tunes\":{}},{\"id\":\"h-a2a\",\"type\":\"header\",\"data\":{\"text\":\"MCP vs A2A\",\"level\":2},\"tunes\":{}},{\"id\":\"p-a2a-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP primarily connects an AI host or agent to capabilities such as tools, resources and data. A2A targets collaboration between independent agent systems.\"},\"tunes\":{}},{\"id\":\"p-a2a-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A remote agent can internally use MCP to reach databases and tools while exposing an A2A interface to other agents. The protocols can therefore be layered rather than substituted.\"},\"tunes\":{}},{\"id\":\"p-a2a-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The existing protocol-stack article owns the broader MCP\u002FA2A\u002FUCP\u002FAP2\u002FA2UI comparison; G02 remains the canonical MCP definition.\"},\"tunes\":{}},{\"id\":\"ref-protocol-stack\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fde\u002Fblog\u002Fmcp-vs-a2a-vs-ucp-vs-ap2-vs-a2ui-the-agent-protocol-stack-explained\",\"title\":\"MCP vs A2A vs UCP vs AP2 vs A2UI: The Agent Protocol Stack Explained\",\"excerpt\":\"A broader responsibility map showing how MCP composes with agent collaboration, commerce, payment authority and agent-driven UI protocols.\",\"ctaLabel\":\"Read the protocol stack\"},\"tunes\":{}},{\"id\":\"h-transport\",\"type\":\"header\",\"data\":{\"text\":\"Local and remote MCP use different transport realities\",\"level\":2},\"tunes\":{}},{\"id\":\"p-transport-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP can connect to local and remote servers. Local desktop integrations commonly use process-level transports such as stdio; remote servers use HTTP-oriented transport.\"},\"tunes\":{}},{\"id\":\"p-transport-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The 2026-07-28 revision makes the protocol core stateless. Requests carry the information needed for protocol handling instead of depending on the earlier protocol-level session model.\"},\"tunes\":{}},{\"id\":\"p-transport-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The current revision also places method and capability names in HTTP headers so gateways, WAFs, rate limiters and load balancers can route and meter MCP traffic more naturally.\"},\"tunes\":{}},{\"id\":\"h-version\",\"type\":\"header\",\"data\":{\"text\":\"Why MCP version awareness matters\",\"level\":2},\"tunes\":{}},{\"id\":\"version-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Protocol era\",\"Operational characteristic\"],[\"2025-11-25 and earlier\",\"Handshake\u002Fsession-oriented lifecycle and older Streamable HTTP behavior\"],[\"2026-07-28\",\"Stateless core, optional server discovery, self-describing requests, routing headers, cache hints, MRTR and authorization hardening\"],[\"Extensions\",\"Capabilities such as Tasks and MCP Apps can version separately from the base protocol\"]]},\"tunes\":{}},{\"id\":\"p-version-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"SDK version and protocol version are also different things. The current TypeScript v2 SDK is the stable line for the 2026-07-28 revision, while older v1.x remains a maintenance line for 2025-era behavior.\"},\"tunes\":{}},{\"id\":\"p-version-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Architecture documentation should record both the SDK\u002Flibrary version and the protocol revision where interoperability behavior depends on them.\"},\"tunes\":{}},{\"id\":\"h-modern\",\"type\":\"header\",\"data\":{\"text\":\"What changed in MCP 2026-07-28\",\"level\":2},\"tunes\":{}},{\"id\":\"modern-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Change\",\"Why it matters\"],[\"Stateless core\",\"Remote servers can scale behind ordinary load balancers without protocol-level sticky sessions\"],[\"server\u002Fdiscover\",\"Clients can inspect server capabilities when needed\"],[\"Self-describing requests\",\"Protocol version and client capability metadata travel per request\"],[\"Mcp-Method \u002F Mcp-Name headers\",\"Gateways can route, meter and apply policy without parsing bodies\"],[\"Cache hints\",\"Lists\u002Fresource reads communicate freshness and sharing scope\"],[\"Multi Round-Trip Requests\",\"Servers can require additional input without the older bidirectional request model\"],[\"Authorization hardening\",\"Issuer validation and credential binding strengthen remote auth behavior\"],[\"Extensions framework\",\"Tasks, MCP Apps and other capabilities can evolve separately\"]]},\"tunes\":{}},{\"id\":\"h-deprecations\",\"type\":\"header\",\"data\":{\"text\":\"Roots, sampling and logging are no longer the direction for new implementations\",\"level\":2},\"tunes\":{}},{\"id\":\"p-dep-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"The 2026-07-28 release marks roots, sampling and logging as deprecated protocol capabilities with a defined compatibility window.\"},\"tunes\":{}},{\"id\":\"p-dep-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Older tutorials may still show these features as central primitives. New implementation work should follow the current specification rather than copy older lifecycle diagrams blindly.\"},\"tunes\":{}},{\"id\":\"p-dep-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Deprecation does not mean immediate removal. It means new systems should avoid unnecessary new dependencies on capabilities the protocol is moving away from.\"},\"tunes\":{}},{\"id\":\"h-tasks\",\"type\":\"header\",\"data\":{\"text\":\"Long-running work is not the same as ordinary MCP tool invocation\",\"level\":2},\"tunes\":{}},{\"id\":\"p-task-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Long-running operations need lifecycle semantics beyond a simple immediate tool result. In the current ecosystem, Tasks moved into a dedicated MCP extension.\"},\"tunes\":{}},{\"id\":\"p-task-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"This reinforces a useful design principle: the base protocol does not need to absorb every agent-runtime concern.\"},\"tunes\":{}},{\"id\":\"p-task-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"An application can also keep long-running workflow ownership entirely in its own runtime and use ordinary MCP tools as underlying operations.\"},\"tunes\":{}},{\"id\":\"h-apps\",\"type\":\"header\",\"data\":{\"text\":\"MCP Apps extend UI capability without redefining the core protocol\",\"level\":2},\"tunes\":{}},{\"id\":\"p-apps-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP Apps associate richer interactive UI experiences with MCP tools through the extension model.\"},\"tunes\":{}},{\"id\":\"p-apps-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The host still controls how that UI is embedded, sandboxed and secured.\"},\"tunes\":{}},{\"id\":\"p-apps-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Core capability exchange and UI rendering should therefore remain separate architecture responsibilities.\"},\"tunes\":{}},{\"id\":\"h-auth\",\"type\":\"header\",\"data\":{\"text\":\"MCP authorization is not your complete authorization model\",\"level\":2},\"tunes\":{}},{\"id\":\"p-auth-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Remote MCP needs protocol-level authentication and authorization mechanisms so clients and servers can establish trusted access. The current specification continues to harden OAuth\u002FOIDC-related behavior.\"},\"tunes\":{}},{\"id\":\"p-auth-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"That layer answers whether a client is allowed to connect or request protocol scopes. It does not automatically answer whether Alice may refund order 123, whether an agent may write production configuration or whether Tenant A may read Tenant B data.\"},\"tunes\":{}},{\"id\":\"p-auth-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Those domain decisions belong in the server\u002Fapplication authorization model and must be enforced before invoking the underlying operation.\"},\"tunes\":{}},{\"id\":\"auth-rule\",\"type\":\"callout\",\"data\":{\"variant\":\"warning\",\"title\":\"Never map “authenticated MCP client” to “trusted for every tool”\",\"body\":\"Connection trust, tool visibility, tool permission, user authorization, tenant isolation and business approval are different controls. Keep them separate.\"},\"tunes\":{}},{\"id\":\"h-identity\",\"type\":\"header\",\"data\":{\"text\":\"Identity can cross several boundaries\",\"level\":2},\"tunes\":{}},{\"id\":\"p-id-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An MCP request may involve the MCP client application, the signed-in human, an agent\u002Fsession identity and a downstream service account.\"},\"tunes\":{}},{\"id\":\"p-id-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The server needs an explicit policy for which principal the operation is performed on behalf of. Otherwise a powerful service credential can become a confused-deputy path.\"},\"tunes\":{}},{\"id\":\"p-id-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"For enterprise use, correlation between user identity, agent identity, MCP connection and downstream authorization is as important as protocol compatibility.\"},\"tunes\":{}},{\"id\":\"h-tenant\",\"type\":\"header\",\"data\":{\"text\":\"Tenant isolation remains outside MCP capability discovery\",\"level\":2},\"tunes\":{}},{\"id\":\"p-tenant-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A multi-tenant MCP server must apply tenant scope when it reads or changes tenant-owned resources. Returning a tool named search_documents does not define which tenant's documents are eligible.\"},\"tunes\":{}},{\"id\":\"p-tenant-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Tenant scope should be derived from trusted identity or membership and carried into databases, caches, vector search, object storage and downstream APIs.\"},\"tunes\":{}},{\"id\":\"p-tenant-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Retrieving cross-tenant content and asking the model not to use it is already an isolation failure.\"},\"tunes\":{}},{\"id\":\"h-source\",\"type\":\"header\",\"data\":{\"text\":\"MCP does not define Source of Truth\",\"level\":2},\"tunes\":{}},{\"id\":\"p-source-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An MCP server can expose a database, document repository, web search service or AI-generated summary. The protocol does not declare which source is authoritative for a claim.\"},\"tunes\":{}},{\"id\":\"p-source-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Source-of-Truth rules belong to application\u002Fdomain architecture. The host or server can encode authority through tool design, metadata, access policy or validation, but MCP itself does not make one capability “true.”\"},\"tunes\":{}},{\"id\":\"p-source-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"A tool can therefore be perfectly callable through MCP and still return stale, secondary or non-authoritative information.\"},\"tunes\":{}},{\"id\":\"h-context\",\"type\":\"header\",\"data\":{\"text\":\"MCP and context engineering\",\"level\":2},\"tunes\":{}},{\"id\":\"p-context-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP can increase the capabilities and information available to an AI application, but context engineering still determines what reaches the model.\"},\"tunes\":{}},{\"id\":\"p-context-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Tool catalogs consume model-visible context in many hosts. Tool results can be large. Resources can be numerous. A host needs selection, filtering, dynamic loading and compaction rather than exposing everything on every turn.\"},\"tunes\":{}},{\"id\":\"p-context-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Capability availability and model-visible context should therefore be treated as separate layers.\"},\"tunes\":{}},{\"id\":\"h-tool-design\",\"type\":\"header\",\"data\":{\"text\":\"Design MCP tools around outcomes and risk boundaries\",\"level\":2},\"tunes\":{}},{\"id\":\"tool-design-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Weak tool design\",\"Stronger tool design\"],[\"execute_api(method,url,body)\",\"Narrow domain tools with validated operations\"],[\"One admin tool for all actions\",\"Separate read\u002Fwrite\u002Fapproval operations\"],[\"Raw internal API mirrored 1:1\",\"AI-facing contract around coherent user goals\"],[\"One broad filesystem tool\",\"Workspace-scoped read\u002Fwrite operations\"],[\"Security policy only in description\",\"Server enforces policy in code\"],[\"Unbounded raw response\",\"Structured decision-relevant output\"],[\"Delete\u002Fupdate mixed with read\",\"Separate side-effect tools with confirmation policy\"]]},\"tunes\":{}},{\"id\":\"h-approvals\",\"type\":\"header\",\"data\":{\"text\":\"Approvals belong in the execution architecture\",\"level\":2},\"tunes\":{}},{\"id\":\"p-approve-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A host can require user approval before invoking selected MCP tools. OpenAI's current MCP integration supports automatic or explicit-approval execution patterns.\"},\"tunes\":{}},{\"id\":\"p-approve-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Host approval is useful but should not be the server's only protection because another compatible MCP client may use a different approval model.\"},\"tunes\":{}},{\"id\":\"p-approve-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"For destructive or financially consequential actions, use defense in depth: clear tool contract, runtime approval where appropriate, server-side authorization, business validation and audit.\"},\"tunes\":{}},{\"id\":\"h-observability\",\"type\":\"header\",\"data\":{\"text\":\"MCP observability should connect protocol calls to domain actions\",\"level\":2},\"tunes\":{}},{\"id\":\"p-obs-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An MCP trace is most useful when it can be correlated with the underlying application call, database change or business transaction.\"},\"tunes\":{}},{\"id\":\"p-obs-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The 2026-07-28 ecosystem standardizes W3C Trace Context propagation conventions, making it easier to follow a request across host, client, server and downstream services.\"},\"tunes\":{}},{\"id\":\"p-obs-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Protocol logs alone are not enough for consequential operations. Audit evidence should also record relevant principal, tenant, target resource, approval and resulting state change.\"},\"tunes\":{}},{\"id\":\"h-failure\",\"type\":\"header\",\"data\":{\"text\":\"What MCP cannot fix\",\"level\":2},\"tunes\":{}},{\"id\":\"failure-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Problem\",\"Why MCP does not solve it\"],[\"Bad business API\",\"MCP can expose the bad API more consistently\"],[\"Wrong data\",\"Protocol validity does not create factual correctness\"],[\"Missing tenant isolation\",\"Tool discovery does not enforce resource ownership\"],[\"Excessive privileges\",\"A standardized tool can still be overprivileged\"],[\"Poor agent planning\",\"MCP exposes capabilities; runtime\u002Fmodel still chooses how to use them\"],[\"Bad retry\u002Fidempotency design\",\"Protocol calls do not make side effects safe\"],[\"No Source of Truth\",\"MCP does not decide which system owns a fact\"],[\"Weak evaluation\",\"Interoperability does not prove task success\"],[\"No audit policy\",\"Transport traces do not define retention or accountability\"],[\"Protocol mismatch\",\"Old\u002Fnew versions can still require migration or compatibility handling\"]]},\"tunes\":{}},{\"id\":\"h-implementation\",\"type\":\"header\",\"data\":{\"text\":\"Original implementation evidence: Aaasaasa AI Client\",\"level\":2},\"tunes\":{}},{\"id\":\"impl-note\",\"type\":\"callout\",\"data\":{\"variant\":\"note\",\"title\":\"Implementation evidence\",\"body\":\"Aaasaasa AI Client contains an authenticated local MCP connector\u002Fbroker for approved local directories and integration through Secure MCP Tunnel. This is concrete implementation evidence for the protocol boundary and permission architecture, not a claim of a general-purpose commercial MCP platform.\"},\"tunes\":{}},{\"id\":\"p-impl-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"The application can run an authenticated Streamable HTTP MCP endpoint on loopback. The endpoint exposes only directories selected through the central workspace permission broker.\"},\"tunes\":{}},{\"id\":\"p-impl-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The local endpoint and remote route are separate concerns: the local connector can bind only to loopback, while a Secure MCP Tunnel can make the approved MCP service reachable to a permitted external AI client without exposing the whole local machine.\"},\"tunes\":{}},{\"id\":\"p-impl-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The central permission model distinguishes chat-only, read-only, project-write and custom-directory profiles. Direct Chat has no filesystem or shell access; tool-capable agent runtimes use the selected permission profile.\"},\"tunes\":{}},{\"id\":\"p-impl-4\",\"type\":\"paragraph\",\"data\":{\"text\":\"This is a direct implementation of the G02 boundary: MCP provides the standardized capability connection, while the application-owned permission broker decides which directories the server may expose.\"},\"tunes\":{}},{\"id\":\"impl-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Implemented element\",\"Architecture evidence\"],[\"Authenticated local MCP endpoint\",\"MCP server can be a local deterministic capability service\"],[\"Loopback binding\",\"Network exposure and protocol capability are separate decisions\"],[\"Secure MCP Tunnel integration\",\"Private\u002Flocal MCP can be bridged through a controlled route\"],[\"Central permission broker\",\"MCP capability is constrained by application policy\"],[\"Selected directory scope\",\"Filesystem visibility is explicitly bounded\"],[\"Direct Chat without OS tools\",\"Model access does not automatically imply tool access\"]]},\"tunes\":{}},{\"id\":\"impl-boundary\",\"type\":\"callout\",\"data\":{\"variant\":\"warning\",\"title\":\"Evidence boundary\",\"body\":\"The implementation demonstrates MCP connectivity and permission-scoped local directory exposure. It does not imply that every MCP primitive, every 2026-07-28 feature or every enterprise authorization extension is implemented.\"},\"tunes\":{}},{\"id\":\"h-use\",\"type\":\"header\",\"data\":{\"text\":\"When MCP is a good fit\",\"level\":2},\"tunes\":{}},{\"id\":\"use-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"MCP is a strong fit when\",\"A direct integration may be simpler when\"],[\"The same capability should be reusable across multiple AI hosts\",\"One application owns both sides and portability has little value\"],[\"An external system wants to publish discoverable AI-facing tools\u002Fresources\",\"A single stable internal API call is sufficient\"],[\"You want a standard boundary around local tools\u002Fdata\",\"There is no AI-facing interoperability requirement\"],[\"Tool providers and AI clients evolve independently\",\"The integration is intentionally private and tightly coupled\"],[\"You want ecosystem-compatible capability discovery\",\"The capability set is tiny and fixed in application code\"]]},\"tunes\":{}},{\"id\":\"h-not-need\",\"type\":\"header\",\"data\":{\"text\":\"When you do not need MCP\",\"level\":2},\"tunes\":{}},{\"id\":\"p-not-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Do not add MCP merely because the application uses AI. If your backend already calls one internal API and no independent MCP client needs that capability, an ordinary function or service call may be clearer.\"},\"tunes\":{}},{\"id\":\"p-not-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP adds value at an interoperability boundary. Without that boundary, the protocol can become an unnecessary adapter layer.\"},\"tunes\":{}},{\"id\":\"p-not-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The architectural question is not “Does this project have AI?” but “Do independently evolving AI hosts and capability providers benefit from a standard contract?”\"},\"tunes\":{}},{\"id\":\"h-security\",\"type\":\"header\",\"data\":{\"text\":\"MCP security checklist\",\"level\":2},\"tunes\":{}},{\"id\":\"security-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Boundary\",\"Question\"],[\"Server identity\",\"Which MCP server am I actually connected to?\"],[\"Client identity\",\"Which application\u002Fclient is requesting access?\"],[\"End-user identity\",\"On whose behalf is the operation performed?\"],[\"Tool allowlist\",\"Which capabilities may this host\u002Fagent discover and call?\"],[\"Business permission\",\"May this principal perform this operation?\"],[\"Tenant scope\",\"Which tenant\u002Fresource boundary applies?\"],[\"Credential isolation\",\"Are credentials bound correctly and kept outside model context?\"],[\"Approval\",\"Which side effects require human confirmation?\"],[\"Input validation\",\"Are tool arguments validated independently of model output?\"],[\"Output trust\",\"Can returned content contain untrusted instructions or sensitive data?\"],[\"Network exposure\",\"Is a local server accidentally exposed beyond intended interfaces?\"],[\"Audit\",\"Can a protocol call be correlated with the downstream action?\"]]},\"tunes\":{}},{\"id\":\"h-misconceptions\",\"type\":\"header\",\"data\":{\"text\":\"Common misconceptions\",\"level\":2},\"tunes\":{}},{\"id\":\"misconceptions-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Misconception\",\"Correction\"],[\"“An MCP server is an AI server.”\",\"It can be ordinary deterministic software exposing capabilities.\"],[\"“I need my own LLM on the MCP server.”\",\"No. The model can live entirely on the host side.\"],[\"“MCP replaces REST APIs.”\",\"MCP often wraps existing APIs for AI-facing interoperability.\"],[\"“MCP is an agent framework.”\",\"MCP supplies capabilities; an agent runtime manages iteration and state.\"],[\"“MCP and function calling compete.”\",\"A host can bridge MCP capabilities into its model tool interface.\"],[\"“MCP replaces A2A.”\",\"MCP focuses on capability integration; A2A focuses on agent collaboration.\"],[\"“If a tool is listed, the user may call it.”\",\"Discovery is not authorization.\"],[\"“OAuth solves business permissions.”\",\"Connection authorization does not replace domain authorization or tenant isolation.\"],[\"“Local MCP means local AI.”\",\"Tool-server location and inference location are independent.\"],[\"“MCP makes tool output trustworthy.”\",\"Data quality, authority and provenance still belong to the source\u002Fapplication.\"],[\"“One giant generic tool is flexible.”\",\"Over-broad tools weaken permissions, validation and observability.\"],[\"“Old tutorials are implementation-current.”\",\"The 2026-07-28 revision materially changed lifecycle and transport behavior.\"]]},\"tunes\":{}},{\"id\":\"h-design\",\"type\":\"header\",\"data\":{\"text\":\"A practical MCP design sequence\",\"level\":2},\"tunes\":{}},{\"id\":\"design-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"Design the boundary before implementing the server\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"1. Identify the interoperability boundary\",\"description\":\"Confirm that independent AI hosts actually need reusable access.\"},{\"label\":\"2. Keep the domain API authoritative\",\"description\":\"Preserve the real application\u002Fservice contract behind MCP.\"},{\"label\":\"3. Choose primitives deliberately\",\"description\":\"Use tools, resources and prompts according to their semantics.\"},{\"label\":\"4. Split by risk and permission\",\"description\":\"Separate read, write, destructive and approval-required operations.\"},{\"label\":\"5. Define identity propagation\",\"description\":\"Know which client, user, agent and downstream principal each call represents.\"},{\"label\":\"6. Enforce business authorization\",\"description\":\"Validate permissions, tenant scope and target ownership.\"},{\"label\":\"7. Choose local or remote transport\",\"description\":\"Match deployment topology to the real need.\"},{\"label\":\"8. Pin protocol\u002FSDK expectations\",\"description\":\"Document 2026-07-28 versus older compatibility.\"},{\"label\":\"9. Add approvals for consequential actions\",\"description\":\"Use risk-appropriate confirmation controls.\"},{\"label\":\"10. Design structured outputs\",\"description\":\"Return concise machine-usable results.\"},{\"label\":\"11. Add tracing and audit correlation\",\"description\":\"Connect MCP calls to downstream service\u002Fbusiness events.\"},{\"label\":\"12. Test portability\",\"description\":\"Verify more than one client where interoperability is a stated requirement.\"}]},\"tunes\":{}},{\"id\":\"h-checklist\",\"type\":\"header\",\"data\":{\"text\":\"MCP architecture checklist\",\"level\":2},\"tunes\":{}},{\"id\":\"checklist-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Question\",\"Expected answer\"],[\"Why is MCP needed?\",\"A real AI-facing interoperability boundary\"],[\"What does the server expose?\",\"Explicit tools\u002Fresources\u002Fprompts\"],[\"Where does the model run?\",\"Independent host\u002Fprovider decision\"],[\"Where does tool execution run?\",\"Named server\u002Fruntime location\"],[\"Which protocol revision is expected?\",\"Version-aware contract\"],[\"Who is the requesting principal?\",\"Client\u002Fuser\u002Fagent identity model\"],[\"Which tools may be discovered?\",\"Allowlist\u002Fcapability policy\"],[\"Which operations may execute?\",\"Server-side business authorization\"],[\"How is tenant\u002Fresource scope enforced?\",\"Trusted tenant\u002Fresource ownership checks\"],[\"Which actions need approval?\",\"Risk-based confirmation policy\"],[\"How are credentials protected?\",\"Trusted runtime storage, not model-visible secrets\"],[\"How is output bounded?\",\"Structured relevant result contract\"],[\"How are calls traced?\",\"Correlation through MCP to downstream action\"],[\"What happens if MCP is unavailable?\",\"Defined fallback\u002Ffailure behavior\"],[\"Can another compatible host use it?\",\"Portability validated where required\"]]},\"tunes\":{}},{\"id\":\"h-edge\",\"type\":\"header\",\"data\":{\"text\":\"Edge cases and limitations\",\"level\":2},\"tunes\":{}},{\"id\":\"p-edge-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A local stdio MCP server can have little network exposure while still be dangerous if the process itself has excessive filesystem or shell permissions.\"},\"tunes\":{}},{\"id\":\"p-edge-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A remote MCP server may expose only public documentation or highly sensitive enterprise actions. “Remote MCP” says little about risk without the capability and authorization context.\"},\"tunes\":{}},{\"id\":\"p-edge-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Some servers may use only tools and ignore resources\u002Fprompts. MCP compatibility does not require every optional primitive to be equally important.\"},\"tunes\":{}},{\"id\":\"p-edge-4\",\"type\":\"paragraph\",\"data\":{\"text\":\"A host can translate between its own internal tool model and MCP. Users may never see the protocol boundary directly, which is acceptable if security and attribution remain clear.\"},\"tunes\":{}},{\"id\":\"p-edge-5\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP continues to evolve rapidly. Extensions, authorization patterns, SDK APIs and ecosystem conventions can change faster than the core architectural distinction.\"},\"tunes\":{}},{\"id\":\"h-change\",\"type\":\"header\",\"data\":{\"text\":\"What would change this answer?\",\"level\":2},\"tunes\":{}},{\"id\":\"p-change-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Future MCP revisions can change lifecycle, transports, authorization and extension mechanisms. The July 2026 revision already demonstrates why implementation-specific claims must be dated.\"},\"tunes\":{}},{\"id\":\"p-change-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The canonical boundary would change only if MCP expanded from an interoperability protocol into an end-to-end application\u002Fagent architecture standard. That is not what the current protocol defines.\"},\"tunes\":{}},{\"id\":\"p-change-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"For implementation work, always check the current specification and exact SDK line instead of copying version-sensitive examples from older tutorials.\"},\"tunes\":{}},{\"id\":\"h-related\",\"type\":\"header\",\"data\":{\"text\":\"Related canonical knowledge\",\"level\":2},\"tunes\":{}},{\"id\":\"p-related-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP belongs downstream of Agentic AI: first understand the agent\u002Fruntime\u002Ftool boundary, then use MCP when external capabilities need a portable protocol contract.\"},\"tunes\":{}},{\"id\":\"p-related-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP also depends on RBAC and tenant isolation because protocol-level capability exposure does not determine application authorization.\"},\"tunes\":{}},{\"id\":\"p-related-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The broader protocol-stack article explains where MCP sits beside A2A, UCP, AP2 and A2UI. G02 remains the canonical source for MCP itself.\"},\"tunes\":{}},{\"id\":\"ref-reliability\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough\",\"title\":\"AI Agent Reliability: Why the Final Answer Is Not Enough\",\"excerpt\":\"MCP tool calls become part of an agent trajectory; reliable systems need to evaluate actions and observations, not only final text.\",\"ctaLabel\":\"Read the agent reliability article\"},\"tunes\":{}},{\"id\":\"h-faq\",\"type\":\"header\",\"data\":{\"text\":\"Frequently asked questions\",\"level\":2},\"tunes\":{}},{\"id\":\"faq\",\"type\":\"faq\",\"data\":{\"title\":\"Model Context Protocol FAQ\",\"items\":[{\"id\":\"faq1\",\"question\":\"What is MCP?\",\"answer\":\"The Model Context Protocol is an open client-server protocol for connecting AI applications to external tools, resources, prompts and capability providers through a standardized contract.\"},{\"id\":\"faq2\",\"question\":\"Does an MCP server need an AI model?\",\"answer\":\"No. An MCP server can be completely deterministic software. The model normally runs in the AI host or agent runtime, although a server may optionally use AI internally.\"},{\"id\":\"faq3\",\"question\":\"What is the difference between an MCP client and server?\",\"answer\":\"The client is the protocol component used by an AI host to communicate with capability providers. The server publishes and executes the capabilities it exposes.\"},{\"id\":\"faq4\",\"question\":\"Does MCP replace function calling?\",\"answer\":\"No. Function\u002Ftool calling is how a model invokes configured capabilities. MCP standardizes discovery and communication with external capability servers. A host can bridge the two.\"},{\"id\":\"faq5\",\"question\":\"Does MCP replace REST APIs?\",\"answer\":\"No. MCP servers frequently wrap existing REST, GraphQL, database or service APIs and provide an AI-facing interoperability layer.\"},{\"id\":\"faq6\",\"question\":\"Is MCP an agent framework?\",\"answer\":\"No. MCP exposes capabilities. Agent planning, state, memory, context management, retries, orchestration and stopping belong to the surrounding runtime.\"},{\"id\":\"faq7\",\"question\":\"What is the difference between MCP and A2A?\",\"answer\":\"MCP primarily connects an AI host or agent to tools and data providers. A2A connects independent agent systems for collaboration and delegation.\"},{\"id\":\"faq8\",\"question\":\"Does MCP handle authorization?\",\"answer\":\"MCP includes protocol-level authorization mechanisms, especially for remote servers, but the application must still enforce business permissions, resource ownership and tenant isolation.\"},{\"id\":\"faq9\",\"question\":\"Can MCP work with local models?\",\"answer\":\"Yes. Model location is independent of MCP. A local-model host can call local or remote MCP servers, and a cloud-model host can use approved local or remote MCP servers through an appropriate connection architecture.\"},{\"id\":\"faq10\",\"question\":\"What is the current MCP specification version?\",\"answer\":\"As of 8 October 2026, the current specification revision is 2026-07-28. Older 2025-era implementations remain in use, so compatibility must be checked.\"}]},\"tunes\":{}},{\"id\":\"h-glossary\",\"type\":\"header\",\"data\":{\"text\":\"Glossary\",\"level\":2},\"tunes\":{}},{\"id\":\"glossary\",\"type\":\"glossary\",\"data\":{\"title\":\"Key MCP terms\",\"entries\":[{\"term\":\"MCP\",\"definition\":\"Model Context Protocol, an open protocol for interoperable connections between AI hosts\u002Fclients and external capability servers.\",\"anchor\":\"mcp\"},{\"term\":\"MCP host\",\"definition\":\"The AI application or runtime that owns model interaction and uses MCP clients to connect to servers.\",\"anchor\":\"mcp-host\"},{\"term\":\"MCP client\",\"definition\":\"Protocol component on the host side that communicates with an MCP server.\",\"anchor\":\"mcp-client\"},{\"term\":\"MCP server\",\"definition\":\"Capability provider that implements MCP and exposes tools, resources, prompts or supported extensions.\",\"anchor\":\"mcp-server\"},{\"term\":\"Tool\",\"definition\":\"Callable structured capability exposed by an MCP server.\",\"anchor\":\"mcp-tool\"},{\"term\":\"Resource\",\"definition\":\"Readable data or content exposed through MCP resource methods.\",\"anchor\":\"mcp-resource\"},{\"term\":\"Prompt\",\"definition\":\"Reusable prompt template exposed by an MCP server for compatible hosts.\",\"anchor\":\"mcp-prompt\"},{\"term\":\"Streamable HTTP\",\"definition\":\"HTTP-oriented MCP transport used for remote\u002Fnetworked server communication.\",\"anchor\":\"streamable-http\"},{\"term\":\"stdio\",\"definition\":\"Process standard-input\u002Foutput transport commonly used for local MCP server integrations.\",\"anchor\":\"stdio\"},{\"term\":\"server\u002Fdiscover\",\"definition\":\"Modern MCP method that lets a client inspect server capabilities in the 2026-07-28 protocol era.\",\"anchor\":\"server-discover\"},{\"term\":\"MRTR\",\"definition\":\"Multi Round-Trip Requests, a mechanism for obtaining additional input during a request in the 2026-07-28 protocol era.\",\"anchor\":\"mrtr\"},{\"term\":\"MCP extension\",\"definition\":\"Capability that composes with the base protocol and can evolve\u002Fversion separately, such as Tasks or MCP Apps.\",\"anchor\":\"mcp-extension\"}]},\"tunes\":{}},{\"id\":\"h-conclusion\",\"type\":\"header\",\"data\":{\"text\":\"Conclusion\",\"level\":2},\"tunes\":{}},{\"id\":\"p-conclusion-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP is easiest to understand when its boundary stays narrow: it connects AI applications to external capabilities through a standard protocol.\"},\"tunes\":{}},{\"id\":\"p-conclusion-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The model does not have to live on the MCP server. The server does not become the agent runtime. A listed tool does not become an authorized business action. And MCP does not replace the underlying API, Source of Truth, tenant isolation or domain architecture.\"},\"tunes\":{}},{\"id\":\"p-conclusion-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"That narrowness is the protocol's strength. MCP can standardize how AI systems reach tools and data while leaving application ownership, security, business semantics and model choice in the layers that actually own them.\"},\"tunes\":{}},{\"id\":\"h-sources\",\"type\":\"header\",\"data\":{\"text\":\"Primary sources and current documentation\",\"level\":2},\"tunes\":{}},{\"id\":\"p-sources-note\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP is evolving quickly, so version-sensitive claims in this article are tied to the 8 October 2026 state. The Aaasaasa AI Client section is original implementation evidence and is explicitly limited to the verified MCP connector and permission-broker scope.\"},\"tunes\":{}},{\"id\":\"src-mcp-ts\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fts.sdk.modelcontextprotocol.io\u002Fv2\u002F\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"Model Context Protocol — TypeScript SDK v2\",\"description\":\"Current stable TypeScript SDK documentation implementing the 2026-07-28 MCP specification and server\u002Fclient primitives.\"}},\"tunes\":{}},{\"id\":\"src-mcp-release\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fblog.modelcontextprotocol.io\u002Fposts\u002F2026-07-28\u002F\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"Model Context Protocol — 2026-07-28 Specification Release\",\"description\":\"Official release explanation for the current MCP protocol revision, including stateless core, MRTR, routing, caching, authorization hardening, extensions and deprecations.\"}},\"tunes\":{}},{\"id\":\"src-mcp-migration\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fts.sdk.modelcontextprotocol.io\u002Fv2\u002Fmigration\u002Fsupport-2026-07-28\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"MCP TypeScript SDK — Supporting protocol revision 2026-07-28\",\"description\":\"Version-specific implementation guidance for the current protocol revision and earlier-era compatibility.\"}},\"tunes\":{}},{\"id\":\"src-openai-mcp\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Ftools-connectors-mcp\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"OpenAI — MCP servers\",\"description\":\"Current OpenAI guidance for connecting models to remote MCP servers and local\u002Fprivate MCP servers through Secure MCP Tunnel.\"}},\"tunes\":{}},{\"id\":\"src-openai-agent-mcp\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Fagents-api\u002Ftools\u002Fmcp\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"OpenAI — MCP connections for Agents API\",\"description\":\"Current MCP connection guidance covering service, environment and stdio locations plus allowed-tool controls.\"}},\"tunes\":{}},{\"id\":\"src-openai-tools\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Ftools\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"OpenAI — Tools\",\"description\":\"Current overview placing remote MCP servers alongside function calling, web search, shell and other model tools.\"}},\"tunes\":{}},{\"id\":\"src-openai-plugin-mcp\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdevelopers.openai.com\u002Fplugins\u002Fconcepts\u002Fmcp-server\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"OpenAI — MCP server concept\",\"description\":\"Current description of MCP servers exposing tools, resources and prompts for external service integrations.\"}},\"tunes\":{}}],\"version\":\"2.31.6\"}",{"time":1654,"blocks":1655,"version":2815},1791486641380,[1656,1660,1665,1670,1675,1680,1684,1688,1692,1696,1700,1704,1708,1712,1716,1742,1746,1750,1754,1758,1762,1787,1791,1795,1799,1822,1826,1830,1834,1838,1842,1846,1850,1854,1858,1862,1866,1870,1874,1897,1901,1905,1909,1913,1918,1922,1926,1930,1934,1938,1959,1963,1967,1971,1975,1979,1982,1986,1990,1994,2000,2004,2008,2012,2016,2020,2035,2039,2043,2047,2077,2081,2085,2089,2093,2097,2101,2105,2109,2113,2117,2121,2125,2129,2133,2137,2141,2146,2150,2154,2158,2162,2166,2170,2174,2178,2182,2186,2190,2194,2198,2202,2206,2210,2214,2241,2245,2249,2253,2257,2261,2265,2269,2273,2277,2314,2318,2323,2327,2331,2335,2339,2364,2369,2373,2395,2399,2403,2407,2411,2415,2458,2462,2505,2509,2550,2554,2605,2609,2613,2617,2621,2625,2629,2633,2637,2641,2645,2649,2653,2657,2661,2668,2672,2707,2711,2742,2746,2750,2754,2758,2762,2766,2773,2780,2787,2794,2801,2808],{"id":215,"data":1657,"type":218,"tunes":1659},{"text":1658},"The Model Context Protocol (MCP) is an open protocol for connecting AI applications to external capabilities and information through standardized client-server contracts. An MCP server can expose tools, resources and prompts; an MCP-compatible host or client discovers and uses those capabilities on behalf of an AI application. MCP does not require the server to run its own language model, and it does not replace the agent runtime, business authorization, tenant isolation, application APIs or domain architecture behind the exposed capabilities.",{},{"id":221,"data":1661,"type":226,"tunes":1664},{"body":1662,"title":1663,"variant":225},"\u003Cstrong>MCP standardizes the boundary between an AI host and external capability providers.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>A useful mental model is:\u003Cbr>\u003Cstrong>User → AI host \u002F agent runtime → MCP client → MCP server → application\u002FAPI\u002Fdata\u002Ftool\u003C\u002Fstrong>.\u003Cbr>\u003Cbr>The model can remain entirely on the host side. The MCP server may be ordinary deterministic software that exposes structured capabilities.","Direct answer",{},{"id":229,"data":1666,"type":226,"tunes":1669},{"body":1667,"title":1668,"variant":233},"A filesystem MCP server can list or read files. A database MCP server can run approved queries. A Jira MCP server can expose issue operations. None of those servers needs an LLM to satisfy the MCP contract. If a server internally uses AI, that is an implementation choice behind the protocol boundary, not an MCP requirement.","An MCP server does not need its own AI model",{},{"id":236,"data":1671,"type":226,"tunes":1674},{"body":1672,"title":1673,"variant":240},"If an MCP server exposes \u003Ccode>delete_file\u003C\u002Fcode>, \u003Ccode>refund_order\u003C\u002Fcode> or \u003Ccode>deploy_service\u003C\u002Fcode>, that only means the capability exists. The server\u002Fapplication must still enforce identity, permissions, tenant scope, business rules, confirmation requirements and audit controls. Protocol discovery must never silently become authorization.","MCP capability is not business authority",{},{"id":243,"data":1676,"type":226,"tunes":1679},{"body":1677,"title":1678,"variant":247},"The current MCP specification revision is \u003Cstrong>2026-07-28\u003C\u002Fstrong>. Its major change is a stateless protocol core with self-describing requests, optional \u003Ccode>server\u002Fdiscover\u003C\u002Fcode>, routable HTTP headers, cacheable list\u002Fresource responses, authorization hardening and a formal extension model. The TypeScript SDK v2 is the current stable SDK line implementing this revision. Older 2025-era clients and servers still exist, so implementation guidance must remain version-aware.","Current-source note — 8 October 2026",{},{"id":250,"data":1681,"type":255,"tunes":1683},{"title":1682,"maxLevel":253,"minLevel":254},"Contents",{},{"id":258,"data":1685,"type":42,"tunes":1687},{"text":1686,"level":254},"What MCP really standardizes",{},{"id":263,"data":1689,"type":218,"tunes":1691},{"text":1690},"Before MCP, every AI application could integrate external systems through its own tool schema, plugin format, authentication convention and connection code. The same service could need different adapters for a desktop AI client, an IDE agent and a custom application.",{},{"id":268,"data":1693,"type":218,"tunes":1695},{"text":1694},"MCP creates a reusable protocol boundary. The external system exposes capabilities through an MCP server, while compatible AI hosts implement an MCP client. This reduces integration coupling between the AI application and the underlying tool or data provider.",{},{"id":273,"data":1697,"type":218,"tunes":1699},{"text":1698},"The protocol does not standardize the entire application. It standardizes how capabilities are described, discovered and invoked across that boundary.",{},{"id":278,"data":1701,"type":42,"tunes":1703},{"text":1702,"level":254},"The simplest example",{},{"id":283,"data":1705,"type":218,"tunes":1707},{"text":1706},"Suppose an AI coding application needs access to a local project directory. Without MCP, the application might implement its own filesystem integration directly.",{},{"id":288,"data":1709,"type":218,"tunes":1711},{"text":1710},"With MCP, a filesystem server can expose capabilities such as listing directories, reading approved files or writing inside an allowed workspace. The AI host connects through an MCP client and presents those capabilities to the model or agent runtime.",{},{"id":293,"data":1713,"type":218,"tunes":1715},{"text":1714},"The server does not need to understand the user's natural-language request. The host\u002Fmodel decides which capability is useful; the MCP server executes the structured request under its own security rules.",{},{"id":298,"data":1717,"type":324,"tunes":1741},{"steps":1718,"title":1740,"orientation":323},[1719,1722,1725,1728,1731,1734,1737],{"label":1720,"description":1721},"1. Host connects to server","The MCP-capable application configures access to the external MCP server.",{"label":1723,"description":1724},"2. Capabilities are discovered","The client learns which tools, resources or prompts the server exposes.",{"label":1726,"description":1727},"3. Model or runtime selects a capability","The AI application decides that one exposed capability is needed.",{"label":1729,"description":1730},"4. Client sends structured request","Arguments are sent through MCP to the server.",{"label":1732,"description":1733},"5. Server authorizes and executes","The server validates the request and calls its underlying system.",{"label":1735,"description":1736},"6. Result returns to host","The result becomes an observation or context input.",{"label":1738,"description":1739},"7. Host decides what happens next","The model\u002Fruntime may answer, call another tool or continue a workflow.","A basic MCP tool call",{},{"id":327,"data":1743,"type":42,"tunes":1745},{"text":1744,"level":254},"Where the simple example stops",{},{"id":332,"data":1747,"type":218,"tunes":1749},{"text":1748},"MCP does not define how the host chooses a tool, how an agent plans, how a business workflow is modeled or how a domain object such as an invoice or deployment should behave.",{},{"id":337,"data":1751,"type":218,"tunes":1753},{"text":1752},"A protocol can make the integration interoperable while the underlying application remains incorrect, insecure or badly designed. A perfectly valid MCP request can still call the wrong business capability.",{},{"id":342,"data":1755,"type":218,"tunes":1757},{"text":1756},"The central boundary is: MCP standardizes integration semantics, not application truth or business correctness.",{},{"id":347,"data":1759,"type":42,"tunes":1761},{"text":1760,"level":254},"The MCP architecture: host, client and server",{},{"id":352,"data":1763,"type":376,"tunes":1786},{"content":1764,"stretched":43,"withHeadings":14},[1765,1768,1771,1774,1777,1780,1783],[1766,1767],"Component","Responsibility",[1769,1770],"AI host","User-facing AI application or runtime that owns model interaction, context and overall workflow",[1772,1773],"MCP client","Protocol-side component used by the host to communicate with an MCP server",[1775,1776],"MCP server","Publishes capabilities and handles MCP requests",[1778,1779],"Underlying system","Application, API, database, filesystem, SaaS platform or service behind the MCP server",[1781,1782],"Model","Chooses or reasons about capabilities according to the host\u002Fruntime design; it is not necessarily inside the MCP server",[1784,1785],"Authorization\u002Fbusiness policy","Determines whether a requested operation is actually permitted",{},{"id":379,"data":1788,"type":218,"tunes":1790},{"text":1789},"A host can connect to multiple MCP servers, and one MCP server can front one or several underlying systems. The host remains responsible for integrating MCP results into the broader AI application.",{},{"id":384,"data":1792,"type":218,"tunes":1794},{"text":1793},"The server can be local to the host, run as a separate process or be remote over a network transport. Hosting topology and model location are independent decisions.",{},{"id":389,"data":1796,"type":42,"tunes":1798},{"text":1797,"level":254},"The three core server primitives",{},{"id":394,"data":1800,"type":425,"tunes":1821},{"rows":1801,"title":1814,"layout":376,"columns":1815},[1802,1805,1808,1811],{"id":398,"label":1803,"values":1804},"Primary purpose",[401,401,401],{"id":403,"label":1806,"values":1807},"Typical interaction",[401,401,401],{"id":407,"label":1809,"values":1810},"Example",[401,401,401],{"id":411,"label":1812,"values":1813},"Typical risk",[401,401,401],"Tools, resources and prompts solve different needs",[1816,1818,1820],{"id":417,"label":1817},"Tools",{"id":420,"label":1819},"Resources",{"id":423,"label":424},{},{"id":428,"data":1823,"type":42,"tunes":1825},{"text":1824,"level":254},"Tools: callable capabilities",{},{"id":433,"data":1827,"type":218,"tunes":1829},{"text":1828},"Tools are structured operations an MCP server makes available to the host. A tool has a name, description and input schema; modern implementations can also provide structured output.",{},{"id":438,"data":1831,"type":218,"tunes":1833},{"text":1832},"Examples include searching a repository, reading a customer record, creating a ticket, running a build or sending a message. Tools can be read-only or have side effects.",{},{"id":443,"data":1835,"type":218,"tunes":1837},{"text":1836},"A good MCP tool surface should represent coherent user or agent goals rather than mechanically mirror every internal API endpoint. Operations with different permissions, confirmation requirements or blast radius should usually be separate tools.",{},{"id":448,"data":1839,"type":42,"tunes":1841},{"text":1840,"level":254},"Resources: readable context and data",{},{"id":453,"data":1843,"type":218,"tunes":1845},{"text":1844},"Resources expose data or content that a client can list or read. They fit naturally when the semantic operation is “give me this artifact or information” rather than “perform this action.”",{},{"id":458,"data":1847,"type":218,"tunes":1849},{"text":1848},"A resource URI is not an authorization grant. The server still owns access control and must verify which principal may read the underlying object.",{},{"id":463,"data":1851,"type":218,"tunes":1853},{"text":1852},"The 2026-07-28 protocol revision adds cache semantics for list and resource-read responses, including freshness and cache scope, making caching behavior more explicit.",{},{"id":468,"data":1855,"type":42,"tunes":1857},{"text":1856,"level":254},"Prompts: reusable templates",{},{"id":473,"data":1859,"type":218,"tunes":1861},{"text":1860},"MCP prompts let a server publish reusable prompt templates to compatible clients. This can keep domain-specific instructions close to the capability provider.",{},{"id":478,"data":1863,"type":218,"tunes":1865},{"text":1864},"A prompt supplied by an MCP server does not automatically outrank the host's system or security instructions. The host decides how prompt material enters its context hierarchy.",{},{"id":483,"data":1867,"type":218,"tunes":1869},{"text":1868},"Protocol-provided prompt content should therefore be treated as capability data with explicit trust semantics, not as unrestricted instruction authority.",{},{"id":488,"data":1871,"type":42,"tunes":1873},{"text":1872,"level":254},"Tool or resource?",{},{"id":493,"data":1875,"type":376,"tunes":1896},{"content":1876,"stretched":43,"withHeadings":14},[1877,1880,1883,1886,1889,1891,1893],[1878,1879],"Need","Prefer",[1881,1882],"Perform an action with structured arguments","Tool",[1884,1885],"Read a specific stable artifact","Resource",[1887,1888],"Search or calculate dynamically","Usually tool",[1890,1882],"Modify external state",[1892,512],"Package reusable prompt instructions",[1894,1895],"Long-running asynchronous execution","Tool plus application\u002Fruntime task handling or an MCP extension",{},{"id":518,"data":1898,"type":42,"tunes":1900},{"text":1899,"level":254},"Where is the AI model?",{},{"id":523,"data":1902,"type":218,"tunes":1904},{"text":1903},"MCP does not require the model to run on the MCP server. The model can be cloud-hosted, locally hosted, embedded in the desktop application or reached through another provider.",{},{"id":528,"data":1906,"type":218,"tunes":1908},{"text":1907},"The host normally owns the model interaction. The MCP server exposes external capability. A local MCP server can therefore be used by a host whose model runs in the cloud, and a remote MCP server can be used by a host whose model runs locally.",{},{"id":533,"data":1910,"type":218,"tunes":1912},{"text":1911},"If the MCP server itself calls an LLM internally, that model is part of the server's implementation behind the protocol boundary; it is not required by MCP.",{},{"id":538,"data":1914,"type":226,"tunes":1917},{"body":1915,"title":1916,"variant":233},"\u003Cstrong>Local MCP does not imply local inference, and remote MCP does not imply remote inference.\u003C\u002Fstrong> Connection location, tool-execution location and model\u002Fprovider location are separate architecture dimensions.","Protocol location ≠ inference location",{},{"id":544,"data":1919,"type":42,"tunes":1921},{"text":1920,"level":254},"MCP does not replace APIs",{},{"id":549,"data":1923,"type":218,"tunes":1925},{"text":1924},"An MCP server often wraps existing APIs or services. REST, GraphQL, SQL, SDK calls and internal service contracts can remain exactly where they are.",{},{"id":554,"data":1927,"type":218,"tunes":1929},{"text":1928},"MCP adds an AI-facing interoperability layer. The underlying domain API can remain the authoritative application contract for ordinary deterministic clients.",{},{"id":559,"data":1931,"type":218,"tunes":1933},{"text":1932},"The usual architecture is therefore API\u002Fservice first, selected AI-facing capability second — not “replace every API with MCP.”",{},{"id":564,"data":1935,"type":42,"tunes":1937},{"text":1936,"level":254},"MCP vs function calling",{},{"id":569,"data":1939,"type":425,"tunes":1958},{"rows":1940,"title":1953,"layout":376,"columns":1954},[1941,1944,1947,1950],{"id":573,"label":1942,"values":1943},"Scope",[401,401],{"id":577,"label":1945,"values":1946},"Tool definition",[401,401],{"id":581,"label":1948,"values":1949},"Portability",[401,401],{"id":585,"label":1951,"values":1952},"Can they coexist?",[401,401],"Function calling and MCP are related but not identical",[1955,1957],{"id":591,"label":1956},"Function calling",{"id":594,"label":595},{},{"id":598,"data":1960,"type":218,"tunes":1962},{"text":1961},"OpenAI currently exposes remote MCP servers as one tool type alongside ordinary function calling, web search, shell and other tools. That implementation illustrates the architectural relationship: MCP connectivity and the model's own tool-call interface can be composed.",{},{"id":603,"data":1964,"type":42,"tunes":1966},{"text":1965,"level":254},"MCP does not create the agent loop",{},{"id":608,"data":1968,"type":218,"tunes":1970},{"text":1969},"An AI agent needs a runtime that can decide, invoke tools, observe results, update state and continue or stop. MCP can supply some of the tools and data used by that loop.",{},{"id":613,"data":1972,"type":218,"tunes":1974},{"text":1973},"The MCP server does not automatically become the planner, memory system or orchestrator. Those responsibilities normally remain in the host or agent runtime.",{},{"id":618,"data":1976,"type":218,"tunes":1978},{"text":1977},"A non-agentic application can also use MCP. One deterministic MCP tool call does not require an autonomous multi-step agent.",{},{"id":623,"data":1980,"type":42,"tunes":1981},{"text":625,"level":254},{},{"id":628,"data":1983,"type":218,"tunes":1985},{"text":1984},"MCP primarily connects an AI host or agent to capabilities such as tools, resources and data. A2A targets collaboration between independent agent systems.",{},{"id":633,"data":1987,"type":218,"tunes":1989},{"text":1988},"A remote agent can internally use MCP to reach databases and tools while exposing an A2A interface to other agents. The protocols can therefore be layered rather than substituted.",{},{"id":638,"data":1991,"type":218,"tunes":1993},{"text":1992},"The existing protocol-stack article owns the broader MCP\u002FA2A\u002FUCP\u002FAP2\u002FA2UI comparison; G02 remains the canonical MCP definition.",{},{"id":643,"data":1995,"type":649,"tunes":1999},{"url":645,"title":1996,"excerpt":1997,"ctaLabel":1998},"MCP vs A2A vs UCP vs AP2 vs A2UI: The Agent Protocol Stack Explained","A broader responsibility map showing how MCP composes with agent collaboration, commerce, payment authority and agent-driven UI protocols.","Read the protocol stack",{},{"id":652,"data":2001,"type":42,"tunes":2003},{"text":2002,"level":254},"Local and remote MCP use different transport realities",{},{"id":657,"data":2005,"type":218,"tunes":2007},{"text":2006},"MCP can connect to local and remote servers. Local desktop integrations commonly use process-level transports such as stdio; remote servers use HTTP-oriented transport.",{},{"id":662,"data":2009,"type":218,"tunes":2011},{"text":2010},"The 2026-07-28 revision makes the protocol core stateless. Requests carry the information needed for protocol handling instead of depending on the earlier protocol-level session model.",{},{"id":667,"data":2013,"type":218,"tunes":2015},{"text":2014},"The current revision also places method and capability names in HTTP headers so gateways, WAFs, rate limiters and load balancers can route and meter MCP traffic more naturally.",{},{"id":672,"data":2017,"type":42,"tunes":2019},{"text":2018,"level":254},"Why MCP version awareness matters",{},{"id":677,"data":2021,"type":376,"tunes":2034},{"content":2022,"stretched":43,"withHeadings":14},[2023,2026,2029,2031],[2024,2025],"Protocol era","Operational characteristic",[2027,2028],"2025-11-25 and earlier","Handshake\u002Fsession-oriented lifecycle and older Streamable HTTP behavior",[687,2030],"Stateless core, optional server discovery, self-describing requests, routing headers, cache hints, MRTR and authorization hardening",[2032,2033],"Extensions","Capabilities such as Tasks and MCP Apps can version separately from the base protocol",{},{"id":694,"data":2036,"type":218,"tunes":2038},{"text":2037},"SDK version and protocol version are also different things. The current TypeScript v2 SDK is the stable line for the 2026-07-28 revision, while older v1.x remains a maintenance line for 2025-era behavior.",{},{"id":699,"data":2040,"type":218,"tunes":2042},{"text":2041},"Architecture documentation should record both the SDK\u002Flibrary version and the protocol revision where interoperability behavior depends on them.",{},{"id":704,"data":2044,"type":42,"tunes":2046},{"text":2045,"level":254},"What changed in MCP 2026-07-28",{},{"id":709,"data":2048,"type":376,"tunes":2076},{"content":2049,"stretched":43,"withHeadings":14},[2050,2053,2056,2058,2061,2064,2067,2070,2073],[2051,2052],"Change","Why it matters",[2054,2055],"Stateless core","Remote servers can scale behind ordinary load balancers without protocol-level sticky sessions",[719,2057],"Clients can inspect server capabilities when needed",[2059,2060],"Self-describing requests","Protocol version and client capability metadata travel per request",[2062,2063],"Mcp-Method \u002F Mcp-Name headers","Gateways can route, meter and apply policy without parsing bodies",[2065,2066],"Cache hints","Lists\u002Fresource reads communicate freshness and sharing scope",[2068,2069],"Multi Round-Trip Requests","Servers can require additional input without the older bidirectional request model",[2071,2072],"Authorization hardening","Issuer validation and credential binding strengthen remote auth behavior",[2074,2075],"Extensions framework","Tasks, MCP Apps and other capabilities can evolve separately",{},{"id":741,"data":2078,"type":42,"tunes":2080},{"text":2079,"level":254},"Roots, sampling and logging are no longer the direction for new implementations",{},{"id":746,"data":2082,"type":218,"tunes":2084},{"text":2083},"The 2026-07-28 release marks roots, sampling and logging as deprecated protocol capabilities with a defined compatibility window.",{},{"id":751,"data":2086,"type":218,"tunes":2088},{"text":2087},"Older tutorials may still show these features as central primitives. New implementation work should follow the current specification rather than copy older lifecycle diagrams blindly.",{},{"id":756,"data":2090,"type":218,"tunes":2092},{"text":2091},"Deprecation does not mean immediate removal. It means new systems should avoid unnecessary new dependencies on capabilities the protocol is moving away from.",{},{"id":761,"data":2094,"type":42,"tunes":2096},{"text":2095,"level":254},"Long-running work is not the same as ordinary MCP tool invocation",{},{"id":766,"data":2098,"type":218,"tunes":2100},{"text":2099},"Long-running operations need lifecycle semantics beyond a simple immediate tool result. In the current ecosystem, Tasks moved into a dedicated MCP extension.",{},{"id":771,"data":2102,"type":218,"tunes":2104},{"text":2103},"This reinforces a useful design principle: the base protocol does not need to absorb every agent-runtime concern.",{},{"id":776,"data":2106,"type":218,"tunes":2108},{"text":2107},"An application can also keep long-running workflow ownership entirely in its own runtime and use ordinary MCP tools as underlying operations.",{},{"id":781,"data":2110,"type":42,"tunes":2112},{"text":2111,"level":254},"MCP Apps extend UI capability without redefining the core protocol",{},{"id":786,"data":2114,"type":218,"tunes":2116},{"text":2115},"MCP Apps associate richer interactive UI experiences with MCP tools through the extension model.",{},{"id":791,"data":2118,"type":218,"tunes":2120},{"text":2119},"The host still controls how that UI is embedded, sandboxed and secured.",{},{"id":796,"data":2122,"type":218,"tunes":2124},{"text":2123},"Core capability exchange and UI rendering should therefore remain separate architecture responsibilities.",{},{"id":801,"data":2126,"type":42,"tunes":2128},{"text":2127,"level":254},"MCP authorization is not your complete authorization model",{},{"id":806,"data":2130,"type":218,"tunes":2132},{"text":2131},"Remote MCP needs protocol-level authentication and authorization mechanisms so clients and servers can establish trusted access. The current specification continues to harden OAuth\u002FOIDC-related behavior.",{},{"id":811,"data":2134,"type":218,"tunes":2136},{"text":2135},"That layer answers whether a client is allowed to connect or request protocol scopes. It does not automatically answer whether Alice may refund order 123, whether an agent may write production configuration or whether Tenant A may read Tenant B data.",{},{"id":816,"data":2138,"type":218,"tunes":2140},{"text":2139},"Those domain decisions belong in the server\u002Fapplication authorization model and must be enforced before invoking the underlying operation.",{},{"id":821,"data":2142,"type":226,"tunes":2145},{"body":2143,"title":2144,"variant":240},"Connection trust, tool visibility, tool permission, user authorization, tenant isolation and business approval are different controls. Keep them separate.","Never map “authenticated MCP client” to “trusted for every tool”",{},{"id":827,"data":2147,"type":42,"tunes":2149},{"text":2148,"level":254},"Identity can cross several boundaries",{},{"id":832,"data":2151,"type":218,"tunes":2153},{"text":2152},"An MCP request may involve the MCP client application, the signed-in human, an agent\u002Fsession identity and a downstream service account.",{},{"id":837,"data":2155,"type":218,"tunes":2157},{"text":2156},"The server needs an explicit policy for which principal the operation is performed on behalf of. Otherwise a powerful service credential can become a confused-deputy path.",{},{"id":842,"data":2159,"type":218,"tunes":2161},{"text":2160},"For enterprise use, correlation between user identity, agent identity, MCP connection and downstream authorization is as important as protocol compatibility.",{},{"id":847,"data":2163,"type":42,"tunes":2165},{"text":2164,"level":254},"Tenant isolation remains outside MCP capability discovery",{},{"id":852,"data":2167,"type":218,"tunes":2169},{"text":2168},"A multi-tenant MCP server must apply tenant scope when it reads or changes tenant-owned resources. Returning a tool named search_documents does not define which tenant's documents are eligible.",{},{"id":857,"data":2171,"type":218,"tunes":2173},{"text":2172},"Tenant scope should be derived from trusted identity or membership and carried into databases, caches, vector search, object storage and downstream APIs.",{},{"id":862,"data":2175,"type":218,"tunes":2177},{"text":2176},"Retrieving cross-tenant content and asking the model not to use it is already an isolation failure.",{},{"id":867,"data":2179,"type":42,"tunes":2181},{"text":2180,"level":254},"MCP does not define Source of Truth",{},{"id":872,"data":2183,"type":218,"tunes":2185},{"text":2184},"An MCP server can expose a database, document repository, web search service or AI-generated summary. The protocol does not declare which source is authoritative for a claim.",{},{"id":877,"data":2187,"type":218,"tunes":2189},{"text":2188},"Source-of-Truth rules belong to application\u002Fdomain architecture. The host or server can encode authority through tool design, metadata, access policy or validation, but MCP itself does not make one capability “true.”",{},{"id":882,"data":2191,"type":218,"tunes":2193},{"text":2192},"A tool can therefore be perfectly callable through MCP and still return stale, secondary or non-authoritative information.",{},{"id":887,"data":2195,"type":42,"tunes":2197},{"text":2196,"level":254},"MCP and context engineering",{},{"id":892,"data":2199,"type":218,"tunes":2201},{"text":2200},"MCP can increase the capabilities and information available to an AI application, but context engineering still determines what reaches the model.",{},{"id":897,"data":2203,"type":218,"tunes":2205},{"text":2204},"Tool catalogs consume model-visible context in many hosts. Tool results can be large. Resources can be numerous. A host needs selection, filtering, dynamic loading and compaction rather than exposing everything on every turn.",{},{"id":902,"data":2207,"type":218,"tunes":2209},{"text":2208},"Capability availability and model-visible context should therefore be treated as separate layers.",{},{"id":907,"data":2211,"type":42,"tunes":2213},{"text":2212,"level":254},"Design MCP tools around outcomes and risk boundaries",{},{"id":912,"data":2215,"type":376,"tunes":2240},{"content":2216,"stretched":43,"withHeadings":14},[2217,2220,2222,2225,2228,2231,2234,2237],[2218,2219],"Weak tool design","Stronger tool design",[919,2221],"Narrow domain tools with validated operations",[2223,2224],"One admin tool for all actions","Separate read\u002Fwrite\u002Fapproval operations",[2226,2227],"Raw internal API mirrored 1:1","AI-facing contract around coherent user goals",[2229,2230],"One broad filesystem tool","Workspace-scoped read\u002Fwrite operations",[2232,2233],"Security policy only in description","Server enforces policy in code",[2235,2236],"Unbounded raw response","Structured decision-relevant output",[2238,2239],"Delete\u002Fupdate mixed with read","Separate side-effect tools with confirmation policy",{},{"id":941,"data":2242,"type":42,"tunes":2244},{"text":2243,"level":254},"Approvals belong in the execution architecture",{},{"id":946,"data":2246,"type":218,"tunes":2248},{"text":2247},"A host can require user approval before invoking selected MCP tools. OpenAI's current MCP integration supports automatic or explicit-approval execution patterns.",{},{"id":951,"data":2250,"type":218,"tunes":2252},{"text":2251},"Host approval is useful but should not be the server's only protection because another compatible MCP client may use a different approval model.",{},{"id":956,"data":2254,"type":218,"tunes":2256},{"text":2255},"For destructive or financially consequential actions, use defense in depth: clear tool contract, runtime approval where appropriate, server-side authorization, business validation and audit.",{},{"id":961,"data":2258,"type":42,"tunes":2260},{"text":2259,"level":254},"MCP observability should connect protocol calls to domain actions",{},{"id":966,"data":2262,"type":218,"tunes":2264},{"text":2263},"An MCP trace is most useful when it can be correlated with the underlying application call, database change or business transaction.",{},{"id":971,"data":2266,"type":218,"tunes":2268},{"text":2267},"The 2026-07-28 ecosystem standardizes W3C Trace Context propagation conventions, making it easier to follow a request across host, client, server and downstream services.",{},{"id":976,"data":2270,"type":218,"tunes":2272},{"text":2271},"Protocol logs alone are not enough for consequential operations. Audit evidence should also record relevant principal, tenant, target resource, approval and resulting state change.",{},{"id":981,"data":2274,"type":42,"tunes":2276},{"text":2275,"level":254},"What MCP cannot fix",{},{"id":986,"data":2278,"type":376,"tunes":2313},{"content":2279,"stretched":43,"withHeadings":14},[2280,2283,2286,2289,2292,2295,2298,2301,2304,2307,2310],[2281,2282],"Problem","Why MCP does not solve it",[2284,2285],"Bad business API","MCP can expose the bad API more consistently",[2287,2288],"Wrong data","Protocol validity does not create factual correctness",[2290,2291],"Missing tenant isolation","Tool discovery does not enforce resource ownership",[2293,2294],"Excessive privileges","A standardized tool can still be overprivileged",[2296,2297],"Poor agent planning","MCP exposes capabilities; runtime\u002Fmodel still chooses how to use them",[2299,2300],"Bad retry\u002Fidempotency design","Protocol calls do not make side effects safe",[2302,2303],"No Source of Truth","MCP does not decide which system owns a fact",[2305,2306],"Weak evaluation","Interoperability does not prove task success",[2308,2309],"No audit policy","Transport traces do not define retention or accountability",[2311,2312],"Protocol mismatch","Old\u002Fnew versions can still require migration or compatibility handling",{},{"id":1024,"data":2315,"type":42,"tunes":2317},{"text":2316,"level":254},"Original implementation evidence: Aaasaasa AI Client",{},{"id":1029,"data":2319,"type":226,"tunes":2322},{"body":2320,"title":2321,"variant":247},"Aaasaasa AI Client contains an authenticated local MCP connector\u002Fbroker for approved local directories and integration through Secure MCP Tunnel. This is concrete implementation evidence for the protocol boundary and permission architecture, not a claim of a general-purpose commercial MCP platform.","Implementation evidence",{},{"id":1035,"data":2324,"type":218,"tunes":2326},{"text":2325},"The application can run an authenticated Streamable HTTP MCP endpoint on loopback. The endpoint exposes only directories selected through the central workspace permission broker.",{},{"id":1040,"data":2328,"type":218,"tunes":2330},{"text":2329},"The local endpoint and remote route are separate concerns: the local connector can bind only to loopback, while a Secure MCP Tunnel can make the approved MCP service reachable to a permitted external AI client without exposing the whole local machine.",{},{"id":1045,"data":2332,"type":218,"tunes":2334},{"text":2333},"The central permission model distinguishes chat-only, read-only, project-write and custom-directory profiles. Direct Chat has no filesystem or shell access; tool-capable agent runtimes use the selected permission profile.",{},{"id":1050,"data":2336,"type":218,"tunes":2338},{"text":2337},"This is a direct implementation of the G02 boundary: MCP provides the standardized capability connection, while the application-owned permission broker decides which directories the server may expose.",{},{"id":1055,"data":2340,"type":376,"tunes":2363},{"content":2341,"stretched":43,"withHeadings":14},[2342,2345,2348,2351,2354,2357,2360],[2343,2344],"Implemented element","Architecture evidence",[2346,2347],"Authenticated local MCP endpoint","MCP server can be a local deterministic capability service",[2349,2350],"Loopback binding","Network exposure and protocol capability are separate decisions",[2352,2353],"Secure MCP Tunnel integration","Private\u002Flocal MCP can be bridged through a controlled route",[2355,2356],"Central permission broker","MCP capability is constrained by application policy",[2358,2359],"Selected directory scope","Filesystem visibility is explicitly bounded",[2361,2362],"Direct Chat without OS tools","Model access does not automatically imply tool access",{},{"id":1081,"data":2365,"type":226,"tunes":2368},{"body":2366,"title":2367,"variant":240},"The implementation demonstrates MCP connectivity and permission-scoped local directory exposure. It does not imply that every MCP primitive, every 2026-07-28 feature or every enterprise authorization extension is implemented.","Evidence boundary",{},{"id":1087,"data":2370,"type":42,"tunes":2372},{"text":2371,"level":254},"When MCP is a good fit",{},{"id":1092,"data":2374,"type":376,"tunes":2394},{"content":2375,"stretched":43,"withHeadings":14},[2376,2379,2382,2385,2388,2391],[2377,2378],"MCP is a strong fit when","A direct integration may be simpler when",[2380,2381],"The same capability should be reusable across multiple AI hosts","One application owns both sides and portability has little value",[2383,2384],"An external system wants to publish discoverable AI-facing tools\u002Fresources","A single stable internal API call is sufficient",[2386,2387],"You want a standard boundary around local tools\u002Fdata","There is no AI-facing interoperability requirement",[2389,2390],"Tool providers and AI clients evolve independently","The integration is intentionally private and tightly coupled",[2392,2393],"You want ecosystem-compatible capability discovery","The capability set is tiny and fixed in application code",{},{"id":1115,"data":2396,"type":42,"tunes":2398},{"text":2397,"level":254},"When you do not need MCP",{},{"id":1120,"data":2400,"type":218,"tunes":2402},{"text":2401},"Do not add MCP merely because the application uses AI. If your backend already calls one internal API and no independent MCP client needs that capability, an ordinary function or service call may be clearer.",{},{"id":1125,"data":2404,"type":218,"tunes":2406},{"text":2405},"MCP adds value at an interoperability boundary. Without that boundary, the protocol can become an unnecessary adapter layer.",{},{"id":1130,"data":2408,"type":218,"tunes":2410},{"text":2409},"The architectural question is not “Does this project have AI?” but “Do independently evolving AI hosts and capability providers benefit from a standard contract?”",{},{"id":1135,"data":2412,"type":42,"tunes":2414},{"text":2413,"level":254},"MCP security checklist",{},{"id":1140,"data":2416,"type":376,"tunes":2457},{"content":2417,"stretched":43,"withHeadings":14},[2418,2421,2424,2427,2430,2433,2436,2439,2442,2445,2448,2451,2454],[2419,2420],"Boundary","Question",[2422,2423],"Server identity","Which MCP server am I actually connected to?",[2425,2426],"Client identity","Which application\u002Fclient is requesting access?",[2428,2429],"End-user identity","On whose behalf is the operation performed?",[2431,2432],"Tool allowlist","Which capabilities may this host\u002Fagent discover and call?",[2434,2435],"Business permission","May this principal perform this operation?",[2437,2438],"Tenant scope","Which tenant\u002Fresource boundary applies?",[2440,2441],"Credential isolation","Are credentials bound correctly and kept outside model context?",[2443,2444],"Approval","Which side effects require human confirmation?",[2446,2447],"Input validation","Are tool arguments validated independently of model output?",[2449,2450],"Output trust","Can returned content contain untrusted instructions or sensitive data?",[2452,2453],"Network exposure","Is a local server accidentally exposed beyond intended interfaces?",[2455,2456],"Audit","Can a protocol call be correlated with the downstream action?",{},{"id":1184,"data":2459,"type":42,"tunes":2461},{"text":2460,"level":254},"Common misconceptions",{},{"id":1189,"data":2463,"type":376,"tunes":2504},{"content":2464,"stretched":43,"withHeadings":14},[2465,2468,2471,2474,2477,2480,2483,2486,2489,2492,2495,2498,2501],[2466,2467],"Misconception","Correction",[2469,2470],"“An MCP server is an AI server.”","It can be ordinary deterministic software exposing capabilities.",[2472,2473],"“I need my own LLM on the MCP server.”","No. The model can live entirely on the host side.",[2475,2476],"“MCP replaces REST APIs.”","MCP often wraps existing APIs for AI-facing interoperability.",[2478,2479],"“MCP is an agent framework.”","MCP supplies capabilities; an agent runtime manages iteration and state.",[2481,2482],"“MCP and function calling compete.”","A host can bridge MCP capabilities into its model tool interface.",[2484,2485],"“MCP replaces A2A.”","MCP focuses on capability integration; A2A focuses on agent collaboration.",[2487,2488],"“If a tool is listed, the user may call it.”","Discovery is not authorization.",[2490,2491],"“OAuth solves business permissions.”","Connection authorization does not replace domain authorization or tenant isolation.",[2493,2494],"“Local MCP means local AI.”","Tool-server location and inference location are independent.",[2496,2497],"“MCP makes tool output trustworthy.”","Data quality, authority and provenance still belong to the source\u002Fapplication.",[2499,2500],"“One giant generic tool is flexible.”","Over-broad tools weaken permissions, validation and observability.",[2502,2503],"“Old tutorials are implementation-current.”","The 2026-07-28 revision materially changed lifecycle and transport behavior.",{},{"id":1233,"data":2506,"type":42,"tunes":2508},{"text":2507,"level":254},"A practical MCP design sequence",{},{"id":1238,"data":2510,"type":324,"tunes":2549},{"steps":2511,"title":2548,"orientation":323},[2512,2515,2518,2521,2524,2527,2530,2533,2536,2539,2542,2545],{"label":2513,"description":2514},"1. Identify the interoperability boundary","Confirm that independent AI hosts actually need reusable access.",{"label":2516,"description":2517},"2. Keep the domain API authoritative","Preserve the real application\u002Fservice contract behind MCP.",{"label":2519,"description":2520},"3. Choose primitives deliberately","Use tools, resources and prompts according to their semantics.",{"label":2522,"description":2523},"4. Split by risk and permission","Separate read, write, destructive and approval-required operations.",{"label":2525,"description":2526},"5. Define identity propagation","Know which client, user, agent and downstream principal each call represents.",{"label":2528,"description":2529},"6. Enforce business authorization","Validate permissions, tenant scope and target ownership.",{"label":2531,"description":2532},"7. Choose local or remote transport","Match deployment topology to the real need.",{"label":2534,"description":2535},"8. Pin protocol\u002FSDK expectations","Document 2026-07-28 versus older compatibility.",{"label":2537,"description":2538},"9. Add approvals for consequential actions","Use risk-appropriate confirmation controls.",{"label":2540,"description":2541},"10. Design structured outputs","Return concise machine-usable results.",{"label":2543,"description":2544},"11. Add tracing and audit correlation","Connect MCP calls to downstream service\u002Fbusiness events.",{"label":2546,"description":2547},"12. Test portability","Verify more than one client where interoperability is a stated requirement.","Design the boundary before implementing the server",{},{"id":1280,"data":2551,"type":42,"tunes":2553},{"text":2552,"level":254},"MCP architecture checklist",{},{"id":1285,"data":2555,"type":376,"tunes":2604},{"content":2556,"stretched":43,"withHeadings":14},[2557,2559,2562,2565,2568,2571,2574,2577,2580,2583,2586,2589,2592,2595,2598,2601],[2420,2558],"Expected answer",[2560,2561],"Why is MCP needed?","A real AI-facing interoperability boundary",[2563,2564],"What does the server expose?","Explicit tools\u002Fresources\u002Fprompts",[2566,2567],"Where does the model run?","Independent host\u002Fprovider decision",[2569,2570],"Where does tool execution run?","Named server\u002Fruntime location",[2572,2573],"Which protocol revision is expected?","Version-aware contract",[2575,2576],"Who is the requesting principal?","Client\u002Fuser\u002Fagent identity model",[2578,2579],"Which tools may be discovered?","Allowlist\u002Fcapability policy",[2581,2582],"Which operations may execute?","Server-side business authorization",[2584,2585],"How is tenant\u002Fresource scope enforced?","Trusted tenant\u002Fresource ownership checks",[2587,2588],"Which actions need approval?","Risk-based confirmation policy",[2590,2591],"How are credentials protected?","Trusted runtime storage, not model-visible secrets",[2593,2594],"How is output bounded?","Structured relevant result contract",[2596,2597],"How are calls traced?","Correlation through MCP to downstream action",[2599,2600],"What happens if MCP is unavailable?","Defined fallback\u002Ffailure behavior",[2602,2603],"Can another compatible host use it?","Portability validated where required",{},{"id":1337,"data":2606,"type":42,"tunes":2608},{"text":2607,"level":254},"Edge cases and limitations",{},{"id":1342,"data":2610,"type":218,"tunes":2612},{"text":2611},"A local stdio MCP server can have little network exposure while still be dangerous if the process itself has excessive filesystem or shell permissions.",{},{"id":1347,"data":2614,"type":218,"tunes":2616},{"text":2615},"A remote MCP server may expose only public documentation or highly sensitive enterprise actions. “Remote MCP” says little about risk without the capability and authorization context.",{},{"id":1352,"data":2618,"type":218,"tunes":2620},{"text":2619},"Some servers may use only tools and ignore resources\u002Fprompts. MCP compatibility does not require every optional primitive to be equally important.",{},{"id":1357,"data":2622,"type":218,"tunes":2624},{"text":2623},"A host can translate between its own internal tool model and MCP. Users may never see the protocol boundary directly, which is acceptable if security and attribution remain clear.",{},{"id":1362,"data":2626,"type":218,"tunes":2628},{"text":2627},"MCP continues to evolve rapidly. Extensions, authorization patterns, SDK APIs and ecosystem conventions can change faster than the core architectural distinction.",{},{"id":1367,"data":2630,"type":42,"tunes":2632},{"text":2631,"level":254},"What would change this answer?",{},{"id":1372,"data":2634,"type":218,"tunes":2636},{"text":2635},"Future MCP revisions can change lifecycle, transports, authorization and extension mechanisms. The July 2026 revision already demonstrates why implementation-specific claims must be dated.",{},{"id":1377,"data":2638,"type":218,"tunes":2640},{"text":2639},"The canonical boundary would change only if MCP expanded from an interoperability protocol into an end-to-end application\u002Fagent architecture standard. That is not what the current protocol defines.",{},{"id":1382,"data":2642,"type":218,"tunes":2644},{"text":2643},"For implementation work, always check the current specification and exact SDK line instead of copying version-sensitive examples from older tutorials.",{},{"id":1387,"data":2646,"type":42,"tunes":2648},{"text":2647,"level":254},"Related canonical knowledge",{},{"id":1392,"data":2650,"type":218,"tunes":2652},{"text":2651},"MCP belongs downstream of Agentic AI: first understand the agent\u002Fruntime\u002Ftool boundary, then use MCP when external capabilities need a portable protocol contract.",{},{"id":1397,"data":2654,"type":218,"tunes":2656},{"text":2655},"MCP also depends on RBAC and tenant isolation because protocol-level capability exposure does not determine application authorization.",{},{"id":1402,"data":2658,"type":218,"tunes":2660},{"text":2659},"The broader protocol-stack article explains where MCP sits beside A2A, UCP, AP2 and A2UI. G02 remains the canonical source for MCP itself.",{},{"id":1407,"data":2662,"type":649,"tunes":2667},{"url":2663,"title":2664,"excerpt":2665,"ctaLabel":2666},"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough","AI Agent Reliability: Why the Final Answer Is Not Enough","MCP tool calls become part of an agent trajectory; reliable systems need to evaluate actions and observations, not only final text.","Read the agent reliability article",{},{"id":1415,"data":2669,"type":42,"tunes":2671},{"text":2670,"level":254},"Frequently asked questions",{},{"id":1420,"data":2673,"type":1420,"tunes":2706},{"items":2674,"title":2705},[2675,2678,2681,2684,2687,2690,2693,2696,2699,2702],{"id":1424,"answer":2676,"question":2677},"The Model Context Protocol is an open client-server protocol for connecting AI applications to external tools, resources, prompts and capability providers through a standardized contract.","What is MCP?",{"id":1428,"answer":2679,"question":2680},"No. An MCP server can be completely deterministic software. The model normally runs in the AI host or agent runtime, although a server may optionally use AI internally.","Does an MCP server need an AI model?",{"id":1432,"answer":2682,"question":2683},"The client is the protocol component used by an AI host to communicate with capability providers. The server publishes and executes the capabilities it exposes.","What is the difference between an MCP client and server?",{"id":1436,"answer":2685,"question":2686},"No. Function\u002Ftool calling is how a model invokes configured capabilities. MCP standardizes discovery and communication with external capability servers. A host can bridge the two.","Does MCP replace function calling?",{"id":1440,"answer":2688,"question":2689},"No. MCP servers frequently wrap existing REST, GraphQL, database or service APIs and provide an AI-facing interoperability layer.","Does MCP replace REST APIs?",{"id":1444,"answer":2691,"question":2692},"No. MCP exposes capabilities. Agent planning, state, memory, context management, retries, orchestration and stopping belong to the surrounding runtime.","Is MCP an agent framework?",{"id":1448,"answer":2694,"question":2695},"MCP primarily connects an AI host or agent to tools and data providers. A2A connects independent agent systems for collaboration and delegation.","What is the difference between MCP and A2A?",{"id":1452,"answer":2697,"question":2698},"MCP includes protocol-level authorization mechanisms, especially for remote servers, but the application must still enforce business permissions, resource ownership and tenant isolation.","Does MCP handle authorization?",{"id":1456,"answer":2700,"question":2701},"Yes. Model location is independent of MCP. A local-model host can call local or remote MCP servers, and a cloud-model host can use approved local or remote MCP servers through an appropriate connection architecture.","Can MCP work with local models?",{"id":1460,"answer":2703,"question":2704},"As of 8 October 2026, the current specification revision is 2026-07-28. Older 2025-era implementations remain in use, so compatibility must be checked.","What is the current MCP specification version?","Model Context Protocol FAQ",{},{"id":1466,"data":2708,"type":42,"tunes":2710},{"text":2709,"level":254},"Glossary",{},{"id":1471,"data":2712,"type":1471,"tunes":2741},{"title":2713,"entries":2714},"Key MCP terms",[2715,2717,2720,2722,2724,2726,2728,2730,2732,2734,2736,2738],{"term":595,"anchor":594,"definition":2716},"Model Context Protocol, an open protocol for interoperable connections between AI hosts\u002Fclients and external capability servers.",{"term":2718,"anchor":1479,"definition":2719},"MCP host","The AI application or runtime that owns model interaction and uses MCP clients to connect to servers.",{"term":1772,"anchor":1482,"definition":2721},"Protocol component on the host side that communicates with an MCP server.",{"term":1775,"anchor":1485,"definition":2723},"Capability provider that implements MCP and exposes tools, resources, prompts or supported extensions.",{"term":1882,"anchor":1488,"definition":2725},"Callable structured capability exposed by an MCP server.",{"term":1885,"anchor":1491,"definition":2727},"Readable data or content exposed through MCP resource methods.",{"term":512,"anchor":1494,"definition":2729},"Reusable prompt template exposed by an MCP server for compatible hosts.",{"term":1497,"anchor":1498,"definition":2731},"HTTP-oriented MCP transport used for remote\u002Fnetworked server communication.",{"term":1501,"anchor":1501,"definition":2733},"Process standard-input\u002Foutput transport commonly used for local MCP server integrations.",{"term":719,"anchor":1504,"definition":2735},"Modern MCP method that lets a client inspect server capabilities in the 2026-07-28 protocol era.",{"term":1507,"anchor":1508,"definition":2737},"Multi Round-Trip Requests, a mechanism for obtaining additional input during a request in the 2026-07-28 protocol era.",{"term":2739,"anchor":1512,"definition":2740},"MCP extension","Capability that composes with the base protocol and can evolve\u002Fversion separately, such as Tasks or MCP Apps.",{},{"id":1516,"data":2743,"type":42,"tunes":2745},{"text":2744,"level":254},"Conclusion",{},{"id":1521,"data":2747,"type":218,"tunes":2749},{"text":2748},"MCP is easiest to understand when its boundary stays narrow: it connects AI applications to external capabilities through a standard protocol.",{},{"id":1526,"data":2751,"type":218,"tunes":2753},{"text":2752},"The model does not have to live on the MCP server. The server does not become the agent runtime. A listed tool does not become an authorized business action. And MCP does not replace the underlying API, Source of Truth, tenant isolation or domain architecture.",{},{"id":1531,"data":2755,"type":218,"tunes":2757},{"text":2756},"That narrowness is the protocol's strength. MCP can standardize how AI systems reach tools and data while leaving application ownership, security, business semantics and model choice in the layers that actually own them.",{},{"id":1536,"data":2759,"type":42,"tunes":2761},{"text":2760,"level":254},"Primary sources and current documentation",{},{"id":1541,"data":2763,"type":218,"tunes":2765},{"text":2764},"MCP is evolving quickly, so version-sensitive claims in this article are tied to the 8 October 2026 state. The Aaasaasa AI Client section is original implementation evidence and is explicitly limited to the verified MCP connector and permission-broker scope.",{},{"id":1546,"data":2767,"type":1553,"tunes":2772},{"link":1548,"meta":2768},{"image":2769,"title":2770,"description":2771},{"url":401},"Model Context Protocol — TypeScript SDK v2","Current stable TypeScript SDK documentation implementing the 2026-07-28 MCP specification and server\u002Fclient primitives.",{},{"id":1556,"data":2774,"type":1553,"tunes":2779},{"link":1558,"meta":2775},{"image":2776,"title":2777,"description":2778},{"url":401},"Model Context Protocol — 2026-07-28 Specification Release","Official release explanation for the current MCP protocol revision, including stateless core, MRTR, routing, caching, authorization hardening, extensions and deprecations.",{},{"id":1565,"data":2781,"type":1553,"tunes":2786},{"link":1567,"meta":2782},{"image":2783,"title":2784,"description":2785},{"url":401},"MCP TypeScript SDK — Supporting protocol revision 2026-07-28","Version-specific implementation guidance for the current protocol revision and earlier-era compatibility.",{},{"id":1574,"data":2788,"type":1553,"tunes":2793},{"link":1576,"meta":2789},{"image":2790,"title":2791,"description":2792},{"url":401},"OpenAI — MCP servers","Current OpenAI guidance for connecting models to remote MCP servers and local\u002Fprivate MCP servers through Secure MCP Tunnel.",{},{"id":1583,"data":2795,"type":1553,"tunes":2800},{"link":1585,"meta":2796},{"image":2797,"title":2798,"description":2799},{"url":401},"OpenAI — MCP connections for Agents API","Current MCP connection guidance covering service, environment and stdio locations plus allowed-tool controls.",{},{"id":1592,"data":2802,"type":1553,"tunes":2807},{"link":1594,"meta":2803},{"image":2804,"title":2805,"description":2806},{"url":401},"OpenAI — Tools","Current overview placing remote MCP servers alongside function calling, web search, shell and other model tools.",{},{"id":1601,"data":2809,"type":1553,"tunes":2814},{"link":1603,"meta":2810},{"image":2811,"title":2812,"description":2813},{"url":401},"OpenAI — MCP server concept","Current description of MCP servers exposing tools, resources and prompts for external service integrations.",{},"2.31.6","Model Context Protocol connects AI applications to external tools, resources and prompts through a standard client-server boundary. Learn what MCP does, what it does not do, and where it fits in agent architecture.",{"lang":7,"title":208,"content":210,"contentJson":2818,"excerpt":1610},{"time":212,"blocks":2819,"version":1609},[2820,2823,2826,2829,2832,2835,2838,2841,2844,2847,2850,2853,2856,2859,2862,2873,2876,2879,2882,2885,2888,2899,2902,2905,2908,2924,2927,2930,2933,2936,2939,2942,2945,2948,2951,2954,2957,2960,2963,2974,2977,2980,2983,2986,2989,2992,2995,2998,3001,3004,3019,3022,3025,3028,3031,3034,3037,3040,3043,3046,3049,3052,3055,3058,3061,3064,3072,3075,3078,3081,3094,3097,3100,3103,3106,3109,3112,3115,3118,3121,3124,3127,3130,3133,3136,3139,3142,3145,3148,3151,3154,3157,3160,3163,3166,3169,3172,3175,3178,3181,3184,3187,3190,3193,3196,3208,3211,3214,3217,3220,3223,3226,3229,3232,3235,3250,3253,3256,3259,3262,3265,3268,3279,3282,3285,3295,3298,3301,3304,3307,3310,3327,3330,3347,3350,3366,3369,3389,3392,3395,3398,3401,3404,3407,3410,3413,3416,3419,3422,3425,3428,3431,3434,3437,3451,3454,3470,3473,3476,3479,3482,3485,3488,3493,3498,3503,3508,3513,3518],{"id":215,"data":2821,"type":218,"tunes":2822},{"text":217},{},{"id":221,"data":2824,"type":226,"tunes":2825},{"body":223,"title":224,"variant":225},{},{"id":229,"data":2827,"type":226,"tunes":2828},{"body":231,"title":232,"variant":233},{},{"id":236,"data":2830,"type":226,"tunes":2831},{"body":238,"title":239,"variant":240},{},{"id":243,"data":2833,"type":226,"tunes":2834},{"body":245,"title":246,"variant":247},{},{"id":250,"data":2836,"type":255,"tunes":2837},{"title":252,"maxLevel":253,"minLevel":254},{},{"id":258,"data":2839,"type":42,"tunes":2840},{"text":260,"level":254},{},{"id":263,"data":2842,"type":218,"tunes":2843},{"text":265},{},{"id":268,"data":2845,"type":218,"tunes":2846},{"text":270},{},{"id":273,"data":2848,"type":218,"tunes":2849},{"text":275},{},{"id":278,"data":2851,"type":42,"tunes":2852},{"text":280,"level":254},{},{"id":283,"data":2854,"type":218,"tunes":2855},{"text":285},{},{"id":288,"data":2857,"type":218,"tunes":2858},{"text":290},{},{"id":293,"data":2860,"type":218,"tunes":2861},{"text":295},{},{"id":298,"data":2863,"type":324,"tunes":2872},{"steps":2864,"title":322,"orientation":323},[2865,2866,2867,2868,2869,2870,2871],{"label":302,"description":303},{"label":305,"description":306},{"label":308,"description":309},{"label":311,"description":312},{"label":314,"description":315},{"label":317,"description":318},{"label":320,"description":321},{},{"id":327,"data":2874,"type":42,"tunes":2875},{"text":329,"level":254},{},{"id":332,"data":2877,"type":218,"tunes":2878},{"text":334},{},{"id":337,"data":2880,"type":218,"tunes":2881},{"text":339},{},{"id":342,"data":2883,"type":218,"tunes":2884},{"text":344},{},{"id":347,"data":2886,"type":42,"tunes":2887},{"text":349,"level":254},{},{"id":352,"data":2889,"type":376,"tunes":2898},{"content":2890,"stretched":43,"withHeadings":14},[2891,2892,2893,2894,2895,2896,2897],[356,357],[359,360],[362,363],[365,366],[368,369],[371,372],[374,375],{},{"id":379,"data":2900,"type":218,"tunes":2901},{"text":381},{},{"id":384,"data":2903,"type":218,"tunes":2904},{"text":386},{},{"id":389,"data":2906,"type":42,"tunes":2907},{"text":391,"level":254},{},{"id":394,"data":2909,"type":425,"tunes":2923},{"rows":2910,"title":414,"layout":376,"columns":2919},[2911,2913,2915,2917],{"id":398,"label":399,"values":2912},[401,401,401],{"id":403,"label":404,"values":2914},[401,401,401],{"id":407,"label":408,"values":2916},[401,401,401],{"id":411,"label":412,"values":2918},[401,401,401],[2920,2921,2922],{"id":417,"label":418},{"id":420,"label":421},{"id":423,"label":424},{},{"id":428,"data":2925,"type":42,"tunes":2926},{"text":430,"level":254},{},{"id":433,"data":2928,"type":218,"tunes":2929},{"text":435},{},{"id":438,"data":2931,"type":218,"tunes":2932},{"text":440},{},{"id":443,"data":2934,"type":218,"tunes":2935},{"text":445},{},{"id":448,"data":2937,"type":42,"tunes":2938},{"text":450,"level":254},{},{"id":453,"data":2940,"type":218,"tunes":2941},{"text":455},{},{"id":458,"data":2943,"type":218,"tunes":2944},{"text":460},{},{"id":463,"data":2946,"type":218,"tunes":2947},{"text":465},{},{"id":468,"data":2949,"type":42,"tunes":2950},{"text":470,"level":254},{},{"id":473,"data":2952,"type":218,"tunes":2953},{"text":475},{},{"id":478,"data":2955,"type":218,"tunes":2956},{"text":480},{},{"id":483,"data":2958,"type":218,"tunes":2959},{"text":485},{},{"id":488,"data":2961,"type":42,"tunes":2962},{"text":490,"level":254},{},{"id":493,"data":2964,"type":376,"tunes":2973},{"content":2965,"stretched":43,"withHeadings":14},[2966,2967,2968,2969,2970,2971,2972],[497,498],[500,501],[503,504],[506,507],[509,501],[511,512],[514,515],{},{"id":518,"data":2975,"type":42,"tunes":2976},{"text":520,"level":254},{},{"id":523,"data":2978,"type":218,"tunes":2979},{"text":525},{},{"id":528,"data":2981,"type":218,"tunes":2982},{"text":530},{},{"id":533,"data":2984,"type":218,"tunes":2985},{"text":535},{},{"id":538,"data":2987,"type":226,"tunes":2988},{"body":540,"title":541,"variant":233},{},{"id":544,"data":2990,"type":42,"tunes":2991},{"text":546,"level":254},{},{"id":549,"data":2993,"type":218,"tunes":2994},{"text":551},{},{"id":554,"data":2996,"type":218,"tunes":2997},{"text":556},{},{"id":559,"data":2999,"type":218,"tunes":3000},{"text":561},{},{"id":564,"data":3002,"type":42,"tunes":3003},{"text":566,"level":254},{},{"id":569,"data":3005,"type":425,"tunes":3018},{"rows":3006,"title":588,"layout":376,"columns":3015},[3007,3009,3011,3013],{"id":573,"label":574,"values":3008},[401,401],{"id":577,"label":578,"values":3010},[401,401],{"id":581,"label":582,"values":3012},[401,401],{"id":585,"label":586,"values":3014},[401,401],[3016,3017],{"id":591,"label":592},{"id":594,"label":595},{},{"id":598,"data":3020,"type":218,"tunes":3021},{"text":600},{},{"id":603,"data":3023,"type":42,"tunes":3024},{"text":605,"level":254},{},{"id":608,"data":3026,"type":218,"tunes":3027},{"text":610},{},{"id":613,"data":3029,"type":218,"tunes":3030},{"text":615},{},{"id":618,"data":3032,"type":218,"tunes":3033},{"text":620},{},{"id":623,"data":3035,"type":42,"tunes":3036},{"text":625,"level":254},{},{"id":628,"data":3038,"type":218,"tunes":3039},{"text":630},{},{"id":633,"data":3041,"type":218,"tunes":3042},{"text":635},{},{"id":638,"data":3044,"type":218,"tunes":3045},{"text":640},{},{"id":643,"data":3047,"type":649,"tunes":3048},{"url":645,"title":646,"excerpt":647,"ctaLabel":648},{},{"id":652,"data":3050,"type":42,"tunes":3051},{"text":654,"level":254},{},{"id":657,"data":3053,"type":218,"tunes":3054},{"text":659},{},{"id":662,"data":3056,"type":218,"tunes":3057},{"text":664},{},{"id":667,"data":3059,"type":218,"tunes":3060},{"text":669},{},{"id":672,"data":3062,"type":42,"tunes":3063},{"text":674,"level":254},{},{"id":677,"data":3065,"type":376,"tunes":3071},{"content":3066,"stretched":43,"withHeadings":14},[3067,3068,3069,3070],[681,682],[684,685],[687,688],[690,691],{},{"id":694,"data":3073,"type":218,"tunes":3074},{"text":696},{},{"id":699,"data":3076,"type":218,"tunes":3077},{"text":701},{},{"id":704,"data":3079,"type":42,"tunes":3080},{"text":706,"level":254},{},{"id":709,"data":3082,"type":376,"tunes":3093},{"content":3083,"stretched":43,"withHeadings":14},[3084,3085,3086,3087,3088,3089,3090,3091,3092],[713,714],[716,717],[719,720],[722,723],[725,726],[728,729],[731,732],[734,735],[737,738],{},{"id":741,"data":3095,"type":42,"tunes":3096},{"text":743,"level":254},{},{"id":746,"data":3098,"type":218,"tunes":3099},{"text":748},{},{"id":751,"data":3101,"type":218,"tunes":3102},{"text":753},{},{"id":756,"data":3104,"type":218,"tunes":3105},{"text":758},{},{"id":761,"data":3107,"type":42,"tunes":3108},{"text":763,"level":254},{},{"id":766,"data":3110,"type":218,"tunes":3111},{"text":768},{},{"id":771,"data":3113,"type":218,"tunes":3114},{"text":773},{},{"id":776,"data":3116,"type":218,"tunes":3117},{"text":778},{},{"id":781,"data":3119,"type":42,"tunes":3120},{"text":783,"level":254},{},{"id":786,"data":3122,"type":218,"tunes":3123},{"text":788},{},{"id":791,"data":3125,"type":218,"tunes":3126},{"text":793},{},{"id":796,"data":3128,"type":218,"tunes":3129},{"text":798},{},{"id":801,"data":3131,"type":42,"tunes":3132},{"text":803,"level":254},{},{"id":806,"data":3134,"type":218,"tunes":3135},{"text":808},{},{"id":811,"data":3137,"type":218,"tunes":3138},{"text":813},{},{"id":816,"data":3140,"type":218,"tunes":3141},{"text":818},{},{"id":821,"data":3143,"type":226,"tunes":3144},{"body":823,"title":824,"variant":240},{},{"id":827,"data":3146,"type":42,"tunes":3147},{"text":829,"level":254},{},{"id":832,"data":3149,"type":218,"tunes":3150},{"text":834},{},{"id":837,"data":3152,"type":218,"tunes":3153},{"text":839},{},{"id":842,"data":3155,"type":218,"tunes":3156},{"text":844},{},{"id":847,"data":3158,"type":42,"tunes":3159},{"text":849,"level":254},{},{"id":852,"data":3161,"type":218,"tunes":3162},{"text":854},{},{"id":857,"data":3164,"type":218,"tunes":3165},{"text":859},{},{"id":862,"data":3167,"type":218,"tunes":3168},{"text":864},{},{"id":867,"data":3170,"type":42,"tunes":3171},{"text":869,"level":254},{},{"id":872,"data":3173,"type":218,"tunes":3174},{"text":874},{},{"id":877,"data":3176,"type":218,"tunes":3177},{"text":879},{},{"id":882,"data":3179,"type":218,"tunes":3180},{"text":884},{},{"id":887,"data":3182,"type":42,"tunes":3183},{"text":889,"level":254},{},{"id":892,"data":3185,"type":218,"tunes":3186},{"text":894},{},{"id":897,"data":3188,"type":218,"tunes":3189},{"text":899},{},{"id":902,"data":3191,"type":218,"tunes":3192},{"text":904},{},{"id":907,"data":3194,"type":42,"tunes":3195},{"text":909,"level":254},{},{"id":912,"data":3197,"type":376,"tunes":3207},{"content":3198,"stretched":43,"withHeadings":14},[3199,3200,3201,3202,3203,3204,3205,3206],[916,917],[919,920],[922,923],[925,926],[928,929],[931,932],[934,935],[937,938],{},{"id":941,"data":3209,"type":42,"tunes":3210},{"text":943,"level":254},{},{"id":946,"data":3212,"type":218,"tunes":3213},{"text":948},{},{"id":951,"data":3215,"type":218,"tunes":3216},{"text":953},{},{"id":956,"data":3218,"type":218,"tunes":3219},{"text":958},{},{"id":961,"data":3221,"type":42,"tunes":3222},{"text":963,"level":254},{},{"id":966,"data":3224,"type":218,"tunes":3225},{"text":968},{},{"id":971,"data":3227,"type":218,"tunes":3228},{"text":973},{},{"id":976,"data":3230,"type":218,"tunes":3231},{"text":978},{},{"id":981,"data":3233,"type":42,"tunes":3234},{"text":983,"level":254},{},{"id":986,"data":3236,"type":376,"tunes":3249},{"content":3237,"stretched":43,"withHeadings":14},[3238,3239,3240,3241,3242,3243,3244,3245,3246,3247,3248],[990,991],[993,994],[996,997],[999,1000],[1002,1003],[1005,1006],[1008,1009],[1011,1012],[1014,1015],[1017,1018],[1020,1021],{},{"id":1024,"data":3251,"type":42,"tunes":3252},{"text":1026,"level":254},{},{"id":1029,"data":3254,"type":226,"tunes":3255},{"body":1031,"title":1032,"variant":247},{},{"id":1035,"data":3257,"type":218,"tunes":3258},{"text":1037},{},{"id":1040,"data":3260,"type":218,"tunes":3261},{"text":1042},{},{"id":1045,"data":3263,"type":218,"tunes":3264},{"text":1047},{},{"id":1050,"data":3266,"type":218,"tunes":3267},{"text":1052},{},{"id":1055,"data":3269,"type":376,"tunes":3278},{"content":3270,"stretched":43,"withHeadings":14},[3271,3272,3273,3274,3275,3276,3277],[1059,1060],[1062,1063],[1065,1066],[1068,1069],[1071,1072],[1074,1075],[1077,1078],{},{"id":1081,"data":3280,"type":226,"tunes":3281},{"body":1083,"title":1084,"variant":240},{},{"id":1087,"data":3283,"type":42,"tunes":3284},{"text":1089,"level":254},{},{"id":1092,"data":3286,"type":376,"tunes":3294},{"content":3287,"stretched":43,"withHeadings":14},[3288,3289,3290,3291,3292,3293],[1096,1097],[1099,1100],[1102,1103],[1105,1106],[1108,1109],[1111,1112],{},{"id":1115,"data":3296,"type":42,"tunes":3297},{"text":1117,"level":254},{},{"id":1120,"data":3299,"type":218,"tunes":3300},{"text":1122},{},{"id":1125,"data":3302,"type":218,"tunes":3303},{"text":1127},{},{"id":1130,"data":3305,"type":218,"tunes":3306},{"text":1132},{},{"id":1135,"data":3308,"type":42,"tunes":3309},{"text":1137,"level":254},{},{"id":1140,"data":3311,"type":376,"tunes":3326},{"content":3312,"stretched":43,"withHeadings":14},[3313,3314,3315,3316,3317,3318,3319,3320,3321,3322,3323,3324,3325],[1144,1145],[1147,1148],[1150,1151],[1153,1154],[1156,1157],[1159,1160],[1162,1163],[1165,1166],[1168,1169],[1171,1172],[1174,1175],[1177,1178],[1180,1181],{},{"id":1184,"data":3328,"type":42,"tunes":3329},{"text":1186,"level":254},{},{"id":1189,"data":3331,"type":376,"tunes":3346},{"content":3332,"stretched":43,"withHeadings":14},[3333,3334,3335,3336,3337,3338,3339,3340,3341,3342,3343,3344,3345],[1193,1194],[1196,1197],[1199,1200],[1202,1203],[1205,1206],[1208,1209],[1211,1212],[1214,1215],[1217,1218],[1220,1221],[1223,1224],[1226,1227],[1229,1230],{},{"id":1233,"data":3348,"type":42,"tunes":3349},{"text":1235,"level":254},{},{"id":1238,"data":3351,"type":324,"tunes":3365},{"steps":3352,"title":1277,"orientation":323},[3353,3354,3355,3356,3357,3358,3359,3360,3361,3362,3363,3364],{"label":1242,"description":1243},{"label":1245,"description":1246},{"label":1248,"description":1249},{"label":1251,"description":1252},{"label":1254,"description":1255},{"label":1257,"description":1258},{"label":1260,"description":1261},{"label":1263,"description":1264},{"label":1266,"description":1267},{"label":1269,"description":1270},{"label":1272,"description":1273},{"label":1275,"description":1276},{},{"id":1280,"data":3367,"type":42,"tunes":3368},{"text":1282,"level":254},{},{"id":1285,"data":3370,"type":376,"tunes":3388},{"content":3371,"stretched":43,"withHeadings":14},[3372,3373,3374,3375,3376,3377,3378,3379,3380,3381,3382,3383,3384,3385,3386,3387],[1145,1289],[1291,1292],[1294,1295],[1297,1298],[1300,1301],[1303,1304],[1306,1307],[1309,1310],[1312,1313],[1315,1316],[1318,1319],[1321,1322],[1324,1325],[1327,1328],[1330,1331],[1333,1334],{},{"id":1337,"data":3390,"type":42,"tunes":3391},{"text":1339,"level":254},{},{"id":1342,"data":3393,"type":218,"tunes":3394},{"text":1344},{},{"id":1347,"data":3396,"type":218,"tunes":3397},{"text":1349},{},{"id":1352,"data":3399,"type":218,"tunes":3400},{"text":1354},{},{"id":1357,"data":3402,"type":218,"tunes":3403},{"text":1359},{},{"id":1362,"data":3405,"type":218,"tunes":3406},{"text":1364},{},{"id":1367,"data":3408,"type":42,"tunes":3409},{"text":1369,"level":254},{},{"id":1372,"data":3411,"type":218,"tunes":3412},{"text":1374},{},{"id":1377,"data":3414,"type":218,"tunes":3415},{"text":1379},{},{"id":1382,"data":3417,"type":218,"tunes":3418},{"text":1384},{},{"id":1387,"data":3420,"type":42,"tunes":3421},{"text":1389,"level":254},{},{"id":1392,"data":3423,"type":218,"tunes":3424},{"text":1394},{},{"id":1397,"data":3426,"type":218,"tunes":3427},{"text":1399},{},{"id":1402,"data":3429,"type":218,"tunes":3430},{"text":1404},{},{"id":1407,"data":3432,"type":649,"tunes":3433},{"url":1409,"title":1410,"excerpt":1411,"ctaLabel":1412},{},{"id":1415,"data":3435,"type":42,"tunes":3436},{"text":1417,"level":254},{},{"id":1420,"data":3438,"type":1420,"tunes":3450},{"items":3439,"title":1463},[3440,3441,3442,3443,3444,3445,3446,3447,3448,3449],{"id":1424,"answer":1425,"question":1426},{"id":1428,"answer":1429,"question":1430},{"id":1432,"answer":1433,"question":1434},{"id":1436,"answer":1437,"question":1438},{"id":1440,"answer":1441,"question":1442},{"id":1444,"answer":1445,"question":1446},{"id":1448,"answer":1449,"question":1450},{"id":1452,"answer":1453,"question":1454},{"id":1456,"answer":1457,"question":1458},{"id":1460,"answer":1461,"question":1462},{},{"id":1466,"data":3452,"type":42,"tunes":3453},{"text":1468,"level":254},{},{"id":1471,"data":3455,"type":1471,"tunes":3469},{"title":1473,"entries":3456},[3457,3458,3459,3460,3461,3462,3463,3464,3465,3466,3467,3468],{"term":595,"anchor":594,"definition":1476},{"term":1478,"anchor":1479,"definition":1480},{"term":362,"anchor":1482,"definition":1483},{"term":365,"anchor":1485,"definition":1486},{"term":501,"anchor":1488,"definition":1489},{"term":504,"anchor":1491,"definition":1492},{"term":512,"anchor":1494,"definition":1495},{"term":1497,"anchor":1498,"definition":1499},{"term":1501,"anchor":1501,"definition":1502},{"term":719,"anchor":1504,"definition":1505},{"term":1507,"anchor":1508,"definition":1509},{"term":1511,"anchor":1512,"definition":1513},{},{"id":1516,"data":3471,"type":42,"tunes":3472},{"text":1518,"level":254},{},{"id":1521,"data":3474,"type":218,"tunes":3475},{"text":1523},{},{"id":1526,"data":3477,"type":218,"tunes":3478},{"text":1528},{},{"id":1531,"data":3480,"type":218,"tunes":3481},{"text":1533},{},{"id":1536,"data":3483,"type":42,"tunes":3484},{"text":1538,"level":254},{},{"id":1541,"data":3486,"type":218,"tunes":3487},{"text":1543},{},{"id":1546,"data":3489,"type":1553,"tunes":3492},{"link":1548,"meta":3490},{"image":3491,"title":1551,"description":1552},{"url":401},{},{"id":1556,"data":3494,"type":1553,"tunes":3497},{"link":1558,"meta":3495},{"image":3496,"title":1561,"description":1562},{"url":401},{},{"id":1565,"data":3499,"type":1553,"tunes":3502},{"link":1567,"meta":3500},{"image":3501,"title":1570,"description":1571},{"url":401},{},{"id":1574,"data":3504,"type":1553,"tunes":3507},{"link":1576,"meta":3505},{"image":3506,"title":1579,"description":1580},{"url":401},{},{"id":1583,"data":3509,"type":1553,"tunes":3512},{"link":1585,"meta":3510},{"image":3511,"title":1588,"description":1589},{"url":401},{},{"id":1592,"data":3514,"type":1553,"tunes":3517},{"link":1594,"meta":3515},{"image":3516,"title":1597,"description":1598},{"url":401},{},{"id":1601,"data":3519,"type":1553,"tunes":3522},{"link":1603,"meta":3520},{"image":3521,"title":1606,"description":1607},{"url":401},{},"Post erfolgreich abgerufen",{"items":3525,"source":3610,"manualIds":3611,"manualMatchedIds":3612},[3526,3533,3540,3547,3554,3561,3568,3575,3582,3589,3596,3603],{"id":3527,"slug":3528,"title":3529,"excerpt":3530,"featuredImage":3531,"publishedAt":3532},"382","a-practical-monorepo-architecture-next-js-platform-admin-fastify-api-prisma-and-nginx","Una Arquitectura Monorepo Práctica con Next.js, Fastify, Prisma y NGINX","Explora una arquitectura monorepo práctica utilizando Next.js, Fastify, Prisma y NGINX, destacando la integración y el flujo de trabajo en el mundo real.","\u002Fuploads\u002F2026\u002F01\u002Fa-practical-monorepo-architecture-next-js-platform-admin-fastify-api-prisma-and-nginx-1769885526116-q1100n.webp","2026-01-31T08:18:00.000Z",{"id":3534,"slug":3535,"title":3536,"excerpt":3537,"featuredImage":3538,"publishedAt":3539},"486","source-of-truth-in-ai-systems-where-reliable-knowledge-actually-comes-from","Fuente de verdad en los sistemas de IA: de dónde proviene realmente el conocimiento fiable","Una fuente de verdad define qué fuente es autoritativa para un hecho o estado específico. Aprende en qué se diferencia de RAG, la procedencia, la memoria, el contexto, las bases de datos vectoriales y los sistemas de registro.","\u002Fuploads\u002F2026\u002F10\u002Fsource-of-truth-in-ai-systems-where-reliable-knowledge-actually-comes-from-1791479103235-6bq9em.webp","2026-10-08T13:02:00.000Z",{"id":3541,"slug":3542,"title":3543,"excerpt":3544,"featuredImage":3545,"publishedAt":3546},"485","enterprise-ai-architecture-what-changes-when-ai-enters-a-company","Arquitectura de IA empresarial: qué cambia cuando la IA entra en una empresa","La arquitectura de IA empresarial explica cómo la IA cambia los sistemas de la empresa en materia de autoridad sobre los datos, identidad, permisos, proveedores, riesgo, gobernanza, evaluación, cumplimiento y operaciones.","\u002Fuploads\u002F2026\u002F10\u002Fenterprise-ai-architecture-what-changes-when-ai-enters-a-company-1791478161363-czrwaq.webp","2026-10-08T10:48:00.000Z",{"id":3548,"slug":3549,"title":3550,"excerpt":3551,"featuredImage":3552,"publishedAt":3553},"484","what-is-an-ai-platform-architect-models-data-runtime-security-and-operations","¿Qué es un arquitecto de plataforma de IA? Modelos, datos, entorno de ejecución, seguridad y operaciones","Un Arquitecto de Plataformas de IA diseña fundamentos de IA reutilizables a través de modelos, proveedores, recuperación, agentes, identidad, seguridad, evaluación, observabilidad y operaciones.","\u002Fuploads\u002F2026\u002F10\u002Fwhat-is-an-ai-platform-architect-models-data-runtime-security-and-operations-1791477229171-ou3zcc.webp","2026-10-08T12:32:00.000Z",{"id":3555,"slug":3556,"title":3557,"excerpt":3558,"featuredImage":3559,"publishedAt":3560},"480","when-should-an-ai-stop-trusting-its-own-knowledge-the-retrieval-trigger","¿Cuándo debería una IA dejar de confiar en su propio conocimiento? — El desencadenante de la recuperación","Un modelo de IA no necesita recuperación para cada pregunta. El problema importante es saber cuándo su conocimiento interno ya no es suficiente. El Disparador de Recuperación es un límite de decisión práctico que determina cuándo un sistema de IA debe dejar de depender únicamente del conocimiento del modelo y obtener evidencia externa antes de responder.","\u002Fuploads\u002F2026\u002F09\u002Fwhen-should-an-ai-stop-trusting-its-own-knowledge-the-retrieval-trigger-1790574991244-f4rpyg.webp","2026-09-28T01:49:00.000Z",{"id":3562,"slug":3563,"title":3564,"excerpt":3565,"featuredImage":3566,"publishedAt":3567},"478","what-is-rag-the-simplest-explanation-of-how-it-works","¿Qué es RAG? La explicación más sencilla de cómo funciona","RAG suena complicado, pero la idea es simple: antes de que una IA responda, primero busca información útil de una fuente de conocimiento y le da esa información al modelo de lenguaje. Esta guía explica RAG, los LLM, el estado, la memoria y las herramientas usando un modelo mental simple.","\u002Fuploads\u002F2026\u002F09\u002Fwhat-is-rag-the-simplest-explanation-of-how-it-works-1790377492124-khjagt.webp","2026-09-25T19:03:00.000Z",{"id":3569,"slug":3570,"title":3571,"excerpt":3572,"featuredImage":3573,"publishedAt":3574},"483","what-is-an-ai-solution-architect-system-boundaries-responsibilities-and-trade-offs","¿Qué es un arquitecto de soluciones de IA? Límites del sistema, responsabilidades y compensaciones","Un Arquitecto de Soluciones de IA convierte los requisitos empresariales en un sistema de IA listo para producción que abarca datos, modelos, herramientas, seguridad, tiempo de ejecución, evaluación y operaciones.","\u002Fuploads\u002F2026\u002F10\u002Fwhat-is-an-ai-solution-architect-system-boundaries-responsibilities-and-trade-offs-1791476643267-1st5xz.webp","2026-10-08T12:23:00.000Z",{"id":3576,"slug":3577,"title":3578,"excerpt":3579,"featuredImage":3580,"publishedAt":3581},"471","how-to-know-whether-an-ai-agent-actually-used-the-right-evidence","Cómo saber si un agente de IA realmente utilizó la evidencia correcta","Un agente de IA puede citar fuentes y aun así usar la evidencia incorrecta. Este artículo presenta un método práctico para verificar el respaldo de las afirmaciones, la autoridad de la fuente, la aplicabilidad, la procedencia y si la evidencia realmente influyó en la respuesta.","\u002Fuploads\u002F2026\u002F09\u002Fhow-to-know-whether-an-ai-agent-actually-used-the-right-evidence-1790351317188-o5z9ve.webp","2026-09-25T11:47:00.000Z",{"id":3583,"slug":3584,"title":3585,"excerpt":3586,"featuredImage":3587,"publishedAt":3588},"489","agentic-ai-explained-when-an-ai-system-can-plan-use-tools-and-act","IA agéntica explicada: cuando un sistema de IA puede planificar, usar herramientas y actuar","La IA agéntica utiliza modelos dentro de bucles de ejecución de varios pasos, donde pueden elegir herramientas, observar resultados, actualizar el estado y adaptar su siguiente acción dentro de límites explícitos de tiempo de ejecución y permisos.","\u002Fuploads\u002F2026\u002F10\u002Fagentic-ai-explained-when-an-ai-system-can-plan-use-tools-and-act-1791481499084-wnji2a.webp","2026-10-08T11:43:00.000Z",{"id":3590,"slug":3591,"title":3592,"excerpt":3593,"featuredImage":3594,"publishedAt":3595},"481","generative-ai-explained-models-retrieval-tools-and-applications-are-not-the-same-thing","IA generativa explicada: modelos, recuperación, herramientas y aplicaciones no son lo mismo","La IA generativa es más que un modelo. Aprende cómo los modelos, la recuperación, las herramientas, el contexto, los entornos de ejecución y las aplicaciones encajan en los sistemas de IA en producción.","\u002Fuploads\u002F2026\u002F10\u002Fgenerative-ai-explained-models-retrieval-tools-and-applications-are-not-the-same-thing-1791475411822-pp0dvz.webp","2026-10-08T12:00:00.000Z",{"id":3597,"slug":3598,"title":3599,"excerpt":3600,"featuredImage":3601,"publishedAt":3602},"381","enterprise-grade-multi-tenant-architecture-for-an-international-platform","Arquitectura Multi-Inquilino de Grado Empresarial para una Plataforma Internacional","Loving Rocks es una plataforma de bodas de nivel empresarial diseñada con una verdadera arquitectura multiinquilino, bases de datos aisladas por inquilino e internacionalización integrada para escalabilidad global, seguridad y estabilidad operativa a largo plazo.","\u002Fuploads\u002F2026\u002F01\u002Fenterprise-grade-multi-tenant-architecture-for-an-international-platform-1769789121298-b6v7ak.webp","2026-01-30T12:04:00.000Z",{"id":3604,"slug":3605,"title":3606,"excerpt":3607,"featuredImage":3608,"publishedAt":3609},"479","where-does-an-llm-get-its-data-rag-data-sources-in-python","¿De dónde obtiene sus datos un LLM? Fuentes de datos RAG en Python","Un LLM no conoce mágicamente tus archivos, bases de datos o APIs. Esta continuación práctica de la serie RAG muestra, con Python sencillo, cómo los datos externos se convierten en evidencia recuperable: desde archivos de texto y SQL hasta búsqueda de texto completo, embeddings, ensamblaje de contexto y la llamada final al LLM.","\u002Fuploads\u002F2026\u002F09\u002Fwhere-does-an-llm-get-its-data-rag-data-sources-in-python-1790517200521-nfsi5i.webp","2026-09-27T05:51:00.000Z","fallback",[],[]]