MCP & Tool-Use Vocabulary: 2026 reference.

The Model Context Protocol stabilized fast — fast enough that the terminology stopped fragmenting almost as quickly as it appeared. Anthropic, OpenAI, Microsoft, and the framework layer (LangChain, CrewAI, AutoGen) now agree on the canonical terms.

This reference holds 120 terms across six sections: core MCP primitives, transports and sessions, tools and function vocabulary, agent loop terminology, governance and security, and the ecosystem and framework wrappers. Each entry has a plain-language definition, a worked example, and a citation to the spec at modelcontextprotocol.io.

Use this as a translation table when you encounter framework- specific aliases ("function" vs "tool," "session" vs "client," "channel" vs "transport"). The MCP terms are the canonical ones; framework wrappers translate.

The four MCP-defined capabilities are the foundation of the protocol. Every MCP server exposes one or more; every MCP client consumes them. These are the canonical 2026 terms.

MCP server. A process that exposes one or more primitives (tools, prompts, resources, sampling) via the MCP transport. Servers are language-agnostic; reference implementations exist in TypeScript, Python, Rust, Go, and Java.

MCP client. A consumer of MCP servers, typically embedded in an agent runtime. Examples: Claude Desktop, OpenAI Agents SDK, LangChain's MCP integration. The client handles handshake, capability negotiation, and tool-call routing.

Primitive. One of the four capabilities defined by the MCP spec: tools, prompts, resources, sampling. The unit servers advertise and clients consume.

Tool primitive. A typed function the agent can call. Defined by name, JSON Schema for inputs, and a description. The most-used primitive — most MCP servers exist primarily to expose tools.

Prompt primitive. A parameterized prompt template that the server provides. Lets the server ship reusable high-quality prompts (extraction templates, classification rubrics) instead of each client rolling their own.

Resource primitive. A read-only data stream the server exposes — file, URL, database snapshot, or arbitrary stream. Resources are attached to context on demand; distinct from tool results.

Sampling primitive. A reverse capability where the server asks the client to run an LLM completion on its behalf. Critical for governance: the client controls model choice and API keys.

Root. The base URI that anchors a resource namespace. For filesystem servers, the root directory; for HTTP servers, the base URL. Roots define the security boundary.

Capability. A flag in the MCP handshake that advertises support for a specific feature (e.g., tool listing, prompt streaming, resource subscription). Distinct from primitive — primitives are top-level capabilities; sub-features are nested.

Capability negotiation. The handshake step where client and server exchange supported capabilities. Servers advertise what they offer; clients pick what they consume. The result of negotiation determines what's available in the session.

How clients and servers actually communicate. Three transports exist; pick by deployment shape.

stdio transport. Standard input/output communication for local processes. The client launches the server as a subprocess and exchanges JSON-RPC messages over stdin/stdout. Default for local-only servers (filesystem, git, sqlite).

HTTP+SSE transport. Server-Sent Events over HTTP for remote servers. The original remote transport in MCP spec v1; superseded by Streamable HTTP for new deployments. Still supported for backward compatibility.

Streamable HTTP transport. The current production-recommended remote transport. Single HTTP connection with bidirectional streaming. Better proxy and infrastructure compatibility than SSE.

JSON-RPC. The wire-protocol format MCP uses for all messages — request, response, notification. JSON-RPC 2.0 spec. Standardizes message shape across transports.

Session. A connected client-server lifecycle. Begins with handshake and capability negotiation; ends with disconnect. Multiple primitives may be exercised within one session.

Initialize. The first request in a session, sent by the client. Includes protocol version, client info, and the client's supported capabilities.

Initialized notification. The acknowledgement from the client after the server responds to initialize. Marks the session as ready for primitive calls.

Ping. A heartbeat message to verify the connection is alive. Optional in MCP spec; common in production for long-lived sessions.

Notification. A one-way JSON-RPC message that doesn't expect a response. Used for state-change announcements (resource updated, tool list changed).

Subscription. A long-lived registration where the client receives notifications when a resource changes. Not all servers support subscription; advertised via capability.

Cancellation. A client-initiated request to abort an in-flight operation (typically a long-running tool call). Servers should respect cancellation promptly.

Progress notification. A server-to-client message reporting incremental progress on a long-running operation. Lets the client surface a progress UI.

The most-used primitive deserves its own deeper vocabulary section. These are the terms that come up in every tool-design review.

Tool. A typed function the agent can call. The successor to "function call" and "plugin" terminology. Defined by name, input schema, and description.

Tool call. One invocation of a tool. Structured JSON request from model to runtime. Multiple tool calls may run in parallel within one agent step.

Tool result. The structured response returned after a tool executes. Distinct from the model's interpretation of that result in the next turn.

Tool schema. The JSON Schema definition of a tool's inputs (and optionally outputs). The contract: the model uses it to construct calls; the runtime uses it to validate and route.

Tool description. The natural-language description of what the tool does, included in the model's context. Often more important than the schema for getting the model to call the tool correctly.

Tool name. A short identifier for the tool. Conventionally snake_case. Must be unique within a tool set.

Tool annotation. Optional metadata that hints at tool behavior (read-only vs side-effect-causing, idempotent vs non-idempotent, destructive). Lets clients apply governance rules.

Tool error. A structured error response from a tool — distinct from a runtime exception. Tool errors are returned to the model so it can attempt recovery.

Tool retry. Re-executing a failed tool call. Standard agent loops retry on transient errors with exponential backoff; permanent errors should be surfaced for plan revision.

Parallel tool calls. Multiple tool calls issued in a single agent step, executed concurrently. Reduces latency for independent calls. Anthropic and OpenAI both support parallel calls natively.

Tool call hallucination. The model invokes a tool that doesn't exist or with malformed arguments. Mitigated by schema enforcement, tool annotation, and clear descriptions.

Tool selection. The model's decision about which tool to call given the available set. Quality of selection depends on description specificity and tool-set curation.

Tool gating. Filtering the visible tool set for a given step based on context (only show file tools when handling file tasks). Reduces selection error and context cost.

How MCP fits inside an agent's runtime control flow. These are the terms agent-orchestrator authors use when wiring MCP into their loops.

Agent loop. A bounded iteration that reads context, calls tools (often via MCP), observes results, and decides next action. MCP tool calls are one event class within the loop.

Tool catalog. The full set of tools advertised by all connected MCP servers in a session. Combined into a single context block visible to the model.

Tool routing. The runtime's decision about which MCP server should handle a given tool call. Identified by the unique tool name in the catalog.

Server multiplexing. A single client connecting to multiple MCP servers concurrently. Standard for agent runtimes — most agents have 5-15 connected servers.

Composition. Combining outputs from multiple MCP servers in one agent step (read from filesystem server, write to GitHub server). The pattern that makes MCP useful at agent scale.

Permission model. The runtime's policy for which tools are allowed without user confirmation versus which require approval. Often informed by tool annotations.

Confirmation gate. A prompt to the user before executing a destructive or irreversible tool call. The standard governance pattern for write-side tools.

Auto-approve. A configuration that bypasses the confirmation gate for designated tools. Used for read-only or idempotent tools.

Tool budget. A maximum number of tool calls allowed in a single agent loop. Prevents runaway loops; common range is 20-50 per task.

Latency budget. A wall-clock ceiling for the agent loop. Tool calls that exceed the budget are cancelled or backgrounded.

How MCP deployments are secured and governed at enterprise scale. The vocabulary here matches the broader AI-governance language but takes on MCP-specific shape.

Tool allowlist. An explicit list of tools the agent is permitted to call. Default-deny security pattern.

Tool blocklist. An explicit list of forbidden tools. Default-allow security pattern; weaker than allowlist but useful for surgical exclusions.

Server allowlist. An explicit list of MCP servers the client may connect to. Standard enterprise control for managed agent deployments.

Auth token. A bearer credential used by remote MCP servers (Streamable HTTP transport). Typically OAuth or session-based. Stdio servers don't need tokens.

OAuth flow. The MCP-spec-recommended authorization pattern for remote servers. Standardized in 2025 spec update; most major MCP servers support it.

Capability denial. The client refusing to negotiate a server-offered capability — typically for security-sensitive primitives like sampling.

Sandbox. An isolated runtime in which tool calls execute, restricted in filesystem, network, and process access. Standard for executing untrusted server code.

Tool-call audit log. A persistent record of every tool call (server, tool, args, result, timing). Required for SOC 2, HIPAA, and most regulated deployments.

PII redaction. Stripping or masking personally-identifying information from tool calls and results before audit logging or downstream model exposure.

Prompt injection mitigation. Defenses against tool-result content that contains adversarial instructions. Standard mitigations: structured-result schemas, instruction hierarchy, content scanning.

How MCP shows up across the agent-framework layer. Each framework wraps MCP slightly differently; this section maps their terms back to canonical MCP terminology.

Smithery. An MCP server registry and distribution platform. Hosts hundreds of community MCP servers; includes one-click install for most agent runtimes.

Glama. An MCP-server discovery and management platform. Indexes servers by capability and vendor.

PulseMCP. A directory and changelog for MCP servers. Tracks version history and capability changes.

MCP gateway. A reverse-proxy server that aggregates multiple downstream MCP servers behind a single endpoint. Used for centralized auth, logging, and rate-limiting. Cloudflare's MCP gateway is the canonical example.

OpenAI Agents SDK MCP integration. Built-in MCP client support in the OpenAI Agents SDK (Python, TypeScript). Maps OpenAI's "function" terminology onto MCP "tool" via the SDK's adapters.

LangChain MCP client. LangChain's MCP integration as a tool provider. Connects to any MCP server and exposes its tools to LangGraph or LangChain agents.

Claude Desktop MCP. Anthropic's reference MCP client implementation, embedded in Claude Desktop. The de facto test bed for new MCP servers.

VS Code MCP. The MCP integration in VS Code (and forks like Cursor). Lets coding-agent extensions consume arbitrary MCP servers.

Microsoft Agent Framework MCP. The MCP support in Microsoft's Agent Framework (.NET, Python). Includes runtime governance and audit log integration.

MCP working group. The cross-vendor body that stewards the MCP specification. Members include Anthropic, OpenAI, Microsoft, and major framework maintainers as of 2026.