Glossary · MCP Five

Where a term has a page of its own, the definition links to it.

The protocol

MCP: The Model Context Protocol. An agreed shape of JSON-RPC message between an AI application and the services it wants to reach — so ten apps and ten services need twenty integrations rather than a hundred.
host: The thing that owns the conversation with the model, wrangles several servers, and runs the loop. Claude Code, Cursor and ChatGPT-with-plugins are all hosts. →
client: The piece that speaks to exactly one server. In this series it is hand-written — about 200 lines of fetch. →
server: Offers tools and waits. Never initiates. →
protocol era: Which revision of MCP a connection is speaking. The legacy era negotiates once at initialize; the modern era (2026-07-28) is selected per request via a _meta envelope and has no server→client channel. →

tool: A verb. Something to do, which the model decides to invoke. →
resource: A noun. Something to read, addressed by URI, which the host decides to show the model.
prompt: A saved fill-in-the-blank instruction that a human picks from a menu. An offer, never spliced straight into the model's conversation.
sampling: The server asking your host to run a model call. It has no API key and no model — it has yours. →
elicitation: The server asking your user a question mid-call. Costs no money; spends attention.

agent loop: Send the conversation and the tool list to the model; append its whole reply; if it asked for a tool, run it, paste the result back, and go again. That is all an agent is. →
iteration: One trip around that loop — one full API call with a conversation that is bigger than last time. Capped at 10 throughout this series.
tool_use / tool_result: The request block the model emits, and the block you send back. Every tool_use needs exactly one matching tool_result or the API rejects the whole request — including when the answer is “denied”. →
namespacing: Rewriting every tool name as server__tool on the way out, so two servers can both offer secret_code. Split it back apart with indexOf, not split. →
local tool: A tool the host implements itself rather than fetching from a server. Runs with your host's privileges, which makes it a security boundary. →

approval gate: A host-side list of what needs a human before it runs. Reads arguments, not just tool names, and never reads the server's own destructiveHint. →
destructiveHint: An annotation a server can set on its own tool. Genuinely useful for a human skimming a list or a UI picking an icon. Not a permission model, because a server that wants to bypass your gate would simply set it to false.
default-allow: Unmatched tools run without asking. Deliberately chosen here, because a gate that prompts about roll_dice trains you to click Approve within ninety seconds. →
eval: A prompt plus a check. Never assert on prose; run each case several times and score a pass rate; include a case where the right answer is calling nothing. →
replay: Reading a stored run back from its trace_events rows. No model call, nothing re-executed, nothing charged. →

sub-agent: A tool that happens to think. The model gets one extra tool whose implementation is the loop that is calling it. →
orchestrator: The agent that holds the plan and hires the workers. It receives each worker's forty-second investigation as one paragraph in an ordinary tool_result, and has no idea an agent produced it.
origin: Who asked, and why — carried up with a bubbled approval so the human is not rubber-stamping a decision they cannot see. →
partial_results: Finished siblings' reports, stored so that approving does not re-run the workers that already completed.
paused_children: A frozen worker's entire messages array, without which there is nothing left to say yes to.

TreeBudget: One token allowance shared by reference across an agent tree, so “the whole run stops at 600,000 tokens” is true rather than approximately true. →
spend gate: A ceiling on the estimated cost of a sampling request, per server. Refuses synchronously; a human's grant lands on the next attempt. →
ledger: A row for every model call a server asked for — allowed and refused. A ledger with no refusals in it is indistinguishable from a gate that is switched off.
prompt caching: A prefix match on the unchanging head of your request. One breakpoint on the system block cut project #2's input cost 47%. Interpolate a timestamp into the prefix and every hit silently becomes a miss. →
cache read / cache write: A cache read costs about a tenth of a fresh token; a write costs a little more than one. Report both, because input_tokens is only what you paid full price for.
input_tokens: Only the uncached remainder. The real prompt size is input + cache_creation + cache_read, and forgetting that is how two runs get compared on the wrong number.

multi-round-trip: How sampling and elicitation work in the modern era. Round 1 answers input_required; the host does the work; round 2 calls the same tool again with the answer. Needs no held-open connection, which is exactly why it replaced the push. →
input_required: The resultType a server returns instead of a result, meaning “I need something from you before I can finish.”
requestState: An opaque string the server mints and the client echoes back. It travels through a boundary you do not control, so the server must integrity-protect it — the SDK does not. →
−32020 / −32021 / −32022: Headers and body disagree · a capability was not declared · unsupported protocol version. →