AI went from talking to doing · mcp-audit Academy

Not long ago an AI assistant answered questions in a chat box. If it was wrong, you got a wrong answer. Today's coding agents, like Claude Code, Cursor and GitHub Copilot, edit your files, run terminal commands, open pull requests and talk to other services. If one of them is tricked, the result is an action: a file read, a message sent, a command run.

That jump from talking to doing is the security story of the AI revolution.

MCP in one paragraph

MCP (Model Context Protocol) is an open standard for connecting an AI agent to tools. Think of it as USB-C for AI: one standard plug, thousands of things you can connect. Each connection is an MCP server, a small program that gives the agent one kind of ability, such as reading a folder, querying a database or posting to Slack.

You add a server by adding a few lines to a config file. This one gives an agent access to a projects folder:

claude_desktop_config.json

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/demo/projects"]
    }
  }
}

Read it in plain words: “Download the package called server-filesystem and run it, with access to my projects folder.” That program now runs on your computer with your permissions, and the agent decides when to use it.

How does the agent decide? Each server describes its tools in text, such as “Reads a file from disk.” The agent reads those descriptions and believes them.

Key ideaAn MCP config is not a settings file. It is a list of programs your AI may run, plus descriptions it will trust.

Under the hood: transports, tool lists and other instruction surfaces

Transports. A stdio server is a local process the client launches from command + args; it inherits your user's file and network access. A remote server is reached over HTTP or SSE at a url, often with headers carrying tokens.

Tool listing. On connect the client calls tools/list. Every tool's name, description and input schema (parameter descriptions, enums, defaults) goes into the model's context. All of it is model-readable text, and all of it can carry instructions.

Config dialects. VS Code uses a "servers" root key; most other clients use "mcpServers"; Codex uses TOML [mcp_servers.*] tables; Gemini CLI allows comments. Files live at user level and inside repositories (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, .codex/config.toml and others).

Beyond MCP. Agents also obey instruction files: CLAUDE.md, AGENTS.md, skills, Cursor rules, Copilot instructions, subagent definitions and hooks. Same trust problem, different file.

Check yourself

1. What is an MCP server?

2. How does an agent decide when to use a tool?

3. Adding a server to your config is closest to…