AI Agent & MCP Glossary
Plain-English definitions of the terms used across MCP servers, agent skills and AI agent security.
Jump to: Model Context Protocol (MCP) · MCP server · MCP host · MCP client · Tool (MCP) · Resource (MCP) · Transport (stdio, Streamable HTTP) · MCP Registry · Agent skill · SKILL.md · Progressive disclosure · AI agent · Agentic AI · Subagent · Agent2Agent protocol (A2A) · Prompt injection · Tool poisoning · Rug pull (MCP) · Tool shadowing · Supply-chain attack · Least privilege · Network egress · Security scan (AgenticMart)
Model Context Protocol (MCP)
The Model Context Protocol is an open standard, introduced by Anthropic in November 2024, that defines how AI applications connect to external tools and data. An app that speaks MCP can use any MCP server without a custom integration.
MCP server
An MCP server is a program that exposes tools, resources and prompts to AI applications over the Model Context Protocol. A local server runs on your machine with your permissions; a remote server runs on the internet and is reached over HTTP.
MCP host
An MCP host is the AI application the user works in, such as Claude Desktop, Claude Code, Cursor or VS Code. The host decides which servers to connect to and asks the user to approve tool calls.
MCP client
An MCP client is the connector inside a host that keeps one connection to one MCP server. A host with three servers runs three clients.
Tool (MCP)
A tool is an action an MCP server lets the model take, such as querying a database or creating a GitHub issue. Each tool has a name, a description and an input schema, all of which the model reads.
Resource (MCP)
A resource is data an MCP server makes available to read, such as a file, a document or a database record, identified by a URI.
Transport (stdio, Streamable HTTP)
The transport is how an MCP client and server exchange messages. Local servers usually use stdio (standard input and output); remote servers use Streamable HTTP.
MCP Registry
The MCP Registry is the official, community-run catalogue of publicly available MCP servers, which clients and directories can read from. Listing there is a metadata entry, not a security review.
Agent skill
An agent skill is a folder of instructions, scripts and reference files that teaches an AI agent how to do a specific job. The agent reads a short description of every installed skill and loads the full skill only when a task needs it.
SKILL.md
SKILL.md is the required file at the root of an agent skill: YAML frontmatter with a name and a description, followed by Markdown instructions. The description decides when the agent uses the skill.
Progressive disclosure
Progressive disclosure is how skills stay cheap: the agent first sees only each skill's name and description, then the SKILL.md body, and opens extra files or runs scripts only when needed.
AI agent
An AI agent is software in which a language model decides, step by step, which actions to take and which tools to call to reach a goal, observing the results as it goes. Coding agents, research agents and browser agents are common types.
Agentic AI
Agentic AI describes AI systems that act toward a goal with some autonomy, planning steps and using tools, rather than only answering a single prompt.
Subagent
A subagent is a separate agent instance that a main agent hands a task to, with its own instructions and context, and that reports back a result.
Agent2Agent protocol (A2A)
A2A is an open protocol, introduced by Google in 2025, for AI agents built by different vendors to discover each other and exchange tasks. MCP connects an agent to tools and data; A2A connects agents to other agents.
Prompt injection
Prompt injection is an attack in which text the model reads contains instructions that override what the user asked for. In indirect prompt injection, those instructions hide in a web page, file, email or tool result the agent processes.
Tool poisoning
Tool poisoning is prompt injection hidden in an MCP tool's description or schema. The model reads that metadata, so hidden instructions there can steer it even when the user never calls the tool.
Rug pull (MCP)
A rug pull is when an MCP server changes a tool's behaviour or description after the user has approved it, so the approval no longer matches what runs.
Tool shadowing
Tool shadowing is when one MCP server's tool descriptions change how the model uses another, trusted server's tools.
Supply-chain attack
A supply-chain attack compromises software through something it depends on, such as a malicious package, a typosquatted name or a hijacked maintainer account, instead of attacking the user directly.
Least privilege
Least privilege means giving an agent or tool only the access it needs for the task: scoped API keys, read-only where possible, limited folders and no network unless required.
Network egress
Network egress is the outbound connections a program makes. Checking egress shows whether an MCP server or skill talks to domains it never declared, a common sign of data exfiltration.
Security scan (AgenticMart)
An AgenticMart security scan runs one pinned commit in an isolated machine and checks static code patterns, leaked secrets, dependency vulnerabilities, build and boot, and network egress, then publishes the report.