What Is an MCP Host?

📘 The application side of the arrangement

The host is the application a person actually opens — the editor, the chat client, the agent runner. In the protocol’s arrangement it is the party that runs clients: one client per server connection, each maintained for the life of a session. Nothing else has that job, which is why the role carries a name of its own even though no separate process usually corresponds to it.

Three responsibilities sit with the host and nowhere else. It manages connections: starting them, performing the opening handshake through its clients, noticing when one goes away. It decides which of the connected capabilities are made available for a given exchange, out of everything its servers have advertised. And it mediates — results come back to the host, and the host decides what reaches the conversation, in what form, and whether it reaches it at all.

The host is also where consent lives. A server that publishes an operation with side effects has no way to ask anyone anything; the request simply arrives and executes. Whether a person is shown that request first, and whether they can refuse it, is a property of the host application. Two hosts connected to the same server can behave completely differently on that point, and the specification does not settle it.

Two problems land on the host because there is nowhere else for them to land. The first is naming: two servers may publish an operation under the same name, having no knowledge of one another, and only the host can tell which of the two a request meant. The second is traffic in the other direction — a server may raise a request of its own, asking for an answer from the person or for work the host is able to do, and the host decides whether to satisfy it, refuse it, or ask first. Nothing at the far end of a connection can escalate past that decision, which is the point of routing everything through one application.

🧩 The configuration is the whole of the access

A host reaches the servers it has been told about and no others: an entry in a file, a setting inside the application, a record copied from somewhere else. There is no step in which a host learns of a server nobody configured, so that configuration is a complete and readable statement of what the application can touch through this protocol.

It is therefore the first thing to read when the question is what an agent had available to it, and the first thing to change when the answer is too much. It is also where the least examined decisions accumulate, because adding a connection is one line of configuration and nothing afterwards prompts anybody to revisit it.

📐 Host and client are not the same thing

A client is one connection and its session state, conforming to the protocol. A host is the application that owns clients, owns the interaction with a language model, and owns the interface a person sees. Collapsing the two is the most common way to misread a diagram of this protocol.

⚙️ How the Registry classifies configuring an agent host

Connecting a host to several servers and routing each call to the right connection is configuration and integration work against running processes, which the code modification class covers. On the order form's task class field, select Code modification, which covers writing, editing, refactoring, and testing code. That class has its own page at /tasks/code.

The Registry files this topic under one canonical task, fixed in advance and published here rather than generated per visit:

Configure an agent host application to connect to three MCP servers and route each tool call to the correct one.

That string, hashed once, is de684785df893c9c… — the first sixteen of sixty-four hex characters. An assessment ordered against a task of this kind is computed from the class, the wording submitted, and the permanent chart the Registry derives for the model configuration named on the order: its ascendant, its ruling planet, and the composite harmony that constrains the range of verdicts available to it. The whole derivation is published at /method.

The risk in host work is misrouting and over-offering: a call sent down the wrong connection, or a set of operations made available for an exchange in which none of them was appropriate. 4 risk factors are tracked for code modification tasks generally; an assessment reports 3 of them, selected by the submitted task's own seed rather than chosen. Their names, severities and descriptions are certificate content and are not published on a free page.

Get Assessment

📏 What this page does not claim

The Registry makes no representation that an assessment predicts the outcome of any task, and no assessment is validated against real-world results.

This page defines a term and states a classification. It publishes no verdict: the Registry does not test implementations, does not measure how often anything works, and has never run the canonical task above against any model. Which servers a host connects to, and what it asks a person to approve before an operation runs, are decisions of the application rather than of the protocol. The canonical brief fixes neither.

What is sold is a permanent, numbered assessment for one submitted task at one model configuration — a verdict on a seven-point scale, a recommended execution window, and, above the first tier, the risk factors the class tracks. EUR 1.90 Standard, EUR 4.90 Extended, and EUR 14.90 Full Chart, which adds the permanent chart for the configuration itself. Assessments from EUR 1.90; machine-readable at /pricing.json.

🔗 Related surfaces

← All MCP topics · The AFR-1 method · Code modification task class

Related topics: MCP client · MCP server · Security considerations

❓ Questions about an MCP host

What is an MCP host?

The application that runs MCP clients and mediates between them and a language model. It manages the connections, decides which advertised capabilities are available for a given exchange, and is where any human approval step lives.

What is the difference between a host and a client?

A client is a single connection to a single server, with its own session state and its own protocol conformance. A host is the application that runs those clients, holds the interaction, and decides what to do with what comes back. One host, many clients.

Does the specification say when a person must approve a tool call?

No. It defines how a call is made and answered. Whether a human sees it beforehand, and whether they can stop it, is decided by the host application, and two hosts connected to the same server may answer that differently.

What happens if two servers publish an operation with the same name?

The host resolves it. The servers have no knowledge of each other, so nothing at the far end of either connection can tell which one a request was meant for. Disambiguation is a property of the application holding both clients.