An MCP server is the program that offers tools and data to an AI app using MCP. It exposes the capabilities, like "view appointments" or "create a booking"; the app discovers them through its MCP client and the model asks to use them. What the server does not expose or authorize, the agent cannot do through it.
A question from the app. Pick an answer.
The agent only needs to read the stock. What access do you give it?
"Just in case" is exactly the case: if it can write, one mistake changes real data.
It will not get stuck, but it will not stop either. With admin access, one mistake reaches everything.
The minimum for the task. If it needs more tomorrow, you expand it on purpose.
A dental clinic keeps its appointments in a system and someone builds an MCP server for it. That server is the one that knows there is a free slot on Tuesday at 10 and the one that offers the "view open slots" tool. The AI app, for example a coding agent or a chat, does not bring that tool: it uses its MCP client to ask the server what it offers.
The model does not have it built in either. It does not know which slots exist: it can ask to use the tool, and the answer comes from the server. If the clinic adds "cancel an appointment" tomorrow, it adds it to the server, not the model. The big picture of the protocol is in what MCP is; this page is about the piece that does the offering.
When a remote server connects with a token, there are two separate switches. Scopes say what that token authorizes, and the server checks them on every call. Active tools, which you turn on or off in the app, say what the agent tries from there. Scope names vary by service, but the logic is the same.
Example: you connect an email server so the agent can summarize the inbox every morning. When you connected it, it asked to read and send, and you accepted everything. Later you turn off the send tool in the app. The agent no longer sends, but the token still authorizes sending: if someone copies it and calls the server directly, the server complies. To make it read only, revoke that access and authorize reading only.
"The model already comes with those tools." No: the server offers them. "It is a well known server, so it is safe." A famous server with full access can still delete everything; what matters is what you allow. "I built it for one app, so it only works there." MCP is a standard: the same server can work with other compatible apps, though each may support more or fewer features.