MCP server

How it works

The Model Context Protocol connects model applications to outside data and tools over JSON-RPC 2.0. Its specification names three roles, and keeping them apart is most of understanding the term. Hosts are the applications that initiate connections — a chat application, an editor, an agent framework. Clients are the connectors inside a host, one per server. Servers are the processes that provide context and capabilities.

A server may offer three kinds of thing: resources, described as context and data for the user or the model to use; prompts, templated messages and workflows for users; and tools, functions for the model to execute. Financial servers are almost entirely the third — a set of callable operations such as fetching a quote or a filing, each with a schema the client reads at connection time. That is the actual gain over the REST API underneath: nobody writes a client, and one question can cross several tools without a script joining them.

Two things about the plumbing decide whether a given client can talk to a given server at all.

The transport. Two standard ones are defined. With stdio the server runs as a subprocess the client launched, speaking newline-delimited messages over its standard streams — the process is on your machine, holding your key. With Streamable HTTP each message is posted to one HTTP endpoint and replies arrive as a JSON object or a request-scoped stream — the server is somewhere else, run by somebody else. The semantics are identical across both, so this is a deployment and licensing decision rather than a functional one.

The revision. Protocol versions are dates, not numbers: identifiers are in YYYY-MM-DD form "to indicate the last date backwards incompatible changes were made", and the revision current when this page was last checked was 2026-07-28. That string is what to look for in a server's documentation and in a client's release notes, because a mismatch is the ordinary reason a correctly configured server does not appear.

What it is not

Four things the word does not mean, each of which is a mistake somebody has made on the strength of it.

Not a data licence. The protocol moves data into a chat window; it grants nothing. A server wrapping a vendor's API needs that vendor's key and inherits that vendor's terms exactly. Financial MCP servers, and the licence behind them works through what three exchanges have published about AI use, which is the part with a bill attached.

Not a hosted API. A server is a component you install or point at, not a service with its own coverage, uptime or pricing. Where a card lists both an API and a server, they are one product and one subscription with two front doors.

Not an agent. The server exposes tools and answers calls. The host decides which servers are connected, which tools the model sees, and whether a person is asked before one is invoked — and the specification is blunt that it "cannot enforce these security principles at the protocol level". It also warns that descriptions of tool behaviour "should be considered untrusted, unless obtained from a trusted server". The judgement lives in the host, not in the server.

Not a change to what the data costs. A delayed feed read through a server is still delayed. A quote that was display-use on a screen may be something else once a process consumes it, which is the non-display use question, and a quote that reaches somebody who is not you is the redistribution one. Neither is altered by the protocol carrying it.

Why it matters here

This is the most-used phrase in the catalogue, and it is used about cards that differ in ways the phrase hides. Three checks before treating two servers as comparable.

Read-only or not. SEC EDGAR MCP reads a public source and needs no key. SnapTrade's server is read-only and scoped to accounts. QuantConnect's can create projects, run backtests and deploy live algorithms. The failure modes that are tolerable against a read tool are not tolerable against a write one, and the category listing at MCP servers and AI agents marks which is which.

Where it runs, and therefore who sees your key and your queries. A server you host exposes the data to one third party, the model provider that has to see a tool result to answer. A hosted server adds a second party, who holds your key. For anything licensed that is the decision rather than a detail; OpenBB running locally over your own provider keys is the shape to compare against.

Whether a server is the whole product or an accessory to one. Every card in the catalogue that ships one is listed at tools with MCP, and for most of them the server is a feature of a subscription that existed first. A server is a dependency, chosen the way any dependency is: what it wraps, who maintains it, and which protocol revision it tracks.