What do MCP and AI agent terms mean? A plain English glossary of 20

MCP and AI agent terms are easier to learn in groups: the parts that do the work, the ways they connect, the ways they fail, and the controls that keep them safe. This glossary defines twenty of them in plain English, with a small example for each.

TL;DR

• Read the groups in order. Each builds on the one before it.
• The terms that matter most for safety are tool, permission, prompt injection, least privilege, and audit log.
• A table at the end shows which control answers which problem.
• Bookmark this page and share it with anyone new to the topic.

Definition box. MCP stands for Model Context Protocol. Its introduction calls it an open source standard for connecting AI applications to external systems, and compares it to a USB-C port: one standard way to plug many things in. An AI agent is a program built around a language model that picks its own steps and uses tools to finish a task.

Which terms describe the parts that do the work?

1. Language model. The AI engine that reads text and writes text. Example: the model behind a chat assistant. On its own it cannot do anything except produce words.

2. AI agent. A program that wraps a model in a loop so it can choose steps and use tools. Anthropic describes agents as systems where models dynamically direct their own processes and tool usage. Example: an assistant that reads your calendar, finds a free hour, and books it.

3. Workflow. A fixed series of steps written by people, where a model may do some of the steps. Example: a script that reads a form, asks a model to summarize it, and files the summary. The path is set in advance.

4. Tool. An action the model may ask for, such as search, read a file, or create a ticket. In MCP, a tool has a name, a description, and the inputs it accepts.

5. Tool call. One request to use a tool. Example: "read ticket 481." The model asks, and software carries it out.

Which terms describe how things connect?

6. Host. The AI application you use, such as a chat app or coding assistant. In the MCP design, the host creates and manages clients and controls connection permissions.

7. Client. The piece inside the host that holds one connection to one server.

8. MCP server. A program that offers tools, data, or prompts to an AI application over MCP. It can run on your computer or on the internet. Example: a server that lets an assistant search your documents.

9. Local server and remote server. A local one runs on your own machine, with the same privileges as the app that started it. A remote one runs elsewhere and is reached over the internet. They carry different risks, which is why the MCP security guidance treats them separately.

10. Transport. The way messages travel between client and server. Two common choices are standard input and output for local servers, and streamable HTTP for remote ones.

Which terms describe how things fail?

11. Prompt injection. OWASP says a prompt injection vulnerability occurs when prompts alter a model's behavior or output in unintended ways. Example: a web page with hidden text that tells the assistant to ignore your request.

12. Indirect prompt injection. The version where the bad instructions arrive inside content the model reads, such as a website or a file, rather than from the user. This is the form that matters most for agents.

13. Agent hijacking. NIST describes this as a type of indirect prompt injection where an attacker inserts malicious instructions into data that an agent may ingest, so the agent is steered to do something else.

14. Excessive agency. OWASP's name for a system doing damaging actions because it has too much functionality, too many permissions, or too much autonomy. Example: a summarizing assistant that can also delete mail.

15. Confused deputy. A trusted program tricked into using its authority for someone who should not have it. The MCP security guidance describes how a proxy server can be exploited this way when it skips proper user consent.

Which terms describe the controls?

16. Permission and scope. A permission is something an account may do. A scope is a named bundle of permissions in a sign in system. Example: "read files" is narrower than "all files."

17. Least privilege. Give an account only what it needs for its job and nothing more. The MCP guidance describes a progressive model that starts with a minimal set of scopes.

18. Human in the loop. A person who can approve or deny an action before it happens. The MCP tools specification says there should always be a human in the loop with the ability to deny tool invocations.

19. Guardrail. A rule or checkpoint that keeps a system within set limits. An MCP guardrail applies this to the traffic between an agent and its servers.

20. Audit log. A record of what happened: which agent, which tool, what inputs, what result, and when. The MCP specification says clients should log tool usage for audit purposes.

Which control answers which problem?

Worked example: reading a sentence with the glossary

Here is an invented sentence from a vendor email. "Our agent connects to your MCP servers with scoped access and a human in the loop, and every tool call lands in an audit log."

Translate it:

1. "Agent" means a program that chooses its own steps.
2. "Connects to your MCP servers" means it uses the standard plug to reach your tools and data.
3. "Scoped access" means it only has the permissions it needs, which is least privilege.
4. "Human in the loop" means a person can approve or deny actions.
5. "Every tool call lands in an audit log" means each request is recorded.

Now ask the follow ups the sentence does not answer. Which scopes, exactly? Which actions need approval? How long are logs kept, and who can read them? The glossary does not make the claim true, but it helps you ask the right next question. If you want a ready list, see AI security buying glossary: twelve terms and what is an MCP connector: host, client and server for buyers.

How should you use this glossary?

1. Read one group a day for four days.
2. After each group, pick one term and look for it in your own tools. For example, find a tool call in a log.
3. Share the table with the person who approves new tools.
4. Add your own terms as you meet them.

Where does Safeguard fit?

Safeguard offers MCP Guardrail, which governs traffic between agents and MCP servers, and agent identity, which tracks which agent holds what access at what level. Asset discovery helps find agents and servers in use, and policies and gates let you set rules and enforce them. You can try the free scan at gold.safeguard.sh/scan.

Try it yourself

In the demo, watch an MCP server get set up and connected. Try to point at the host, the client, the server, and a tool as they appear.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• What is the Model Context Protocol (MCP)?
• Building effective agents (Anthropic)
• MCP architecture
• MCP tools specification
• MCP security best practices
• OWASP LLM01 Prompt Injection
• OWASP LLM06 Excessive Agency
• NIST CAISI technical blog on agent hijacking evaluations

Last reviewed: 19 October 2026.