MCP client / host

The host is the user-facing application (an IDE, a desktop assistant, an agent runtime). Inside it, one client is created per connected server. The client performs the capability handshake, forwards the model's tool calls to the right server, and returns results. The host is also where security controls live: user approval prompts, tool allowlists, sandboxing of local servers, and any filtering of server content before it reaches the model.

Why it matters

The client is the only place with full context — it sees every server, every tool description, and every result. That makes it the right place to enforce policy and the most damaging place to get policy wrong. Many documented MCP attacks succeed because the client presents server-supplied text to the model (or to the user's approval dialog) without treating it as untrusted.