THE SHORT ANSWER
An API exposes operations in another system. A tool definition tells a model what an allowed operation does and which arguments it accepts. A connector packages authentication and integration logic. MCP is a client-host-server protocol through which servers can expose tools, resources and prompts. None of these layers replaces permission checks or application control.
Separate the connection layers
| Layer | What it provides | What it does not decide |
|---|---|---|
| API | A programmatic operation or data interface | Whether a model should use it |
| Tool definition | A name, description and input contract | Whether a proposed call is authorised |
| Connector | Packaged access to a service or account | Which actions are appropriate for this task |
| MCP | A protocol for clients and servers to exchange capabilities and context | Trust, business policy or automatic safety |
| Host application | Orchestration, identity, policy and user interaction | The model's task-specific judgment |
Evidence & context: OpenAI Developers · Model Context Protocol
MCP standardises discovery and exchange
In the current MCP architecture, a host manages clients, and each client maintains a connection to a server. Servers can declare capabilities and expose tools, resources or prompts. Tool definitions include names and input schemas; a client can list and call them through protocol messages.
This creates a common interface, not a universal trust decision. Hosts remain responsible for consent, security boundaries and which information reaches a server. The official specification also says tool annotations should be treated as untrusted unless the server is trusted.
Evidence & context: Model Context Protocol · Model Context Protocol
Bind connection to identity and purpose
- Authenticate the user or service without placing secrets in model context.
- Request only the scopes needed for the current capability.
- Distinguish read, draft and execute permissions.
- Validate that credentials are intended for the receiving service.
- Show consequential proposals before execution and record approval.
- Treat server content and tool descriptions as untrusted input.
Authorization standards evolve, so implementations should follow the current protocol and service documentation. The durable principle is narrower: a connection transports a capability; it does not grant the agent unlimited authority.
Evidence & context: Model Context Protocol · Model Context Protocol
Illustrative example: calendar scheduling
A calendar API can list availability and create events. A connector may handle the user's account authorization. An MCP server could expose separate read-availability and create-event tools. The host gives the model the read tool first, validates returned times and only exposes or executes the write tool after the user approves recipients, time and title.
Sources & further reading
- Using tools
OpenAI Developers. Official documentation showing how models can be given built-in, function and remote tools. Checked 13 September 2026; product-specific tool names and availability can change.
- Function calling
OpenAI Developers. Official documentation for model-selected function calls. The application, not the model, executes custom functions and must validate arguments, permissions and results.
- Model Context Protocol architecture
Model Context Protocol. The official protocol architecture checked 13 September 2026. It describes hosts, clients, servers and capability negotiation; it does not make every connected tool safe or appropriate.
- Model Context Protocol tools
Model Context Protocol. The current official tools specification checked 13 September 2026. Draft details can change; OpenSkool relies on the durable separation between tool discovery, model selection and host-controlled execution.
- Model Context Protocol authorization
Model Context Protocol. Official authorization requirements and security considerations. Authentication and authorization remain implementation responsibilities; protocol support is not permission to expose a capability.
Examples and exercises are illustrative unless attributed to a source. No independent expert review is claimed.
A correction, a counterexample or an experience worth sharing?
Join the conversation ↗