Архитектура Model Context Protocol — Host, Client, Server в экосистеме ИИ 2026

2026 MCP Model Context Protocol: почему MCP — HTTP-стандарт эры ИИ — техническое руководство

12 июня 2026. Model Context Protocol (MCP) — открытая спецификация agent↔tool на базе JSON-RPC 2.0 — прошла путь от репозитория Anthropic до инфраструктурного слоя с поддержкой OpenAI (январь), Google (февраль), Microsoft (Copilot Studio, VS Code) и governance в Agentic AI Foundation (AAIF). В реестрах — более 10 000 MCP-серверов. Этот hardcore-разбор: проблема N×M, трёхуровневая архитектура Host / Client / Server, wire-level детали STDIO и HTTP+SSE, таблица MCP vs REST, границы безопасности, протокол A2A, экономия интеграций 38–55 % и пять шагов деплоя MCP Server на удалённом Mac 7×24.

1. N×M интеграций: combinatorial explosion

Пусть N — число AI-хостов (Cursor, Claude Desktop, OpenClaw, Copilot, internal agents), M — число backend-tools (Git, Postgres, Slack, Jira, …). Без стандарта каждая пара требует адаптер: O(N×M) connecter code + тесты + документация. Это тот же класс проблем, который HTTP решил для web-клиентов в 1990-х.

MCP сжимает граф до O(N+M): один MCP Server на tool, все conformant clients вызывают tools/list + tools/call. Early adopters (Q2 2026) фиксируют 38–55 % сокращение integration effort — за счёт переиспользования server binary, а не магии LLM.

2. USB-C analogy — один connector, many hosts

MCP — не «ещё один REST wrapper». Это typed tool registry: каждый tool описан JSON Schema (inputSchema), host discovery через tools/list at runtime. Аналогия USB-C: physical connector = transport (STDIO | HTTP+SSE); protocol = JSON-RPC method namespace.

3. Host / Client / Server — process boundaries

  1. Host — процесс с LLM (Cursor IDE, Claude Desktop, OpenClaw gateway). Держит model context, routing tool calls, UI/session state.
  2. Client — MCP client SDK внутри host. Управляет session lifecycle: initialize → capability negotiation → multiplexed requests к одному или нескольким servers.
  3. Server — отдельный процесс (STDIO) или HTTP endpoint. Implements tools/list, tools/call; опционально resources/*, prompts/*.
Host process (PID 1000)
├── LLM inference / agent loop
├── MCP Client lib
│   ├── session[postgres] ──stdio──► MCP Server (PID 1001) npx @mcp/server-postgres
│   ├── session[git]      ──stdio──► MCP Server (PID 1002) uvx mcp-server-git
│   └── session[remote]   ──HTTP───► https://127.0.0.1:3001/mcp (SSE stream)

OpenClaw: MCP servers — child processes gateway; утечки PID после hot reload — см. runbook stdio leaks + gateway restart.

4. Wire format: JSON-RPC 2.0, STDIO, HTTP+SSE

Все сообщения — JSON-RPC 2.0 objects. Request: {"jsonrpc":"2.0","id":N,"method":"...","params":{...}}. Notification — без id. Response: result или error.

Core methods (tools capability):

  • initialize / initialized — protocol version, clientInfo, serverInfo, capabilities bitset
  • tools/list — paginated tool catalog; each tool: name, description, inputSchema (JSON Schema draft)
  • tools/call — params: {name, arguments}; result: {content: [{type:"text"|"image"|..., ...}], isError?}
  • ping — keepalive
Transport Framing Server→Client push Prod notes
STDIO Newline-delimited JSON (one object per line) on stdin/stdout Notifications on stdout same stream Trust boundary = parent process; zombie children if gateway doesn't reap
HTTP + SSE POST /message for client→server; GET /sse opens event stream SSE events carry JSON-RPC responses/notifications Require TLS, auth (OAuth/mTLS/API key), idle timeout, reverse proxy WS/SSE tuning 
// Client → Server (tools/call)
{"jsonrpc":"2.0","id":42,"method":"tools/call","params":{
  "name":"query_database",
  "arguments":{"sql":"SELECT id, title FROM docs LIMIT 10"}
}}

// Server → Client
{"jsonrpc":"2.0","id":42,"result":{
  "content":[{"type":"text","text":"[{\"id\":1,\"title\":\"MCP spec\"}]"}],
  "isError":false
}}

inputSchema валидируется на server side до execution — не полагайтесь на LLM для type safety. Invalid args → JSON-RPC error или isError: true в result.

5. MCP vs REST — decision matrix

Axis REST / OpenAPI 3.x MCP / JSON-RPC 2.0
Consumer Human devs, mobile, services LLM agents, MCP hosts
Discovery Static OpenAPI YAML Dynamic tools/list each session
Invocation GET/POST + URL paths tools/call by tool name + JSON args
Auth OAuth2, API keys — mature patterns Out of spec — implement at HTTP layer or env for STDIO
Idempotency HTTP semantics + headers Tool-defined; no global standard
Pattern 2026 Public product APIs Thin MCP facade → internal REST/gRPC

Anti-pattern: expose raw REST OpenAPI directly to model — token burn + prompt injection via path params. MCP server whitelists operations: model sees 5 tools, not 200 endpoints.

6. Ecosystem 2026: timeline + AAIF + 10 000+ servers

  • 2026-01 — OpenAI: MCP in Agents SDK + Responses API; unified tool registry replaces per-assistant custom actions.
  • 2026-02 — Google: MCP in Gemini CLI, Vertex Agent Builder; A2A for inter-agent task delegation (complementary layer).
  • 2026 Q1–Q2 — Microsoft: MCP host in VS Code extension model, GitHub Copilot agent mode, Copilot Studio enterprise connectors.
  • AAIF (Linux Foundation): Anthropic donated MCP spec; neutral governance; reference SDKs TypeScript/Python; conformance tests emerging.
  • 10 000+ servers: Smithery, PulseMCP, npm @modelcontextprotocol/* — Postgres, Slack, Git, Puppeteer, custom internal APIs.

Architectural implication: betting against MCP in greenfield agent infra = rebuilding N×M adapters in 2027. Same mistake as building custom wire protocols post-HTTP/1.1.

7. Security limits, A2A, operational bounds

Spec intentionally omits:

  • Global authn/z framework — roll your own on HTTP; STDIO = full trust in parent
  • Tool capability sandbox — host must restrict filesystem/network (OpenClaw workspaceAccess, macOS Seatbelt in Claude Code)
  • Supply chain for 10k registry entries — treat third-party MCP servers like npm packages from unknown authors
  • Tool poisoning — malicious description fields in tools/list steer model; allowlist server binaries

A2A (Agent2Agent): Google protocol for agent↔agent (task cards, status updates). MCP = vertical (agent→tool); A2A = horizontal (agent→agent). Compose: Agent A uses MCP tools; delegates subtask to Agent B via A2A.

Ops: STDIO servers under OpenClaw accumulate node/npx children — monitor ps count, cold gateway restart after mcp.servers changes. HTTP MCP with url-only config may be skipped by some hosts — verify with doctor.

8. Пять шагов: MCP Server на remote Mac

  1. Inventory + MCP vs REST matrix: agent-facing → MCP; human/CRUD-only → keep REST. Document N×M savings target (baseline vs 45–62 % remaining work).
  2. Pick transport: dev = STDIO; prod = HTTP+SSE on 127.0.0.1, Caddy/Nginx TLS termination, no anonymous 0.0.0.0.
  3. Configure client: 
    // ~/.openclaw/openclaw.json excerpt
{
  "mcp": {
    "servers": {
      "pg-readonly": {
        "command": "npx",
        "args": ["-y", "@modelcontextprotocol/server-postgres", "${DATABASE_URL}"]
      },
      "git-local": {
        "command": "uvx",
        "args": ["mcp-server-git", "--repository", "/data/workspace"]
      }
    }
  }
}
    Verify: tools/list returns expected schemas; no doctor MCP warnings.
  4. Remote Mac provisioning: Apple Silicon, Node 22+, launchd plist for gateway, disable sleep, dedicated user, workspaceAccess: restricted, secrets in env not in JSON committed to git.
  5. SFTP/rsync + acceptance: CI rsync config/skills → remote; E2E tools/call with fixture data; log JSON-RPC latency P95; integrate with existing Cursor + Claude dual-stack if applicable.

9. FAQ

MCP replaces REST? No. MCP wraps tools for agents; REST stays for services.

STDIO vs HTTP prod? STDIO if single-host colocated; HTTP+SSE for remote clients — always TLS + auth.

MCP vs A2A? Tool layer vs agent coordination — use both.

stdio zombie PIDs? Gateway cold restart; see OpenClaw MCP runbook; don't rely on hot reload alone.

Итог: MCP в 2026 — инфраструктурный протокол уровня HTTP для agent tooling: JSON-RPC wire, typed discovery, N×M→N+M economics (38–55 % saved integration cost), AAIF governance, 10k+ servers. Production MCP Server не живёт на ноутбуке, который засыпает — только SFTPMAC remote Mac: launchd, APFS workspace, SFTP/rsync deploy pipeline, 7×24 tools/call SLA.