.svg)
.svg)
.svg)
What Is an MCP Server?
The "what is an MCP server" question is being asked almost 3,000% more often than it was a year ago. If you are building with AI agents and have not wrapped your head around this yet, here is the short version.
- An MCP server is the part that does things. The AI talks. The MCP server acts. It is the bridge between your AI agent and any external tool, database, API, or website it needs to interact with.
- MCP stands for Model Context Protocol. Anthropic launched it in November 2024. OpenAI, Google DeepMind, and Microsoft adopted it by mid-2025. Downloads grew from roughly 100,000 to 8 million in five months, per PulseMCP data.
- Local vs remote matters more than most guides explain. Local servers run on stdio on your machine. Remote servers run on infrastructure with a public IP. Remote servers are the ones that get blocked by anti-bot systems when they fetch web data.
- MCP does not solve the network layer problem. Protocols handle tool discovery and authentication. They do not stop Cloudflare from evaluating your server's IP before any protocol logic runs.
- There are real cases where you do not need proxies with MCP servers. This article covers those too, because the honest answer is not "add proxies to everything."
Last year I was building out a competitive pricing tool that used an MCP web-fetch server to pull product data on a schedule. The setup was clean. The agent called the tool correctly. The tool called the server. The server made the requests. And then, about six hours after we moved it off my local machine and onto a cloud instance, it started silently returning stale cached pages on about 40% of targets. No error. Just quietly wrong data flowing into our pipeline.
We spent most of a day debugging the MCP layer before someone checked the actual HTTP responses and found Cloudflare challenge pages in the response body. The MCP server was working perfectly. The problem was that it was originating requests from an AWS IP, and the targets had started treating it with high suspicion at the network layer. Honestly, this is simpler than it sounds once you understand what MCP actually does and what it does not do. Let me explain both.
What Is the Model Context Protocol?
Before the server, the protocol itself. Understanding why MCP was created makes the server architecture click immediately.
Before MCP, every AI application needed a custom integration for every tool or data source it used. If you wanted Claude to access GitHub, you wrote a GitHub connector for Claude. If you wanted GPT-4 to access the same GitHub data, you wrote a separate connector. Every new AI model times every new data source required its own custom implementation. Anthropic called this the N x M integration problem, and it was genuinely painful to work around at scale.
The USB-C analogy gets used a lot and it is accurate. Before USB-C you had a different cable for every device. USB-C standardised the interface so any device works with any cable. MCP does the same thing for AI tools. You build the MCP server once, and any MCP-compatible AI can use it.
How Fast MCP Grew
The adoption numbers are genuinely unusual for a new protocol. Anthropic open-sourced MCP at launch in November 2024 with a small handful of reference servers. By April 2025, downloads of the MCP SDK had reached approximately 8 million, up from around 100,000 at launch, according to PulseMCP tracking data. The server ecosystem grew from roughly 100 listed servers in November 2024 to over 5,800 by October 2025, per MCP Manager.
Sources: Anthropic MCP announcement, PulseMCP, MCP Manager October 2025 report.
Microsoft, AWS, Cloudflare, and Block all announced MCP support by mid-2025. In December 2025, Anthropic transferred governance of the protocol to the Linux Foundation's Agentic AI Foundation, making it a formally vendor-neutral open standard. The thing is, you do not see this kind of cross-vendor adoption this fast unless the standard is solving a real problem that everyone was already dealing with independently.
What Is an MCP Server, Specifically?
MCP has a three-part architecture. Getting this clear upfront prevents a lot of confusion later.
(Claude, Cursor, Copilot)
(session manager inside host)
(this is what touches the outside world)
The MCP server is the only component that actually connects to external systems. The host and client live inside the AI application. The server lives at the boundary between AI and the real world.
The Host is the AI application itself. Claude Desktop, Cursor, VS Code with Copilot, any LLM application that supports MCP. The host decides which MCP servers to connect to and manages the overall session.
The Client runs inside the host. It handles the MCP protocol session: establishing the connection, sending requests to servers, receiving results, and feeding those results back into the AI's context window. You usually do not interact with the client directly.
The Server is the part that does things. It runs separately from the AI application and exposes capabilities the AI can use. When the agent needs to search the web, query a database, or call an API, the client sends a request to the relevant server, and the server goes and does it. What this actually means in practice is that the server is the only part of the system that touches external infrastructure.
What an MCP Server Exposes
MCP servers expose capabilities through three types of primitives, as defined in the official MCP specification:
All communication between client and server uses JSON-RPC 2.0 messages. The server advertises its capabilities when the connection is established, and the client passes that capability list to the LLM so it knows what tools are available. The model then generates structured tool calls when it decides it needs to use one.
Local vs Remote MCP Servers
This distinction gets skipped in most explainers. It matters a lot, both for how you deploy servers and for what infrastructure they need around them.
The important thing about remote servers: they make outbound requests from a server IP address. That IP is visible to every site the server fetches from. Remote MCP servers grew roughly 4x between May and October 2025, and 80% of the most-searched MCP servers in that period offered remote deployment options, per the MCP Manager October 2025 adoption report. The trend is clearly toward remote. And remote means network infrastructure decisions start to matter.
How an MCP Server Works: Step by Step
Walking through the actual request flow makes the architecture concrete. I find it helpful to see exactly where in this sequence each component is doing its job.
Steps 4 and 5 are everything. That is where the MCP server earns its existence. The protocol machinery in steps 1 through 3 and step 6 is real but not especially interesting from an infrastructure standpoint. Step 4 is where the real world gets involved, and where real-world constraints like anti-bot systems start applying.
What MCP Servers Actually Do: Real Examples
The ecosystem has expanded fast. Rather than a generic list, here is how the categories break down by what the server actually touches when it runs.
Web Access and Data Collection
The fastest-growing category and the one most relevant to proxy infrastructure. Web-fetch and crawl servers make outbound HTTP requests as their core function. Firecrawl offers scraping and crawling with structured output. Bright Data ships an MCP server with 70+ tools and structured access to 190+ datasets. Playwright and Puppeteer MCP servers give agents full browser automation capability. These all originate HTTP requests from wherever the server is running.
I have not personally tested Bright Data's MCP server against their full dataset catalogue, so I cannot speak to how the structured extraction holds up on edge cases. That is worth investigating if you are evaluating it for AI training pipelines.
Databases and Internal Data
PostgreSQL, SQLite, and MongoDB all have MCP servers that let an agent query and write to databases directly. Redis and Elasticsearch too. These do not make outbound web requests and do not need proxy infrastructure. They communicate with databases on your own network or internal VPC.
Developer and Productivity Tools
GitHub has an official MCP server for issues, pull requests, and code review. Slack, Google Drive, Notion, and Atlassian (Jira + Confluence) all have MCP integrations. These call official APIs using credentials you provide. Again, no proxy infrastructure required because you are an authenticated user of those platforms.
The Ecosystem Numbers
From roughly 100 listed servers at launch in November 2024, the ecosystem reached over 5,800 servers by October 2025 per MCP Manager. By early 2026, Astrix Security was indexing more than 17,000 MCP server implementations across public registries and GitHub repositories when they conducted their security analysis. The growth rate is not slowing down.
I will not go deep on building your own MCP server in this article. That is a full guide on its own, and I want to cover the infrastructure side properly first.
The Network Problem Nobody Explains
This is the section that most MCP guides skip entirely. And it is the one that matters most if you are building anything that fetches live web data.
MCP handles the tool layer. It standardises how the AI discovers tools, invokes them, and receives results. What MCP does not handle is the network layer. These are different layers of the stack and they have different problems that require different solutions.
Anti-bot systems evaluate IP origin at Layer 1 before any MCP protocol logic at Layer 3 runs. A cloud IP behind an MCP tool call gets treated with the same suspicion as a raw HTTP request from that same IP. The protocol wrapping changes nothing about how the IP is scored.
When your MCP web-fetch tool makes an HTTP request to an external target, that request originates from the server's IP address. That IP is the first thing Cloudflare Bot Management, Akamai Bot Manager, and DataDome evaluate. Before your request headers are read. Before any session or authentication logic runs. Before MCP protocol logic runs. If that IP belongs to an AWS, GCP, or Azure ASN, it gets a high suspicion score by default.
Cloudflare Bot Management currently serves over 20 million internet properties. It evaluates every inbound request based on IP origin, ASN, geolocation, and reputation score before any application logic runs. An MCP tool call is still an HTTP request from an IP address. The JSON-RPC wrapping is irrelevant at Layer 1.
I have seen this trip people up before more times than I should admit. Teams spend days debugging MCP server configurations, checking authentication, reviewing JSON-RPC messages, and verifying tool schemas before someone checks what IP the requests are actually originating from. The fix is usually one environment variable pointing the fetch calls through a residential proxy endpoint.
When Your MCP Server Needs Proxies and When It Does Not
Most proxy content skips the "when you do not need them" section. I am spending real time on it here because adding proxies to everything is not the answer, and some MCP server use cases genuinely do not need them.
You Need Residential Proxies
You Do Not Need Proxies
The pattern is consistent: proxies matter when the target has a reason to block you, a mechanism to identify you, and the infrastructure to act on it. Remove any of those three conditions and the proxy question often answers itself.
Which TorchProxies Plan Fits Your MCP Server
Here is the practical decision table. The logic behind each recommendation is in the column on the right.
| MCP Server Use Case | Recommended Plan | Why |
|---|---|---|
| General web data for RAG pipelines | Standard Residential at $4/GB | Rotating residential IPs for broad content access. 30M+ IPs across 195 countries. Cost-effective for the request volumes typical in AI training data workflows. |
| E-commerce price monitoring, Cloudflare-protected sites | Premium Residential at $4.50/GB | 90M+ IPs with a cleaner fraud score profile. On heavily protected targets, the difference between a standard and premium pool shows up directly in success rates. IP reputation matters more than raw IP count. |
| Retail targets: Nike, Supreme, Footsites, Yeezy | Plan X at $5/GB | Pre-configured pools for specific retail targets. 120M+ IPs, 195+ countries. Most providers require manual configuration per target. Plan X includes target-specific pool selection built in, which makes a real difference on platforms with sophisticated bot detection. |
| High-volume AI training data collection | ISP Static at $2.3/IP | Per-IP pricing beats per-GB pricing at high request volume. Stable identity and consistent bandwidth for sustained download pipelines. HTTPS and SOCKS5 supported with switchable auth type. |
| Authenticated APIs (GitHub, Slack, Notion) | No proxies needed | You hold valid credentials. The platform treats you as an authorised user. IP origin does not affect access. Adding a proxy here adds latency and a failure point with no benefit. |
| Internal databases and private APIs | No proxies needed | Traffic stays on your network. No external IP evaluation. Proxies are irrelevant and would route traffic unnecessarily through an external endpoint. |
One honest limitation worth knowing: TorchProxies requires manual configuration at the tool implementation level. There is no browser extension or VPN-style app. You add the proxy endpoint to your web-fetch function directly. That is also how it should be for MCP servers: the proxy stays inside the tool implementation, the agent stays clean of infrastructure concerns, and the two layers stay properly separated.
MCP Server Security: What the Data Shows
This section is worth reading even if you do not care about proxies. The credential security picture across the MCP ecosystem is not encouraging.
Astrix Security analyzed 5,200 open-source MCP server implementations in early 2026. Their findings: 88% of these servers require credentials to function, but 53% store those credentials as static API keys or Personal Access Tokens sitting in configuration files and .env files. Only 8.5% implement OAuth. The analysis covered servers across GitHub, official registries, and community repositories. Source: Astrix Security MCP Server Security Analysis, February 2026.
I want to be specific about what proxies solve here and what they do not. Residential proxies address the network-layer problem. The IP that arrives at the target looks like a real residential connection rather than a known cloud ASN. They do not address credential exposure. A static API key in a .env file is a credential problem, not a network problem. Both need solving, but they need different solutions.
I have not completed a full audit of every MCP server we use in our own pipelines against the Astrix framework yet. I cannot honestly claim we are fully clean on the credential hygiene side. That is on the list. The point is that these are two separate problems operating at two separate layers, and solving one does not give you credit for the other.
Final Verdict
An MCP server is the component that gives an AI agent the ability to act rather than just respond. The architecture is three parts: the host application, the client session manager, and the server that actually touches external systems. The server is the only one of the three with a real-world footprint.
The protocol itself solves a real problem. Before MCP you needed a custom integration for every AI-tool combination. Now you build the server once and any MCP-compatible host can use it. The adoption by OpenAI, Google DeepMind, Microsoft, and AWS within months of launch tells you this standard is going to stick. The Linux Foundation governance transfer in December 2025 confirms it is not going to be controlled by a single vendor.
What MCP does not solve is the network layer. When your server makes an outbound HTTP request, it originates from an IP. That IP gets evaluated by anti-bot infrastructure before any protocol logic runs. The distinction between local stdio servers (no network exposure) and remote HTTP/SSE servers (full network exposure) is the one that determines whether you need to think about proxy infrastructure at all. If you are deploying remote MCP servers that fetch from protected web targets, you need to think about it.