What is an MCP Host?

The Model Context Protocol defines a client-host-server architecture with three distinct roles. The host is the container process: it creates and manages multiple client instances, controls their connection permissions and lifecycle, handles user authorisation decisions, and coordinates the AI model's access to context. Each client maintains exactly one stateful session with one server — a strict 1:1 relationship — while servers expose tools, resources and prompts.

This separation is deliberate. The spec's design principles state that servers should not be able to read the whole conversation or "see into" other servers: full conversation history stays with the host, each client connection is isolated, and cross-server interaction is mediated by the host. The host is therefore the trust boundary in an MCP deployment — it decides which servers to connect, which tools the model may use, and when a human must approve an action.

In practice, popular hosts include Claude Desktop, Claude Code, Cursor, Windsurf, VS Code (via its MCP support) and other agent coding assistants. Users often say "client" colloquially for these applications, but in spec terms the application is the host and the per-connection protocol endpoints inside it are the clients. The distinction matters when reasoning about security: consent prompts, sampling control and context aggregation are host responsibilities, not client or server ones.

PolicyLayer works with any MCP host. Instead of pointing each host's configuration at upstream servers directly, teams point hosts at the PolicyLayer gateway with a per-person scoped token. Host-level consent prompts remain in place; PolicyLayer adds organisation-level, deterministic policy enforcement and audit beneath them, applied uniformly regardless of which host a person uses.