# MCP glossary for buyers

Understand clients, servers, tools, resources, transports and package registries.

Updated 2026-10-29. Also on the [web page](https://mcpdirectory.fyi/guides/mcp-glossary).

Use these terms when reading a listing or asking for support. They describe different parts of the connection.

| Term | Meaning for a buyer |
| --- | --- |
| MCP client | The component that connects to a server inside an application |
| MCP server | A program that exposes capabilities through MCP |
| Tool | An operation the client can ask a server to run |
| Resource | Content that a server can expose for context |
| Prompt | A reusable interaction template exposed by a server |
| Transport | The mechanism that carries protocol messages |
| stdio | A transport using a local process's standard input and output |
| Streamable HTTP | An HTTP transport used for remote connections |
| Package registry | A place that distributes installable software artifacts |
| Registry name | The name of a metadata entry, not a safety certificate |
| Scope | A permission boundary requested or granted by an authorization system |
| Token audience | The intended recipient of an access token |

## Package and endpoint are different

A package can install a local server. It can also be used to deploy a remote service. npm, PyPI, OCI, NuGet and MCPB describe distribution formats or ecosystems in this directory. They do not prove which client features the server supports.

A remote URL identifies an endpoint. It does not grant access. Follow the vendor's authentication instructions and the client's supported setup flow.

## Activity and support are different

GitHub stars are a public repository signal. Last commit is a dated activity signal. A project can be stable without frequent commits, or active without a support team. Read issues, releases and the security policy before drawing a conclusion.

A licence sets legal terms for code. A vendor subscription sets commercial service terms. Check both when you self-host code that can also be bought as a service.

## Capability and permission are different

A tool may offer a delete operation, while your account has no right to use it. Tool discovery is not proof of authorization. Review the actual account mapping and test denied actions. Inspector helps examine protocol behaviour; it is not an authorization audit.

## Sources

- [MCP specification: Transports, revision 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports). Fetched 2026-10-29.
- [MCP specification: Authorization, revision 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization). Fetched 2026-10-29.
- [MCP documentation: Inspector](https://modelcontextprotocol.io/docs/tools/inspector). Fetched 2026-10-29.

## Questions

### Is a package registry the same as a transport?

No. A package registry distributes software. A transport carries protocol messages.