Model Context Protocol (MCP) is how AI coding agents talk to the outside world. It's a standardized protocol originally developed by Anthropic and is now governed by the Agentic AI Foundation under the Linux Foundation. MCP allows agents to invoke external tools: everything from databases to security systems to documentation servers.
When you configure an MCP server for an AI coding agent, you're essentially giving it a new capability. The agent can then decide when to use that capability based on the task at hand.
How MCP Works
MCP servers expose capabilities to AI agents. When an agent determines it needs external information or wants to perform an action, it invokes the appropriate MCP server with a request. The server processes the request and returns a response that the agent incorporates into its workflow.
For example, Corridor's MCP server accepts a description of what the agent is planning to build and returns relevant security considerations: potential vulnerabilities to watch for, secure coding patterns to follow, and context about the codebase's existing security posture. The agent uses this guidance when generating code.
The key word here is "decides." MCP invocation is non-deterministic. The agent chooses whether and when to call MCP servers based on its understanding of the task. This works well in practice, as agents generally do call relevant servers when configured properly. But it's not guaranteed.
MCP vs Hooks
MCP and hooks serve complementary purposes. MCP gives agents capabilities they can choose to use. Hooks guarantee certain actions happen at specific points.
For security, this distinction matters. MCP is great for providing context: the agent calls your security server and gets guidance on how to implement something securely. Hooks are essential for enforcement. After the code is generated, a security scan runs whether the agent asked for it or not.
Corridor uses both approaches: MCP to guide the agent toward secure patterns during code generation, and hooks to verify the output meets security requirements after generation completes.