Glossary
Glossary: MCP, OAuth, AI agents and product terms
Plain definitions of the terms behind AI workspaces and the tools that connect to them: the Model Context Protocol, OAuth, webhooks, AI agents, requirements and the rest of running a small team. Each page answers the question first, then explains it with an example.
Model Context Protocol
How AI assistants connect to the systems where work lives.
- MCP (Model Context Protocol)MCP, the Model Context Protocol, is an open standard for connecting AI applications to outside tools and data. An AI app (the host) runs MCP clients that talk to MCP servers using JSON-RPC 2.0. Servers offer tools to call, resources to read and prompts to reuse, so one integration works across many assistants.
- MCP serverAn MCP server is a program that exposes tools, resources and prompts to AI applications over the Model Context Protocol. A client connects, asks what the server offers, and then calls tools or reads resources on the model's behalf. Servers can run locally over stdio or remotely over Streamable HTTP.
- Remote MCP serverA remote MCP server is an MCP server reached over the internet through one HTTPS endpoint, using the Streamable HTTP transport, instead of running on your own machine. You add it to an AI app by URL, sign in through OAuth in the browser, and it serves many users while keeping each one's data separate.
- MCP clientAn MCP client is the component inside an AI application that holds a connection to one MCP server. It negotiates capabilities, lists the server's tools, resources and prompts, passes tool calls from the model to the server and returns results. The application around it, such as Claude Desktop or Cursor, is called the host.
- MCP toolAn MCP tool is a function an MCP server exposes for an AI model to call. Each tool has a name, a description and a JSON Schema for its inputs, and may declare an output schema. Clients find tools with tools/list and run them with tools/call; the model decides when to call one, with the user's consent.
- MCP resourceAn MCP resource is read-only context an MCP server makes available, identified by a URI, such as a file, a record or a report. Clients list resources with resources/list and fetch them with resources/read. Unlike tools, resources are chosen by the application or the user to attach as context, not called by the model.
- MCP promptAn MCP prompt is a reusable message template an MCP server offers, which a person picks to start a task, often from a slash-command menu. Clients list prompts with prompts/list and fetch one with prompts/get, passing any arguments. The server returns ready-made messages that tell the model what to do and in what order.
Authorization and APIs
How an app or agent proves who it acts for, and what it may do.
- OAuth 2.1OAuth 2.1 is the consolidated update to OAuth 2.0, the standard that lets an app act for a person without receiving their password. It keeps the authorization code flow, requires PKCE, drops the implicit and password grants, and requires exact redirect URI matching. It is an IETF draft that the MCP authorization specification builds on.
- PKCE (Proof Key for Code Exchange)PKCE, Proof Key for Code Exchange, is an OAuth extension that stops a stolen authorization code from being used. The app makes a random secret called the code verifier, sends its SHA-256 hash as the code challenge when the flow starts, and must present the original verifier to exchange the code for a token. Defined in RFC 7636.
- Dynamic client registrationDynamic client registration is an OAuth mechanism, defined in RFC 7591, that lets an app register itself with an authorization server by posting its metadata, such as its name and redirect URIs, to a registration endpoint. The server returns a client ID on the spot, so no developer has to create the app by hand in a console first.
- Scopes (OAuth scopes)Scopes are named permissions attached to an access token that limit what it can do, such as work.read or crm.write. An app requests scopes, the person approves them on a consent screen, and the API checks the token's scopes on every call. Well-designed scopes are narrow, so an app gets only the access it needs.
- Step-up authorizationStep-up authorization is when an app that already holds a token asks for more access only at the moment it needs it. The server refuses the call with 403 insufficient_scope and names the required scopes; the client re-runs authorization for that wider set, the person approves, and the client retries the call with the new token.
- Personal access tokenA personal access token is a long random string you create in an app's settings that lets your own scripts, CI jobs or servers call its API as you. You choose its scopes and expiry when you create it, send it as a bearer token, and revoke it at any time. It replaces a password for programmatic access.
- WebhookA webhook is an HTTP request a service sends to a URL you choose when something happens, such as a deal being won or an issue closing. Instead of your code polling an API to ask for changes, the service pushes the event to you as it occurs, usually as a JSON POST signed so you can verify it.
- HMAC signatureAn HMAC signature is a code computed from a message and a shared secret key using a hash function such as SHA-256. The sender attaches it to the message; the receiver recomputes it with the same secret and compares. If they match, the message came from someone holding the secret and was not changed in transit. Defined in RFC 2104.
- Rate limitA rate limit caps how many requests a client may make to an API in a period of time, such as 120 calls a minute. Requests over the limit are refused, usually with HTTP 429 Too Many Requests and a Retry-After header saying how long to wait. Limits protect the service and keep one busy client from starving the others.
Product and planning
Deciding what to build, writing it down, and tracking it.
- AI workspaceAn AI workspace is one app where a team keeps its work, documents, conversations and records, with AI built into it rather than bolted on. Because projects, docs, chat, calendar and customers live together, the AI can read real context and do real work across them, instead of answering from a blank chat window.
- AI agentAn AI agent is software that uses a language model to pursue a goal over several steps: it reads context, decides what to do, calls tools, checks the results and continues until the task is done or it needs a person. Unlike a chatbot that only replies, an agent takes actions, so its permissions and checkpoints matter.
- Agent runAn agent run is one bounded piece of work an AI agent performs from start to finish, such as writing a requirements document or proposing a batch of tasks. A run has a mode or goal, a status like queued, running, succeeded or failed, and an output. Many AI products meter and price usage by runs.
- Requirements baselineA requirements baseline is a frozen, approved snapshot of a project's requirements at a point in time, usually when the team and stakeholders sign off on what will be built. Later edits do not change it. Progress, scope changes and audits are measured against the baseline, so drift from what was agreed becomes visible.
- Requirements audit (coverage and drift)A requirements audit compares the work actually done against the requirements that were agreed. Coverage shows, requirement by requirement, whether anything is being done about it. Drift shows requirements whose wording changed, or that were dropped or deleted, after sign-off. Together they show gaps before a client or a launch finds them.
- PRD (product requirements document)A PRD, or product requirements document, describes what a product or feature must do and why, written before it is built. It states the problem, the users, the goals and how success is measured, then lists the requirements with priorities and acceptance criteria, and what is out of scope. It is the shared reference for what was agreed.
- Product roadmapA product roadmap is a plan that shows where the major pieces of work sit over the coming months or quarters, and the dates other people depend on. It communicates direction and priority at the level of initiatives and milestones, not individual tasks, and it changes as the team learns. It answers what is next and roughly when.
- BacklogA backlog is the ordered list of work a team might do but has not yet committed to: features, fixes, improvements and ideas. Items wait there until someone refines and prioritises them and moves them into the active plan. A healthy backlog is ordered by value, kept short enough to read, and pruned regularly.
- SprintA sprint is a fixed, short period, usually one to four weeks, in which a team commits to finishing a chosen set of work. It starts with planning, ends with a review of what was delivered and a retrospective on how the team worked, and the next sprint starts immediately after. Sprints come from Scrum.
- OKR (objectives and key results)OKRs, objectives and key results, are a goal-setting method. An objective is a short, qualitative statement of what you want to achieve in a period, usually a quarter. Each objective has two to five key results: measurable outcomes, with a starting value and a target, that show whether the objective was reached.
Sales, hiring and pricing
Running the rest of a small company.
- Booking linkA booking link is a public web page where other people pick a time to meet you from your real availability, without back-and-forth email. It reads your calendar to hide busy times, applies your rules for meeting length, buffers and notice, and on booking adds the event to both calendars, often with a video link.
- Deal pipelineA deal pipeline is the sequence of stages a potential sale moves through, from first contact to won or lost, shown as a board or list in a CRM. Each deal sits in one stage with a value and an owner, so a team can see what is likely to close, where deals stall, and what revenue is coming.
- Applicant trackingApplicant tracking is the practice, and the software, for managing job candidates from application to hire. An applicant tracking system (ATS) publishes open roles, collects applications, moves each candidate through stages such as screening, interview and offer, and keeps notes and decisions in one place so the hiring team works from the same record.
- Flat pricing vs per-seat pricingPer-seat pricing charges for each user, so the bill grows with every person you add. Flat pricing charges one price for the plan, usually with a set number of seats or usage included, so adding a teammate within the plan costs nothing. Per-seat suits large teams with uneven usage; flat pricing suits small, growing ones.