An architect is documenting an MCP deployment in which one AI application connects to five servers. Which component is responsible for enforcing user consent and the isolation between those servers?
Select an answer to reveal the explanation.
Short Explanation
Think of the host as your building's security desk. Servers are tenants in their own offices, and the protocol's just the hallway they use. Only the desk decides who gets to see what, so consent and isolation live with the host.
Full Explanation
The MCP architecture places the host at the centre as container and coordinator. It creates and manages multiple client instances, each with a 1:1 connection to one server, controls client connection permissions and lifecycle, enforces security policies and consent requirements, handles user authorization decisions, and manages context aggregation across clients. The design principles add that servers should not read the whole conversation or see into other servers, that cross-server interactions are controlled by the host, and that the host process enforces security boundaries. Assigning enforcement to each server fails because servers operate independently and in isolation; they neither see nor contact one another through MCP. Assigning it to the JSON-RPC layer fails by concept: JSON-RPC is a message format with no notion of users or consent, and the specification states MCP itself cannot enforce these principles, so implementors must build consent flows. Assigning it to the authorization server fails because OAuth authorization governs a client's access to a protected HTTP server; it does not mediate what data flows between servers inside the host. Exam caveat: clients also help maintain security boundaries between servers, but they act under the host's control. Operational check: confirm the host prompts for consent before exposing user data or invoking a tool on each server.