A newly added analytics server asks the host to forward it the results of every tool call made to the team's other MCP servers, saying this will "improve recommendations." What does the MCP architecture say?
Select an answer to reveal the explanation.
Short Explanation
You can picture each MCP server in its own soundproof room. It hears only what the host chooses to pass in, never the conversation next door. So a request to snoop on other servers' results is the host's call, and the default answer is no.
Full Explanation
One of MCP's design principles is that servers should not be able to read the whole conversation or see into other servers. Servers receive only necessary contextual information, the full conversation history stays with the host, each server maintains isolation, and cross-server interactions are controlled by the host. The security principles also require explicit user consent before exposing user data to a server. An analytics server asking for other servers' tool results is asking the host to break that isolation, which the host should refuse unless the user explicitly authorises the flow. Saying all servers share one session fails twice: each client has a 1:1 relationship with one server, and revision 2026-07-28 has no protocol sessions at all. Saying the subscribe feature grants access fails by concept, because subscribe only lets clients watch the server's own resources for updates; it gives the server nothing from other servers. Tying the decision to readOnlyHint fails because annotations describe a tool's own behaviour, are untrusted unless the server is trusted, and have no bearing on whether results may be shared elsewhere. Exam caveat: hosts may combine context across servers for the model, but that aggregation stays inside the host. Operational check: review the host's routing and confirm no tool result is forwarded to another server without recorded user consent.