One client, three servers
An assistant connects to a filesystem server, a database server and a GitHub server. To save connections, the team wired one MCP client to all three.
MCP's isolation model doesn't work that way. A client talks to exactly one server, and the host — not the client — is the only component allowed to aggregate context across them. Collapse that and servers start seeing traffic that was never theirs.
Boundaries, outermost first: Host · holds the conversation: Model (reached via the host), an empty slot for the for the filesystem, an empty slot for the for the database, an empty slot for the for GitHub Outside every boundary: Database server, GitHub server (FAILED: sees too much), Filesystem server Connections: Model controls for the filesystem — host mediates for the filesystem calls Filesystem server (step 1) for the database calls Database server (step 2) for GitHub calls GitHub server (step 3)