AI plugin and MCP glossary

Updated .

40 terms you meet when you build, publish or install AI plugins and MCP servers, each defined in one or two sentences. Every term has its own link, and where HOL has a tool for it, such as the context cost calculator or the tool definition linter, the definition points to it.

40 terms

Model Context Protocol

Elicitation
An MCP feature, added in the June 2025 specification, that lets a server ask the user for more information through the client while it is handling a request.
inputSchema
The JSON Schema that describes a tool’s arguments. MCP requires one on every tool, and its top-level type must be "object" because arguments arrive as a JSON object. Lint an inputSchema.
JSON-RPC 2.0
The message format MCP uses. A request carries an id, a method and params; a response carries the same id with a result or an error; a notification has no id and gets no reply.
MCP authorization
How a remote MCP server checks who is calling. The specification builds on OAuth 2.1: the client gets an access token from an authorization server and sends it with each HTTP request. Local stdio servers usually read credentials from their environment instead.
MCP client
The connector inside a host that holds a session with exactly one MCP server, sends its requests and passes the results back to the host.
See also: MCP host, MCP server
MCP host
The AI application the user works in, such as Claude Desktop, Claude Code, Cursor or an IDE. The host starts one MCP client per server, decides what the model sees and asks the user before sensitive actions.
See also: MCP client
MCP Inspector
The MCP project’s developer tool for connecting to a server, listing its tools, resources and prompts, and calling them by hand. Paste its tool list into the linter.
MCP server
A program that offers tools, resources or prompts to AI applications over MCP. It runs on your machine as a subprocess over stdio, or remotely behind an HTTP endpoint.
See also: stdio transport, Streamable HTTP
Model Context Protocolalso MCP
An open protocol, introduced by Anthropic in November 2024, that connects AI applications to outside tools and data through one standard interface. A client inside the application talks to servers over JSON-RPC 2.0, and each server offers tools, resources and prompts.
See also: MCP server, MCP host, JSON-RPC 2.0
Promptalso MCP prompt
A reusable message template an MCP server offers. Hosts usually show prompts to the user as slash commands or menu items, with arguments the user fills in.
See also: Slash command
Resourcealso MCP resource
Data an MCP server makes available to read, identified by a URI: a file, a database row, an API response. The application, rather than the model, usually decides which resources to include.
Roots
The folders or URIs a client tells a server it may work in, such as the project open in the editor.
Sampling
An MCP feature that lets a server ask the client to run a model completion on its behalf, so the server can use a model without its own API key. The client keeps control and can show the request to the user first.
stdio transport
The local MCP transport. The client starts the server as a subprocess and they exchange JSON-RPC messages over its standard input and output.
See also: Streamable HTTP
Streamable HTTP
The remote MCP transport, defined in the March 2025 specification. The client POSTs JSON-RPC messages to one endpoint and the server can stream replies as Server-Sent Events. It replaced the earlier HTTP+SSE transport.
See also: MCP authorization
Toolalso MCP tool
A function an MCP server lets the model call. It is defined by a name, a description and an input schema, and the model chooses when to call it from those three things alone. Check your tool definitions.
See also: tools/list, inputSchema, Tool annotations
Tool annotations
Optional hints on a tool, such as readOnlyHint, destructiveHint, idempotentHint and openWorldHint, that describe how it behaves. They come from the server, so a client should not rely on them for a server it does not trust.
tools/call
The MCP request that runs a tool with the arguments the model chose. The result comes back as content blocks such as text or images, with isError set when the tool itself failed.
tools/list
The MCP request a client sends to learn which tools a server offers. The response holds every tool’s name, description and inputSchema, and those definitions are what the host adds to the model’s context. Measure a tools/list response.
See also: Context cost

Plugins and agents

Agent runtime
The application that runs the agent loop and its tools, such as Claude Code, Codex or Cursor. A plugin built for one runtime may not install in another.
Agent skill
A folder holding a SKILL.md file of instructions, plus optional scripts and reference files, that an agent loads only when a task calls for it. Until then only the skill’s name and description take up context.
AI pluginalso Agent plugin
A package that adds capabilities to an AI coding agent, such as slash commands, subagents, skills, hooks and MCP server settings, installed and removed as one unit. Claude Code, Codex and Cursor each define their own plugin format. Check a plugin against directory rules.
See also: Plugin manifest, Plugin marketplace
Hook
A command the agent runs automatically at a set point, such as before a tool call or when a session starts. Hooks are used to check, block or record what the agent does.
See also: HOL Guard
Plugin manifest
The file that names a plugin and says what it contains, for example .claude-plugin/plugin.json for Claude Code.
Plugin marketplace
A catalog an agent installs plugins from, usually a git repository whose manifest lists each plugin and where to fetch it. In Claude Code it is a .claude-plugin/marketplace.json file.
Slash command
A saved prompt the user runs by typing / followed by its name.
Subagent
A separately configured agent, with its own instructions, tools and context window, that the main agent hands a task to and gets a result back from.

Context and cost

Context costalso Tool bloat
The share of the context window that connected tool definitions take on every request, whether or not any tool is called. A handful of servers with long descriptions can use tens of thousands of tokens before the conversation starts. Calculate your context cost.
See also: tools/list, Prompt caching
Context window
The most tokens a model reads in one request, counting the system prompt, tool definitions, the conversation so far and the reply.
See also: Token, Context cost
Prompt caching
Reusing an unchanged start of the prompt, such as the system prompt and tool definitions, across requests so it is processed faster and billed at a lower rate. Changing the tool list invalidates the cache.
Token
The unit a model counts text in: a word or part of one. English text averages about four characters per token, though every tokenizer splits text differently.

Security

Prompt injection
Text in content the agent reads, such as a web page, an issue or a tool result, written to make the model follow instructions the user did not give.
See also: Tool poisoning
Rug pull
A server or plugin that changes its tool definitions or code after the user reviewed and approved it, so the approved tool now does something else. Pinned versions and a fresh review on every update guard against it.
Tool poisoning
Prompt injection hidden in a tool’s own description or schema. The model reads every definition on every request, so instructions planted there can steer it even when the tool is never called.
See also: Tool shadowing, Rug pull
Tool shadowing
A tool description from one server that changes how the model uses a different, trusted server’s tools, for example by telling it to copy every email to another address.
Typosquatting
Publishing a malicious package, server or plugin under a name close to a popular one, so a typo or a hurried install picks it up.

HOL registry

HOL Guard
HOL’s local-first security layer for AI agents. On supported agents it checks risky commands, file changes and MCP actions before they run, and lets you allow, ask or block them. About HOL Guard.
HOL Trust Score
A 0 to 100 number HOL computes from a static scan of each plugin’s source: a weighted sum of six components, capped when the scan finds high-severity problems. It helps compare listings; it does not certify that a plugin is safe. Read the scoring method.
Owner verification
A listing signal showing that the publisher has claimed the plugin on HOL. It identifies who maintains the listing; it is not a safety certification. What verification covers.
Pre-flight
HOL’s free check of a public GitHub plugin repository against the published submission rules of the Claude, ChatGPT and Codex, and Cursor plugin directories, before you submit. Run pre-flight.

Put the terms to work