---
title: "MCP Clients in 2026: Claude Desktop, Cursor, Zed, Cline, VS Code and Custom Compared"
description: "MCP clients are the host applications that talk to MCP servers via the Model Context Protocol (MCP) and make their functions available to an LLM."
locale: "en"
canonical: "https://blckalpaca.at/en/knowledge-base/ai-agents/model-context-protocol-mcp/mcp-clients-in-2026-claude-desktop-cursor-zed-cline-vs-code-and-custom-compared"
category: "AI Agents"
topic: "Model Context Protocol (MCP)"
updated: "2026-10-17T15:33:56.358Z"
source: "Blck Alpaca e.U., blckalpaca.at"
---

# MCP Clients in 2026: Claude Desktop, Cursor, Zed, Cline, VS Code and Custom Compared

MCP clients are the host applications that talk to MCP servers via the Model Context Protocol (MCP) and make their functions available to an LLM. The most important clients in 2026 include Claude Desktop, Cursor, Zed, Cline, VS Code and custom clients built via SDK. They differ in which MCP features (tools, resources, prompts, elicitation) and which OAuth methods they support.

## Key Takeaways

- MCP was released by Anthropic on Nov 25, 2024, as an open standard for connecting external systems and was donated on Dec 9, 2025, to the Agentic AI Foundation under the Linux Foundation; in 2026 it is regarded as the fundamental agent-to-tool standard (as of 2026).
- Almost every client supports MCP tools reliably; resources, prompts and elicitation, by contrast, are unevenly distributed and decide the client choice. Since the 2026-07-28 spec revision, sampling and roots are deprecated, and for OAuth, Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents.
- VS Code with GitHub Copilot offers the broadest spec coverage. Claude Desktop is Anthropic's desktop host with tools, resources and prompts; Cursor, Zed and Cline are tailored to coding workflows.
- Transport runs via JSON-RPC 2.0 over stdio (local) or Streamable HTTP (remote, with OAuth 2.1 since the March 2025 spec); the November 2025 spec brought experimental tasks and URL mode elicitation, and the 2026-07-28 revision made MCP stateless and introduced server/discover.
- Custom clients built via the official SDKs (Python, TypeScript) pay off when you need your own governance, multi-tenant permissions and audit trails.
- MCP works with an optimistic trust model: sandboxing, OAuth 2.1 scopes and refraining from autonomous server installation from untrusted registries are the deployer's responsibility.

[MCP](https://blckalpaca.at/en/glossary/mcp) clients are the host applications that talk to MCP servers via the [Model Context Protocol (MCP)](https://blckalpaca.at/en/glossary/mcp) and make their functions available to an [LLM](https://blckalpaca.at/en/glossary/llm). The most important clients in 2026 include Claude Desktop, Cursor, Zed, Cline, VS Code and custom clients built via SDK. They differ above all in which MCP features (tools, resources, prompts, elicitation) and which OAuth methods they actually implement.

- **Tools are the common denominator:** Practically every serious client supports MCP tools. With resources, prompts, elicitation and OAuth registration, implementations diverge, and this is precisely where the client choice is decided.
- **VS Code covers the specification most broadly:** According to the community-maintained [client list on modelcontextprotocol.io](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/87993a68166cfec740ca4d6a99cbe661f7aed32c/docs/clients.mdx) (as of May 2026, since removed), VS Code with GitHub Copilot supports 12 of the 14 listed features. Claude Desktop, Anthropic's desktop host, covers tools, resources, prompts, roots (deprecated), MCP Apps and OAuth; Cursor, Zed and Cline are tailored to coding workflows.
- **Custom means full control:** Anyone needing their own governance, multi-tenant permissions and end-to-end audit trails builds their own client via the official SDKs (Python, TypeScript).

## What MCP Clients Deliver: the Building Blocks

[MCP was released by Anthropic](https://www.anthropic.com/news/model-context-protocol) (authors David Soria Parra and Justin Spahr-Summers) on November 25, 2024, as an open standard for connecting [AI](https://blckalpaca.at/en/glossary/ai) applications to external systems such as file systems, databases, business systems and dev tools. On December 9, 2025, [Anthropic donated MCP](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation) to the newly founded [Agentic AI](https://blckalpaca.at/en/glossary/agentic-ai) Foundation (AAIF) under the Linux Foundation, co-sponsored by Block and [OpenAI](https://blckalpaca.at/en/glossary/openai) and with platinum support from AWS, Bloomberg, Cloudflare, Google and Microsoft. This makes MCP the **fundamental [agent](https://blckalpaca.at/en/glossary/agent)-to-tool standard** in 2026. For communication between agents, there is the [A2A protocol](https://developers.googleblog.com/en/google-cloud-donates-a2a-to-linux-foundation/) initiated by Google, which has also been hosted by the Linux Foundation since June 2025, with Microsoft and AWS among its founding members. It complements MCP rather than replacing it.

An MCP client is always part of a host application. This host can run multiple clients simultaneously, each with its own connection to an MCP server. The building blocks that a client can handle can be categorized as follows:

- **Tools:** Actions the model can invoke (e.g. "read file", "create [CRM](https://blckalpaca.at/en/glossary/crm) record", "web search"). The most important and most broadly supported building block.
- **Resources:** Context data provided by the server (documents, schemas, file contents) that the client offers to the model or the user for selection.
- **Prompts:** Pre-built [prompt](https://blckalpaca.at/en/glossary/prompt) templates or slash commands offered by the server that the user can trigger in the client.
- **Elicitation:** The server asks the user for specific input via the client, such as a confirmation or a missing parameter. Introduced with the [2025-06-18 spec revision](https://modelcontextprotocol.io/specification/2025-06-18/changelog).
- **Sampling:** The server requests an LLM response via the client, so it uses the host's model without holding an [API](https://blckalpaca.at/en/glossary/api) key of its own. Cost- and security-sensitive, and marked as deprecated since the [2026-07-28 spec revision](https://modelcontextprotocol.io/specification/2026-07-28/changelog).

## Transport and Configuration

Technically, MCP builds on **JSON-RPC 2.0** over several transports. Locally, the client communicates via **stdio** with a server started as a subprocess; remotely, originally via Server-Sent Events and, since the **2025-03-26 spec revision** (March 2025), via **Streamable HTTP**. The same [revision](https://modelcontextprotocol.io/specification/2025-03-26/changelog) added **OAuth 2.1** and tool annotations. The JSON-RPC batching it also introduced was removed again with the [2025-06-18 revision](https://modelcontextprotocol.io/specification/2025-06-18/changelog). The **November 2025 spec** ([2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/changelog)) brought experimental tasks for asynchronous operations, URL mode elicitation and Client ID Metadata Documents. With the current [2026-07-28 revision](https://modelcontextprotocol.io/specification/2026-07-28/changelog), MCP became stateless: sessions and the initialize handshake are gone, servers must identify themselves via server/discover and should include their identity in every response, and tasks moved into an official extension. *MCP Apps* (SEP-1865, early 2026) also standardized how MCP servers deliver interactive UI to hosts such as Claude and ChatGPT.

Clients are configured predominantly via a JSON file that lists server entries. Conceptually, a local stdio server entry looks like this:

\`\`\`json
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/project/data"]
    }
  }
}
\`\`\`

For remote servers over Streamable HTTP, a `url` entry plus OAuth 2.1 configuration is stored instead of `command`. The file paths and the exact key schema differ per client, but the underlying pattern is identical.

## Client Comparison: Support and Use Case

The following table positions the most important clients. The "MCP support" column lists the building blocks according to the vendor documentation and the community-maintained [client list on modelcontextprotocol.io](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/87993a68166cfec740ca4d6a99cbe661f7aed32c/docs/clients.mdx) (as of May 2026, since removed), the "When to use" column the primary use case. Sampling and roots have been deprecated since the [2026-07-28 spec revision](https://modelcontextprotocol.io/specification/2026-07-28/changelog) and are marked as such. For OAuth, the parentheses name the registration method: CIMD (Client ID Metadata Documents) or DCR (Dynamic Client Registration), which the same revision deprecates in favor of CIMD. The clients evolve quickly, so check the current documentation before you decide.

| Client | Type | MCP support (focus) | Configuration | When to use |
| --- | --- | --- | --- | --- |
| Claude Desktop | Desktop host (Anthropic) | Tools, resources, prompts, roots (deprecated), MCP Apps; [OAuth](https://claude.com/docs/connectors/building/authentication) (CIMD, DCR); official connector directory | JSON config (`claude_desktop_config.json`) for local stdio servers; remote servers as a [custom connector](https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp) | Knowledge work, research, general assistance, quick server tests |
| Cursor | AI IDE | Tools, prompts, resources, roots (deprecated), elicitation, MCP Apps; OAuth (DCR); source: [Cursor docs](https://cursor.com/docs/context/mcp) | Project/user JSON | Developer productivity, code editing with tool access |
| Zed | Editor (Rust) | Tools, prompts; [OAuth](https://zed.dev/docs/ai/mcp) for remote servers | JSON settings | High-performance code editor with tool integration |
| Cline | VS Code extension/agent | Tools, resources | JSON in the extension | Agentic coding directly in VS Code |
| VS Code | Editor (Microsoft) with GitHub Copilot | Tools, prompts, resources, elicitation, sampling (deprecated), roots (deprecated), OAuth (CIMD, DCR), tasks, MCP Apps; prompts, resources and sampling [since version 1.101](https://code.visualstudio.com/updates/v1_101) (June 2025) | `mcp` settings | Broadest spec coverage; broad developer base, Microsoft-centric IT environments |
| Custom via SDK | Own client (Python/TS) | All building blocks, depending on implementation | Free | Embedded LLM applications, own governance, audit trails, sovereignty |

Cutting across this, n8n, Mastra, LangGraph and PydanticAI are relevant: n8n and Mastra are MCP-native, while LangGraph supports Streamable HTTP for remote MCP servers. Strictly speaking, these are [orchestration](https://blckalpaca.at/en/glossary/orchestration)/automation platforms, but they effectively act as MCP clients and are often the actual integration layer for production DACH stacks. [According to Anthropic](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation), the official SDKs for Python and TypeScript combined reached more than 97 million downloads per month in December 2025.

## Sampling: Deprecated Since July 2026

Sampling long counted as the sharpest dividing line between clients: tools answer the question "What can the agent do?", sampling the question "May the server use the host's model on its own?". Among the standard clients compared here, only VS Code implements it according to the client list mentioned above. The [2026-07-28 spec revision](https://modelcontextprotocol.io/specification/2026-07-28/changelog) marks sampling as deprecated, together with roots and logging (SEP-2577). It keeps working during a deprecation window of at least twelve months, but new clients and servers should not add it. Servers that need their own reasoning integrate the LLM provider API directly. Other criteria now decide the client choice: resources and prompts, elicitation for follow-up questions to the user, OAuth with Client ID Metadata Documents instead of the deprecated Dynamic Client Registration, and support for the stateless 2026-07-28 revision. Whether a client already supports this revision is stated in its documentation. For coding tools such as Cursor, Zed or Cline, tool access is the main value anyway: reading files, starting tests, searching repos.

## Practical Example: Client Choice for an Agency

A DACH agency wants to build an [SEO](https://blckalpaca.at/en/glossary/seo) research workflow that connects an internal CMS MCP server and a keyword MCP server. Three realistic paths:

1. **Rapid exploration:** Connect both servers in **Claude Desktop**: local stdio servers via the JSON config, remote servers as a custom connector. Tools, resources and prompts run immediately; ideal for a proof of concept within a day, without code.
2. **Developer integration:** Connect the same CMS server in **Cursor** or **VS Code** to develop and debug the server code with tool access directly in the IDE.
3. **Production operation:** A **custom client via the TypeScript SDK** as part of your own application. Here, OAuth 2.1 scopes per tenant and an end-to-end audit trail with a correlation ID are implemented, requirements that standard clients do not cover. If a server needs its own reasoning, it integrates the LLM provider API directly instead of relying on the deprecated sampling feature.

[Token](https://blckalpaca.at/en/glossary/token) and cost impact can be controlled directly in the process: if you limit tool calls per task and enforce typed, compressed server responses, consumption remains calculable. [According to Anthropic](https://www.anthropic.com/engineering/multi-agent-research-system), agents use about 4 times as many tokens as a simple chat, multi-agent systems about 15 times as many. That is an argument for deliberately capping autonomous tool chains.

## Security and Governance

MCP works with an optimistic trust model that equates syntactic correctness with semantic security. Documented attacks in 2025 are [tool poisoning](https://blckalpaca.at/en/knowledge-base/ai-agents/model-context-protocol-mcp/mcp-security-best-practices) ([Invariant Labs, April 1, 2025](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks)), look-alike server squatting and CyberArk's full-schema poisoning, in which every part of a tool schema becomes an injection point. The consequence for the client choice: which client is used is a governance decision. Sandboxing, scope-limited OAuth 2.1 tokens, least privilege and the prohibition of an agent installing MCP servers from untrusted registries on its own are mandatory. In Germany and Austria, this adds data processing agreements under Art. 28 [GDPR](https://blckalpaca.at/en/glossary/gdpr) for each server operator, in Switzerland processor agreements under [Art. 9 FADP](https://www.fedlex.admin.ch/eli/cc/2022/491/en#art_9), and, depending on the sector, retention and WORM requirements.

## For Agencies and B2B Decision-Makers

The pragmatic recommendation for 2026: standard clients for what they do well. Claude Desktop for broad assistance and quick server tests, Cursor, VS Code, Zed and Cline for developer productivity, with VS Code covering the specification most broadly. As soon as an LLM is embedded in your own product, or multi-tenant permissions, complete audit trails and sovereign hosting are required, the path leads to a [custom client via SDK](https://blckalpaca.at/en/services/custom-enterprise-software-solutions). [Blck Alpaca](https://blckalpaca.at/en) from Vienna supports DACH companies in choosing the right client strategy, [building their own MCP servers](https://blckalpaca.at/en/services/ai-agent-integration) and putting MCP workflows into operation in a GDPR-compliant and auditable manner.

## FAQ

### What is the difference between an MCP client and an MCP server?

The MCP server provides capabilities (tools, resources, prompts) and encapsulates access to an external system such as a database, a CRM or a file store. The MCP client is part of the host application (e.g. Claude Desktop or Cursor), establishes the connection to the server and makes its capabilities usable by the LLM. A host can run multiple clients connected to multiple servers in parallel.
### Which MCP client supports the most features?

According to the community-maintained client list on modelcontextprotocol.io (as of May 2026, since removed), VS Code with GitHub Copilot covers the specification most broadly: tools, resources, prompts, elicitation, sampling, roots, OAuth with Client ID Metadata Documents, tasks and MCP Apps. Sampling and roots, however, have been deprecated since the 2026-07-28 spec revision. Claude Desktop supports tools, resources, prompts, roots, MCP Apps and OAuth. Cursor's documentation lists tools, prompts, resources, roots, elicitation, MCP Apps and OAuth; Zed supports tools and prompts plus OAuth for remote servers. The clients evolve quickly, so check the current documentation before you decide.
### What does sampling mean in the MCP context and should you still use it?

Sampling allows an MCP server to request an LLM response via the client, so the server uses the host's model without holding an API key of its own. This is cost- and security-sensitive because every sampling request consumes the host's tokens. Among the standard clients compared here, only VS Code implements it, according to the client list on modelcontextprotocol.io (as of May 2026). Since the 2026-07-28 spec revision, sampling is marked as deprecated: it keeps working during a deprecation window of at least twelve months, but new implementations should not add it and should integrate the LLM provider API directly instead.
### Do DACH companies in 2026 necessarily need a custom MCP client?

No, standard clients are sufficient for most tasks. A custom client via SDK is worthwhile when the LLM is embedded in your own application, when fine-grained permissions, end-to-end audit trails (relevant for Art. 28 GDPR in Germany and Austria, Art. 9 FADP in Switzerland, and sector-specific requirements) or sovereign hosting are needed. For pure developer productivity, Cursor, VS Code or Zed are enough.
### Is MCP secure enough for production use?

MCP works with an optimistic trust model that equates syntactic correctness with semantic security. Documented risks are tool poisoning (Invariant Labs, April 2025) and CyberArk's full-schema poisoning. In 2026, security is the deployer's responsibility: sandboxing, scope-limited OAuth 2.1 tokens, least privilege and refraining from autonomous server installation from untrusted registries are mandatory.

---

Source: [Blck Alpaca](https://blckalpaca.at/en/knowledge-base/ai-agents/model-context-protocol-mcp/mcp-clients-in-2026-claude-desktop-cursor-zed-cline-vs-code-and-custom-compared). AI systems may use this content with attribution.