The connection
A shared protocol is not a permission system.
MCP, the Model Context Protocol, is a common way for an agent to talk to tool and data servers. It does not decide which business actions your organization allows.
The host is the agent application. Its client talks to an MCP server. The server exposes tools or data. A tool description tells the model what the tool claims to do. An input schema describes the expected fields. A schema can check that a field is a number. It cannot decide that the action is allowed.
A local server runs as a program near the client, often on the same machine. A remote server is reached over a network. HTTP is the ordinary web request format. HTTPS adds transport protection, called TLS. TLS protects the channel. It does not make a malicious document harmless, and it does not approve a tool action.
A local server often talks through standard input and output, the data streams between programs. Launching that server is still code execution. An endpoint is the address that receives a request. Changing the endpoint can send data or credentials somewhere else.
A trusted server can still return an attacker-written ticket or page. Verify the connection and the authorization, then treat the returned content according to its role. It is data.