A program that offers capabilities (tools, resources, prompts) to an MCP client. It may run locally as a child process or remotely over HTTP. A server enforces its own limits, but the client can’t see or verify them, so the client treats it as untrusted.