Which MCP architectural role is responsible for enforcing user consent policies and orchestrating the AI workflow?

MCP has three roles, and the trick is keeping them straight. The **host** is the application you actually open, Claude Desktop, Cursor, or your own app. It runs the conversation and shows you the approval prompts. Inside that host live one or more clients. A client is a thin connector: the host spins up exactly one client for each server it wants to talk to. The client's only job is to manage that one JSON-RPC connection and shuttle messages back and forth. A server is a separate program that exposes capabilities: tools the model can call, resources it can read, and prompts the user can pick. A filesystem server, a GitHub server, a Postgres server, each runs on its own. So who enforces consent? The host. It is the only role that sees the user, so it is the only one that can ask 'do you approve this tool call?' and remember the answer. The server cannot enforce a policy it never sees, and the client is just plumbing. That is why the host owns orchestration and permissioning.

MCP defines three roles, and the host is the one that orchestrates and enforces consent. The **host** is the user-facing application, Claude Desktop, Cursor, or a custom app embedding an LLM. It drives the conversation, decides which servers to connect, and gates every tool call behind user approval. Because it is the only role the user interacts with, it is the natural enforcement point for consent. The relationship is one host to many clients to many servers. The host creates exactly one client per server connection. A client is a protocol-layer component that owns a single JSON-RPC session and its lifecycle. Clients do not make policy; they carry messages. Servers sit outside the host as independent processes. Each server exposes tools, resources, and prompts, and may hold credentials for a backend API. But a server cannot enforce the user's consent policy. It has no view of the user and no authority over the workflow. The distractor options invert this. The server holding credentials does not make it the policy authority. The client managing the connection makes it plumbing, not a gatekeeper.