They're open standards for opposite sides of the same interaction. MCP (Model Context Protocol) connects AI agents to tools and data so a model can act: fetch, query, execute. OpenCues standardises the draft side: cues and blanks that improve text before you submit it, with a hard rule that model output never becomes an action.
The action channel is the dividing line
MCP's whole point is giving models capabilities; its security story is about scoping what a connected server may do. OpenCues takes the inverse position: a conformant runtime MUST NOT route LLM output into tool execution, network fetches, clipboard or file writes, or an MCP call. Worst-case prompt injection lands as visible words in your unsent draft, which you review before anyone else sees them.
Different layers, no overlap
| MCP | OpenCues | |
|---|---|---|
| Standardises | Agent ↔ tools/data connections | Config formats for inline text assistance |
| Operates | After submission, inside the agent's turn | Before submission, in your input |
| LLM output becomes | Actions (tool calls, queries) | Draft text only, by normative rule |
| Unit of extension | A server | A folder of markdown |
They compose naturally: an agent wired to MCP servers still gets its instructions typed into a text box, and that text box is exactly where OpenCues works. Sharpen the prompt inline, press Enter, and MCP takes it from there.
What OpenCues borrowed
The project openly learned from MCP's rollout: its spec-change process is modelled on MCP's SEPs, and its security posture was designed against lessons from prior open-standard launches. Same ecosystem philosophy, different layer.
Related: OpenCues vs SKILL.md · Security model · The open standard · What is an open standard for AI? · GitHub repo