MCP client
The application that hosts the model and performs the tool calls it decides to make, such as Claude, Cursor or ChatGPT.
What makes it wrong.
The mechanism, not the warning.
Clients differ in what they will actually do with a server. Some cap how many tools they will load, some do not support resources at all, some require confirmation before every write and some do not. A server that behaves well in one client can be unusable in another, and the protocol does not guarantee otherwise.
In detail.
The client is the half of the protocol people actually use. It connects to servers, presents their tools to the model, executes the calls, and hands the results back into the conversation. It also owns the parts a model cannot do safely on its own: storing credentials, asking a person for permission, and refusing a call.
This is the distinction that gets reversed most often. A website that exposes an MCP endpoint is a server, not a client, even if it has a user interface. A client is what consumes servers.