# llms.txt vs MCP: the difference and how they relate

> How llms.txt differs from the Model Context Protocol (MCP): a file an agent reads versus a protocol with tool calls. The mcpdoc bridge, security and which to choose

Page: https://llms-full-txt.ru/en/reference/mcp-relationship/
Site index: https://llms-full-txt.ru/en/llms.txt

`llms.txt` and MCP are two different systems. `llms.txt` is a file: an agent downloads and reads it. MCP is a protocol: a client program talks to a server, calls tools and receives data.

They do not depend on each other. A separate bridge can connect them, but that is a property of neither the file nor the protocol.

- Two independent systems
- llms.txt
- what is on the site
- Site documentation -> llms.txt
- A static Markdown file
- Any HTTP client will do
- Read only
- Made in 15 minutes
- MCP
- give me data and perform an action
- MCP client -> MCP server
- A protocol on top of JSON-RPC 2.0
- Needs a client and a server
- Read, write and tools
- Needs server development
- An optional bridge
- A separate MCP server that the user gives a list of llms.txt files. An example is mcpdoc.
- llms.txt -> bridge server -> assistant in an editor

## What MCP is

[Model Context Protocol](https://modelcontextprotocol.io/) is an open protocol that connects language models to external data and tools. Anthropic created it in November 2024. In December 2025 the protocol was donated to the Agentic AI Foundation under the Linux Foundation.

Through MCP a model can read files and databases, call APIs, run tools and get context from external sources.

## How they differ

| | llms.txt | MCP |
|---|---|---|
| What it is | a file | a protocol |
| Format | Markdown | JSON-RPC 2.0 |
| How it is obtained | one GET request | a session between a client and a server |
| What is needed | any HTTP client | an MCP client and server |
| What is possible | reading | reading, writing, calling tools |
| Risks | as with any public page | tool poisoning, prompt injection |

## The bridge between them

- How llms.txt reaches an assistant through MCP
- Site
- publishes llms.txt
- llms.txt
- svelte.dev/llms.txt
- Bridge server
- mcpdoc
- the user provides the list of files
- Assistant
- gets pages as a tool

[mcpdoc](https://github.com/langchain-ai/mcpdoc) (langchain-ai) is a separate MCP server. The repository is archived and no longer developed; the example below shows the principle.

1. **The site publishes llms.txt**

   ```markdown title="svelte.dev/llms.txt"
   # Svelte Documentation

   > Svelte is a UI framework that compiles components into efficient JavaScript.

   ## Docs

   - [Overview](https://svelte.dev/docs/svelte/overview): What Svelte is and how it works
   - [SvelteKit introduction](https://svelte.dev/docs/kit/introduction): The application framework
   ```

2. **The user connects the bridge in the assistant settings**

   ```json title="mcp.json"
   {
     "mcpServers": {
       "docs": {
         "command": "uvx",
         "args": [
           "--from", "mcpdoc",
           "mcpdoc",
           "--urls",
           "Svelte:https://svelte.dev/llms.txt",
           "Stripe:https://docs.stripe.com/llms.txt",
           "--transport", "stdio"
         ]
       }
     }
   }
   ```

3. **The assistant requests documentation**

   It gets the list of links from `llms.txt`, loads the pages it needs and answers from fresh documentation.

Another tool of the same kind is [mcp-llms-txt-explorer](https://github.com/thedaviddias/mcp-llms-txt-explorer): an MCP server for navigating the `llms.txt` of any site.

## Security

MCP introduces threats a static file does not have.

| Threat | MCP | llms.txt |
|---|---|---|
| Tool poisoning | a malicious server injects dangerous instructions | not applicable: there are no tools |
| Prompt injection | server data changes model behavior | possible, as on any page |
| Behavior change after trust | the server changes after it is connected | the file can change but performs no actions |
| Data exfiltration | through tool calls | not applicable |

**Confirmed**

- In the [Common Crawl](https://commoncrawl.org/blog) corpus of 584 thousand files, 10 contain a classic prompt injection and 3,793 softly steer the model.
- `llms.txt` performs no actions: it is text.

**Not proven**

- That the file is safe by itself. The proposal text has no security section; the question is discussed in the repository.

**What it does not mean**

- "Read only" does not mean "trusted". An agent must treat the file content as untrusted, like any text from the network.

## What to choose

- An agent has to find documentation and read it: `llms.txt` is enough.
- A model has to perform actions or get private data: MCP is needed.
- Documentation is already described in `llms.txt`, and the assistant works only through MCP: a bridge fits.

## Live examples

Sites that have both `llms.txt` and material about MCP:

- [mcpdoc.ru](https://mcpdoc.ru) - documentation on MCP servers ([llms.txt](https://mcpdoc.ru/llms.txt))
- [n8n-mcp.ru](https://n8n-mcp.ru) - n8n with MCP ([llms.txt](https://n8n-mcp.ru/llms.txt))