Key takeaways
- The Model Context Protocol (MCP) is an open standard for connecting AI applications to tools and data sources.
- Anthropic introduced MCP in November 2024, and by mid-2025 OpenAI, Google and Microsoft had announced support.
- An MCP server exposes tools, resources and prompts; AI applications act as clients that discover and use them.
- MCP makes integrations reusable, but every server must be treated as a security boundary with proper authentication and permissions.
AI assistants become far more useful when they can read your data and take actions in your systems. Until recently, every AI product needed its own custom connector for every tool. The Model Context Protocol, or MCP, aims to change that by providing one standard way to connect them.
What MCP is
MCP is an open protocol, introduced by Anthropic in November 2024, that defines how AI applications communicate with external systems. It is often compared to a universal port: build an MCP server for a system once, and any MCP-compatible AI application can use it. In the first half of 2025, OpenAI, Google and Microsoft each announced support for MCP in their AI platforms and tools, which made it the leading candidate for a common standard.
How it works
| Component | Role |
|---|---|
| MCP host | The AI application the user interacts with, such as a desktop assistant or IDE |
| MCP client | The connector inside the host that talks to a server |
| MCP server | A program that exposes a system’s capabilities to AI |
| Tools | Actions the AI can call, such as “create invoice” or “search tickets” |
| Resources | Data the AI can read, such as files or records |
| Prompts | Reusable templates the server offers for common tasks |
Servers can run locally on a user’s machine or remotely as a web service. The AI application discovers what a server offers and decides when to use its tools, usually with the user’s approval for actions.
Why it matters for businesses
- Reusable integrations. One MCP server for your CRM or ERP can serve several AI tools and agents.
- Less lock-in. If you change AI providers, standard connectors can come with you.
- Faster experimentation. Connecting an assistant to internal data becomes a configuration task rather than a project.
- Growing ecosystem. Many software vendors and open-source projects publish MCP servers for their products.
Example use cases
- A sales assistant that reads CRM accounts and opportunities and drafts follow-ups.
- A support agent that searches the knowledge base and creates or updates tickets.
- A finance assistant that queries invoices and payment status in the ERP.
- A developer assistant that reads code repositories, issues and documentation.
Security considerations
MCP makes it easy to give AI powerful access, which is exactly why security matters. Treat every MCP server as you would any integration with production data:
- Authenticate users and servers properly; remote servers should use standard authorization such as OAuth.
- Apply least privilege: expose only the tools and data the use case needs, scoped to the user’s permissions.
- Require confirmation for actions that change data, spend money or contact customers.
- Only install servers from trusted sources, and review what they can do.
- Be aware of prompt injection: content returned by tools, such as emails or web pages, can contain instructions that try to manipulate the AI.
- Log tool calls for audit and troubleshooting.
Should you build an MCP server?
If you want AI assistants and agents to work with your internal systems, a well-designed MCP server is becoming a sensible way to expose them, alongside or on top of your existing APIs. Start with read-only tools for a single use case, add carefully scoped actions, and expand once security and value are proven. Our AI solutions team designs these integrations with security built in.
A worked example: an MCP server for a CRM
Imagine a company that wants its staff to ask an AI assistant questions about customers. An MCP server is built on top of the CRM’s API with three tools: search accounts, get account details, and create a follow-up task. It authenticates each user, so the assistant only sees records that user can see in the CRM, and the create-task tool asks for confirmation before writing anything. Staff can now ask “What happened with Acme this quarter and what should I do next?” and get an answer grounded in real records, with a follow-up task created in one step.
Questions to ask before connecting AI to a system
- Which data does the use case genuinely need, and which should stay out of reach?
- Will the AI act as the user, with their permissions, or as a service account?
- Which actions require human confirmation?
- Where are tool calls logged, and who reviews them?
- What happens if a server is unavailable or returns an error?
Frequently asked questions
Is MCP only for Anthropic’s Claude?
No. MCP is an open standard, and other major AI providers and many tools have adopted or announced support for it.
Does MCP replace APIs?
No. MCP servers usually sit on top of existing APIs, translating them into tools and resources AI applications can discover and use.
Is MCP secure?
The protocol supports secure patterns, but security depends on implementation: authentication, permissions, confirmation of actions and trusted servers.
