MCP, the Model Context Protocol, is an open standard for connecting AI applications to business systems such as files, databases, CRMs and internal tools through one agreed interface, instead of a custom integration for every pair. It was introduced by Anthropic in 2024 and is now run as a Linux Foundation project. A business needs it when AI tools it did not build should reach its own systems, or when several agents share the same systems. It is unnecessary for a single in-house agent, a fixed workflow or a document chatbot. Start read-only, scope permissions to the user, and require approval for any action.
What is MCP, in plain terms?
MCP, the Model Context Protocol, is an open standard for connecting AI applications to other software: your files, your databases, your CRM, your calendar, your internal tools. The official site describes it as "an open-source standard for connecting AI applications to external systems" and compares it to a USB-C port: one agreed shape of plug, so that any device can connect to any other without a custom cable for each pair.
Before a standard like this, every connection between an AI application and a business system was written by hand. An assistant that needed to read your helpdesk and your order system needed two custom integrations, and a second AI application needed the same two again. MCP lets a system be wrapped once, as an MCP server, and then used by any AI application that speaks the protocol.
Who is behind MCP, and is it a safe bet?
MCP was introduced by Anthropic in November 2024 and has since been set up as an open project. Its governance page states that it is established as "Model Context Protocol a Series of LF Projects, LLC" under Linux Foundation project policies, with specification contributions under the Apache 2.0 licence and maintainers who sit as individuals rather than as company seats. The current specification version is 2026-07-28.
It is supported across a wide range of AI applications and developer tools - the project's own site lists Claude, ChatGPT, Visual Studio Code and Cursor among them. For a business owner, that is the practical reassurance: you are not betting on one vendor's private format. That said, it is still a young standard that publishes new specification versions as it evolves, which matters if someone is building on it for you.
How does MCP work without the jargon?
There are three roles, and the names are more confusing than the idea.
| Role | What the specification calls it | In plain terms |
|---|---|---|
| Host | The LLM application that initiates connections | The AI app your staff use - a chat assistant, a coding tool, your own agent |
| Client | A connector inside the host application | The plug on the AI app's side, one per connection |
| Server | A service that provides context and capabilities | A wrapper around one of your systems that exposes what the AI may see and do |
A server can offer three kinds of thing to the AI application:
- Resources - information to read, such as documents, records or files.
- Tools - actions the AI model can take, such as creating a ticket or looking up an order.
- Prompts- ready-made instructions and workflows a person can pick, such as "summarise this account".
Underneath, the messages use JSON-RPC, a long-established format for one program asking another to do something. You do not need to know that to make a decision, but your engineers will.
When does a business actually need MCP?
You need MCP when you want AI applications - especially ones you did not build yourself - to reach your own systems in a controlled way. Three situations come up most:
Your staff use an AI assistant and want it to see your systems
If your team already uses an assistant that supports MCP, an MCP server for your internal knowledge base or CRM lets them ask questions of your own data from inside a tool they already use, without a separate custom app.
You are building several agents that share the same systems
If three internal agents all need your order system, wrapping it once as an MCP server and reusing it is cleaner than three copies of the same integration, each with its own permissions and bugs.
You sell software and customers want to use it from their AI tools
If you are a SaaS company, publishing an MCP server for your product lets customers connect it to the AI applications they already use. For some products this is becoming an expected integration, alongside an API.
When don't you need MCP?
More often than the attention suggests. MCP solves a connection problem between AI applications and systems. If you do not have that problem, it adds a layer without adding value.
- One agent, built by you, talking to one or two of your systems. Ordinary function calls in your own code are simpler, and you can switch to MCP later if the need appears.
- A fixed workflow with no AI choosing what to do next. That is workflow automation, and tools like n8n already connect to hundreds of systems.
- A chatbot answering from your documents. That is retrieval (RAG), and MCP is not required for it, though a document search can be exposed over MCP if other AI apps need it.
If you are deciding between a fixed workflow and something more flexible, our notes on n8n and the guide to implementing retrieval augmented generation cover the two most common alternatives.
What are the risks of connecting AI to your systems through MCP?
MCP makes connecting easy, and that is the risk. The specification itself is direct about it: tools "represent arbitrary code execution and must be treated with appropriate caution", and descriptions of what a tool does "should be considered untrusted, unless obtained from a trusted server". It also says the protocol cannot enforce its security principles itself - that falls to whoever builds and configures the connection.
In practice, four things deserve a decision before anything is connected:
- Whose permissions the AI acts with. A server should act as the person using it, with their access, not as an all-powerful service account.
- Which actions need a person to approve. Reading is low risk. Sending, paying, deleting and changing records should need explicit confirmation.
- Where third-party servers come from. A server written by someone else is code running with access to your data. Treat it like any other software supplier.
- What the AI reads. Content from emails, web pages or uploaded files can contain instructions aimed at the AI. Our post on prompt injection and AI agent security explains why that matters most when the AI can also take actions.
How should a business get started with MCP?
- 01
Name the question you want answered
Pick one job: 'let support staff ask about any order from their assistant'. Not 'connect our AI to everything'.
- 02
Start read-only
Expose resources and read tools first. Watch how people use it for a few weeks before allowing any action that changes data.
- 03
Scope permissions per user
Make sure the server checks what the person using it is allowed to see, so the AI cannot become a way around your access controls.
- 04
Add actions with approval
When you add tools that change things, require confirmation for each one, and log who approved what.
If an agent of your own is the end goal rather than a connector for someone else's assistant, our guide to custom AI agents covers the spec, and AI integration covers how we connect AI to existing systems.
What is MCP, and does your business need it?
MCP is an open standard, now run as a Linux Foundation project, that lets AI applications connect to business systems through one agreed interface instead of a custom integration for every pair. You need it when you want AI tools - especially ones you did not build - to reach your own data and systems, or when several agents share the same systems. You do not need it for a single agent of your own, a fixed workflow or a document chatbot. Start read-only, scope permissions to the person using it, and require approval for anything that changes data.