What is Model Context Protocol (MCP)? A plain-English guide

The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to external systems, such as files, databases, business tools and workflows. Instead of building a separate integration for every AI assistant, a company builds one MCP server, and any MCP-compatible application, such as Claude, ChatGPT or Visual Studio Code, can use it. The official documentation compares it to a USB-C port for AI applications.

Key takeaways

• MCP is an open standard that lets AI applications discover and use tools, data and prompt templates from external systems in a consistent way.
• An AI application (the host) runs one MCP client per connection to an MCP server, which exposes tools, resources and prompts.
• Since December 2025 MCP has been housed in the Agentic AI Foundation, a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI.
• The protocol is free to use; the costs are building, hosting and securing servers, plus the tokens tool definitions add to every request.
• Security is the main pitfall: consent, least-privilege scopes, token validation and sandboxing are required reading before exposing any server.

What does MCP do, in one sentence?

MCP gives AI applications a standard way to find out what an external system offers and to use it. Using MCP, AI applications can connect to data sources, tools and workflows, so they can access information and perform tasks. For a SaaS company, that means one integration can make your product usable from several AI assistants and agents, rather than one custom plug-in per assistant.

Who is behind MCP?

MCP was created by Anthropic and is now governed under a neutral foundation. On 9 December 2025 Anthropic announced it was donating MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation, co-founded with Block and OpenAI and supported by Google, Microsoft, AWS, Cloudflare and Bloomberg. At the time, Anthropic reported more than 10,000 active public MCP servers and over 97 million monthly SDK downloads across Python and TypeScript. The official site lists support in Claude, ChatGPT, Visual Studio Code, Cursor and other clients.

How does MCP work?

MCP uses a client-server design with three participants, defined in the architecture overview:

• MCP host: the AI application, such as an assistant, IDE or your own agent, that coordinates connections.
• MCP client: a component inside the host that keeps a dedicated connection to one MCP server. A host creates one client per server.
• MCP server: a program that provides context and capabilities. It can run locally on the user's machine or remotely as a web service.

Servers offer three core building blocks, called primitives:

Primitive	What it is	Example
Tools	Executable functions the AI can call	Create an invoice, query orders, send a message
Resources	Data that gives the AI context	A file, a database schema, a customer record
Prompts	Reusable templates for interactions	A "summarise this account" template with examples

Clients can also offer features to servers. Elicitation lets a server request additional information from users, including confirmation of an action, which is useful for human approval steps.

Underneath, messages use JSON-RPC 2.0. There are two standard transports: stdio for local servers on the same machine, and Streamable HTTP for remote servers, which supports standard HTTP authentication, with OAuth recommended for obtaining tokens.

What changed in the latest version?

The current documentation is versioned 2026-07-28, and it describes MCP as a stateless protocol: every request carries the protocol version and capabilities, and servers advertise what they support through a server/discover request. The same version deprecates the sampling and logging client features, recommending that new implementations call model providers directly and log through standard tooling. If you built against an earlier version, check the deprecation notes before upgrading.

What does a typical MCP flow look like?

A simple sequence for a user asking an assistant about an order:

1. The host connects to your MCP server and discovers its capabilities.
2. It calls tools/list and receives each tool's name, description and input schema.
3. The host passes those tool descriptions to the language model with the user's question.
4. The model decides to call get_order with an order number; the host sends a tools/call request to your server.
5. Your server checks the user's permissions, queries your system and returns the result.
6. The model uses the result to answer.

MCP itself does not decide how the model uses that context. The documentation is explicit that it focuses solely on the protocol for context exchange.

What are realistic examples for a business?

Three common patterns:

• Make your SaaS usable from AI assistants. Publish a remote MCP server exposing a few safe tools (search records, create a draft, check status) so customers can work with your product from the assistant they already use.
• Connect an internal agent to company systems. An agent can use MCP servers for your CRM, ticketing and documents, instead of custom glue code for each.
• Developer tooling. IDEs and coding agents use MCP servers for repositories, error trackers and databases.

Our worked example of adding an AI assistant to an existing SaaS shows where an MCP server fits alongside an in-product assistant.

What does MCP cost?

The protocol and official SDKs are open source, so there is no licence fee. The real costs are:

• Build time: designing tools with clear names, descriptions and input schemas, and wiring them to your APIs with proper authorisation.
• Hosting and operations for remote servers: uptime, logging, rate limiting and versioning.
• Tokens: every tool definition sent to the model counts as input tokens on each request. The documentation suggests progressive tool discovery for clients connected to many servers rather than loading every tool upfront.
• Security work, covered next, which is usually the largest item for a public server.

What are the main pitfalls?

Security, by a wide margin. The official security best practices describe several attack types, including:

• Confused deputy: a proxy server that skips per-client consent can let an attacker obtain authorisation without the user's approval. Proxy servers must implement per-client consent.
• Token passthrough: servers must not accept tokens that were not explicitly issued for the MCP server.
• Local server compromise: a malicious startup command or server package can run code with the user's privileges, so clients must show the exact command and get explicit approval, and servers should be sandboxed.
• Over-broad scopes: granting every permission up front increases the damage if a token leaks; the guidance recommends minimal initial scopes with step-up authorisation.

On top of protocol security, the usual LLM risks apply. Tool results and resource content can carry instructions that hijack the model, the risk OWASP calls prompt injection, and an agent with powerful tools can cause harm through excessive agency. Keep write tools narrow, require confirmation for anything irreversible, and see our guide to human-in-the-loop AI for where to place approvals.

Should your company build an MCP server?

Build one if customers or your own team want to use your product from AI assistants or agents, and you can expose a small set of well-defined, permission-checked actions. Start read-only, publish two or three tools, measure how they are used and add write actions with confirmation later. If you are still deciding whether you need an agent at all, our comparison of an AI agent vs a chatbot is a better first step.

Frequently asked questions

Is MCP only for Claude?

No. It started at Anthropic but is an open standard now housed in the Agentic AI Foundation under the Linux Foundation. The official site lists support in ChatGPT, Visual Studio Code, Cursor and other clients as well as Claude.

What is the difference between an MCP server and an API?

An MCP server usually sits on top of your existing API. The API serves your application; the MCP server describes a chosen set of capabilities in a standard format that AI applications can discover and call, with schemas and descriptions written for a language model.

Is MCP secure?

The protocol includes an authorisation framework and detailed security guidance, but safety depends on implementation. Validate tokens, request minimal scopes, sandbox local servers, require user consent for new servers and confirmation for risky actions, and treat tool output as untrusted input.

Do I need MCP to build an AI agent?

No. Most model APIs let you define tools directly in your own code. MCP becomes valuable when you want the same tools to work across several AI applications, or want your agent to use third-party servers without custom integrations.

Does MCP affect GDPR compliance?

MCP is a transport for data, so GDPR applies to whatever personal data flows through it. Apply the same lawful basis, minimisation, access control and logging rules as for any integration, and check where the AI application that calls your server processes data.

If you are considering an MCP server for your product, book a free 30-minute call to scope it.

Cover photo by Matheus Bertelli on Pexels.