What Is MCP (Model Context Protocol)?

How it works

MCP has two sides. The host is the AI app you use, such as a chat assistant or a coding tool. An MCP server is a program that sits in front of a system, such as a shared drive, CRM, or calendar, and describes what that system offers in a standard format the host understands.

A server can offer three main kinds of things:

• Tools: actions the AI can take, such as “create a task” or “search files.”
• Resources: information, such as documents or records, that the app can pull in for the AI to read.
• Prompts: ready-made templates for common requests that you can choose from.

When you ask a question, the app shares the list of available tools with the AI model, which decides whether to call one. The app may ask you to approve the call first. The server then carries out the request, gets the answer from the underlying system, and sends the result back. Servers can run on your own computer or be hosted online by a vendor.

MCP vs. tool use and APIs

These ideas are often mixed up, but they sit at different layers.

• Tool use is the model’s ability to request an action, such as looking something up or creating a record. It is a capability of the AI itself.
• An API is how one piece of software talks to another. Many business apps already have one, and many MCP servers call it behind the scenes.
• MCP is a shared protocol: a common set of rules for how AI apps talk to the systems they connect to. It packages a system’s actions and data so that AI apps supporting the standard can find and use them.

In practice they work together: an MCP server describes its tools, and the model uses its tool-use ability to call them. Before MCP, AI products typically relied on their own connectors or plugin formats, so the same integration was often rebuilt for each product. With a common standard, one server can work with many AI apps. MCP does not replace APIs, and it does not make a model smarter. It makes connecting a model to your systems more consistent.

Why it matters for your business

Anthropic created MCP, then in December 2025 handed it to the Agentic AI Foundation, part of the nonprofit Linux Foundation, so the standard is no longer run by a single company. Other major AI companies, including OpenAI, Google, and Microsoft, have also announced support for it. Many software vendors now publish MCP servers for their products, and many AI assistants and developer tools can connect to them, often under labels like “connectors,” “apps,” or “integrations.”

For a business, that can mean:

• More ready-made connections. You may be able to link an assistant to your files, CRM, or project tools without building a custom integration.
• Less lock-in. A server built for one MCP-compatible app can often work with others, so switching AI tools does not have to mean starting over.
• Groundwork for agents. An AI agent that works across several systems needs a dependable way to reach them, and MCP is one common way to provide it.

Support still varies by product, and not every app or server offers every feature, so check what a specific tool supports before you plan around it.

Risks and how to manage them

Connecting an AI app to your systems gives it real reach, so treat each MCP server like any software you grant access to.

• Only connect servers you trust. Prefer servers published by the software vendor itself or ones your team has reviewed. A malicious or poorly built server can misuse the access you give it.
• Limit what each server can reach. Grant the narrowest permissions that get the job done, such as read-only access where nothing needs to change, and sign in with accounts that can see only the data the task needs.
• Watch for hidden instructions. Content a server returns, such as an email, web page, or document, can contain text written to trick the AI into doing something you didn’t ask for. This is called prompt injection (more precisely, indirect prompt injection). A malicious server can also hide instructions in its own tool descriptions.
• Approve important actions. Require a person to confirm before the AI sends, deletes, or changes anything that matters, and review records of what it did.

These steps fit within the broader AI guardrails an organization sets for how AI tools may use business data.

Further reading

• AI ImplementationUseful if you want help connecting your systems and putting AI to work inside your existing processes.
• Claude 201 WorkshopA hands-on workshop that covers Claude connectors, a practical way to see an AI assistant working with your other tools.