What is MCP (Model Context Protocol) and why does it matter?

MCP, the Model Context Protocol, is an open standard that lets AI assistants such as Claude, ChatGPT, Gemini and Microsoft Copilot connect to business systems through one common interface. A system like your CRM or file drive gets one MCP server, and every MCP-compatible AI app can use it. It matters because it cuts integration work and gives you one place to control what AI can reach.

Teams ask what is model context protocol when a software vendor lists "MCP support" on its pricing page, or a developer proposes an MCP server for the company CRM. Anthropic released MCP in November 2024. By December 2025 it had more than 10,000 published servers and a new home at the Linux Foundation.

On this page

• What is Model Context Protocol in plain terms
• Why MCP matters for a business
• What can MCP do for a small business
• How MCP works: hosts, clients and servers
• Local or remote MCP servers: which to choose
• What an MCP server can offer
• MCP vs API: what is the difference
• Who governs MCP and what changed in 2025 and 2026
• Is MCP safe? The security risks to know
• How to vet an MCP server before you connect it
• How is an MCP server built
• What MCP costs: build effort and token overhead
• When should your business use MCP
• How to roll out MCP in your company

What is Model Context Protocol in plain terms

The official MCP documentation describes MCP as "an open-source standard for connecting AI applications to external systems" and compares it to a USB-C port. Before USB-C, every device needed its own cable. Before MCP, every pairing of an AI app and a business system needed its own custom connector.

The arithmetic shows why that hurts. Say a 25-person accounting firm in Illinois wants three AI tools, a desktop assistant, a coding assistant and an internal chatbot, to reach five systems: documents, CRM, calendar, ticketing and the client portal. Without a standard, that is 3 times 5, or 15 integrations to build and maintain. With MCP, each system needs one server and each AI tool needs one client, which is 8 parts, and the AI vendors already ship the clients.

Most firms build fewer than five servers in practice, because software vendors publish their own. Anthropic's launch included ready-made servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer, and the number has grown into the thousands since.

MCP changes what a model can see and do, the same way a new hire becomes useful once IT grants access to the right drives and apps. The model's reasoning stays the same.

Why MCP matters for a business

Adoption settled the question of whether MCP would last. The Linux Foundation's December 2025 announcement lists Claude, Cursor, Microsoft Copilot, Gemini, VS Code and ChatGPT among the platforms that adopted it. Anthropic's donation post reported more than 10,000 active public MCP servers and over 97 million monthly downloads of its Python and TypeScript SDKs.

Four practical benefits follow for a company that uses or sells software:

• One integration serves many AI apps. A server built for your inventory system works in Claude, ChatGPT and a custom assistant without rework.
• Switching models gets cheaper. If a better or cheaper model appears next year, your connections stay in place.
• Access control has a single home. Permissions, logging and approvals sit in the server instead of being scattered across scripts.
• Software vendors gain a sales channel. A SaaS product with an MCP server can be used from inside the AI tools its customers already pay for.

MCP is the plumbing under most modern AI agents. An agent decides what to do, and MCP is a standard way for it to reach the tools that do the work.

What can MCP do for a small business

The useful cases share one shape. A person already asks an AI assistant for help, and the answer lives in a system the assistant cannot see. Typical examples by team:

• Sales: look up a contact's history, log a call note and move a deal stage in the CRM from inside Claude or ChatGPT.
• Support: read the ticket queue, pull order details and draft replies that cite the order record.
• Operations: check stock levels, open purchase requests or read the shipping schedule.
• Finance: read invoice status and aging reports, with no write access at all.
• Marketing: pull last week's ad spend and site analytics into a one-page summary.

A hypothetical 15-person HVAC parts distributor in Georgia has 4 inside sales reps. Each spends about 40 minutes a day switching between the CRM, the inventory screen and email to answer dealer questions. One CRM server and one inventory server, both read-only at first, let a rep ask "what did dealer 114 order last spring, and is that unit in stock?" in one place.

If that saves 20 minutes per rep per day across 21 working days, the team gets back about 28 hours a month. That figure is the one to measure in a pilot, before anyone adds write access.

How MCP works: hosts, clients and servers

The MCP specification defines three roles. Hosts are "LLM applications that initiate connections," such as Claude Desktop, ChatGPT or an IDE. Clients are "connectors within the host application," one per server connection. Servers are "services that provide context and capabilities," such as a server that exposes your CRM.

Messages between them use JSON-RPC 2.0, a plain format for requests and responses that most programming languages already handle. The design borrows from the Language Server Protocol, which lets one code editor support dozens of programming languages through a shared standard.

A typical exchange looks like this:

1. The host connects to a server and asks what it offers.
2. The server returns a list of tools with names, descriptions and input schemas, for example search_contacts(query).
3. A user asks a question, and the model decides a tool would help.
4. The host asks the user for approval where required, then the client sends the tool call to the server.
5. The server runs the action against your system and returns the result for the model to use.

Two standard transports carry these messages. Stdio runs a server as a local program on the same computer as the AI app. Streamable HTTP runs a server on the web, where each message is an HTTP request to a single endpoint.

Local or remote MCP servers: which to choose

The transport decides who maintains the server, how users sign in and where the logs live. The table compares the two options for a business.

For a business, remote servers should be the default. One team can patch them, revoke access when someone leaves and answer an auditor's question from a single log. Keep local servers for developers testing a new integration on their own machines.

What an MCP server can offer

The specification lists three server features, and each serves a different need:

• Tools are "functions for the AI model to execute," such as creating a ticket, updating a deal stage or querying sales by region.
• Resources are "context and data, for the user or the AI model to use," such as a file, a database row or a product sheet.
• Prompts are "templated messages and workflows for users," such as a saved "weekly pipeline review" request that staff can run in one click.

In the other direction, a client can offer elicitation, which lets a server ask the user for missing information mid-task. A booking server might ask which of two clinic locations the customer meant before it reserves a slot.

Optional extensions add more. Tasks handle long-running jobs that need polling. MCP Apps render interactive elements such as charts and forms inside the conversation. Skills over MCP deliver structured instructions for agent workflows. Both client and server must opt in to an extension, so older apps keep working.

Resources overlap with retrieval-augmented generation. A RAG search over your documents can be exposed as an MCP tool, so any AI app can query your knowledge base through the same connection.

MCP vs API: what is the difference

An API is how software talks to software. MCP is how AI apps discover and use those capabilities. Most MCP servers wrap an existing API, so MCP adds a layer instead of replacing anything.

Function calling, also called tool use, is the model-level mechanism: the model returns a structured request and your code runs it. MCP standardizes the layer around it, so a tool defined once can be used by Claude, ChatGPT and others without rewriting it for each.

The recommendation is direct. Keep your APIs as the foundation. Add an MCP server when people need to use those systems from inside AI tools, or when you want one controlled gateway instead of many scripts.

Who governs MCP and what changed in 2025 and 2026

MCP moved fast from a single-vendor project to shared infrastructure. The timeline covers the changes that matter to buyers.

Anthropic, Block and OpenAI co-founded the Agentic AI Foundation, contributing MCP, Block's goose agent and OpenAI's AGENTS.md. Its platinum members include AWS, Bloomberg, Cloudflare, Google and Microsoft. Anthropic's original announcement framed the problem MCP solves: "every new data source requires its own custom implementation."

The July 2026 revision is the most technical change. Earlier versions opened a session with a handshake. Now every request carries its own protocol version and capabilities, which makes remote servers easier to run behind load balancers. Servers built for older versions still interoperate through a compatibility mode.

Is MCP safe? The security risks to know

MCP is as safe as the servers you connect and the permissions you grant. The specification is blunt: tools "represent arbitrary code execution and must be treated with appropriate caution," and tool descriptions "should be considered untrusted, unless obtained from a trusted server." It also requires hosts to get explicit user consent before invoking any tool.

Research on real servers shows why. A June 2025 study from Queen's University in Canada examined 1,899 MCP servers. In its quality-filtered sample, 7.2 percent had general security vulnerabilities and 3.6 percent exposed credentials. In a random sample of 83 servers, 5.5 percent showed tool poisoning, where hidden instructions in a tool description steer the model.

Remote servers raise the stakes. A July 2026 preprint by Nicolas Padilla audited 414 internet-facing production MCP servers and found 91.8 percent lacked OAuth authentication. It counted 687 tool instances that exposed shell execution with no access controls.

The MCP security best practices name the attacks to design against. Token passthrough, where a server forwards tokens not issued to it, is forbidden outright. The page also covers confused deputy attacks on proxy servers, server-side request forgery and compromised local servers, and recommends a least-privilege scope model that starts with read-only access.

How to vet an MCP server before you connect it

Treat every MCP server like a new employee with system access. Run through these checks before anyone in the company connects one:

• Prefer the official server from the software vendor over a community copy with a similar name.
• For remote servers, require OAuth-based sign-in and confirm the server checks that tokens were issued to it.
• Start with read-only scopes. Add write access one tool at a time, after a review.
• Read the full tool list and every tool description, looking for instructions aimed at the model.
• Run local servers in a sandbox with access limited to the folders and network they need.
• Turn on approval prompts for any tool that sends messages, moves money or deletes records.
• Log every tool call with user, inputs and result, and keep the logs where security staff can search them.
• Pin server versions and review changes before updating, the same way you handle any software dependency.

A firm that connects 10 servers needs an owner for this list. Without one, staff will install whatever looks useful, and the AI app will hold the combined permissions of all of them.

How is an MCP server built

Official SDKs exist for Python and TypeScript, and a first server for an existing API is a small project for a developer who knows that API. The work follows a fixed order:

1. Start from the system's existing API and pick the 5 to 10 actions people ask for most.
2. Write each tool's name, description and input schema in plain language. The model reads the description to decide when to call the tool, so vague wording leads to wrong calls.
3. Map each tool to the narrowest API permission that does the job.
4. Add OAuth sign-in if the server will run remotely.
5. Test with the MCP Inspector, the project's debugging tool, then with 30 or 40 real questions in Claude or ChatGPT.
6. Publish the server to the official Registry if customers or partners will use it.

Step 2 decides most of the quality. A tool called get_data with a one-line description will be called at the wrong times. A tool called find_open_invoices_by_customer with a clear description and examples will be called when it should be.

What MCP costs: build effort and token overhead

The protocol is open source and free to use. The costs come from three places: building or hosting servers, reviewing their security, and the model tokens that tool definitions consume on every request.

That last cost catches teams by surprise. Each tool's name, description and schema is sent to the model so it knows what is available. Anthropic's engineering team reported in November 2025 that developers "routinely build agents with access to hundreds or thousands of tools across dozens of MCP servers," and showed one workflow cut from 150,000 tokens to 2,000, a saving of 98.7 percent, by loading tools on demand through code.

Assume a company connects 5 servers with 60 tools, averaging 300 tokens per definition, and runs 10,000 requests a month. At the October 2026 list price of $2 per million input tokens for Claude Sonnet 5.5, the definitions alone cost:

Good design removes most of that cost. Connect only the servers a team needs, expose only the tools each role uses, and use caching or on-demand tool loading for large catalogs.

When should your business use MCP

The table maps common situations to a recommendation.

Automation platforms speak MCP too. The n8n and Zapier comparison notes that both support it, so a workflow you already run can be exposed to an AI assistant as a tool.

How to roll out MCP in your company

1. List the three systems staff most want AI to reach, and who should see what in each.
2. Check whether each vendor publishes an official MCP server.
3. Connect one server with read-only access for a pilot group of five people.
4. Review the logs after two weeks: which tools were called, by whom and with what results.
5. Add write tools with approval prompts once the read-only pilot is clean.
6. Build custom servers only for systems with no vendor server, wrapping your existing API.

Start with step 1 this week, because the access map decides everything after it. The AI development team at Techno Mantra builds MCP servers on top of existing APIs and CRMs, with OAuth, scoped permissions and logging, and connects them to Claude, ChatGPT or Gemini. You own all code and accounts. Share your system list through the contact page or at info@technomantraa.com, and every inquiry gets a reply within one business day.