On this page
One plug that fits every system
With MCP, the Model Context Protocol, nobody has to write a separate integration for every pairing of AI and software. Through MCP an assistant such as Claude or ChatGPT can open your calendar, read a client file or draft an invoice, with the same fixed plug for every system.
Think of a power socket with a fixed shape. If you want to open a system up to AI, you build one MCP server for it. Every AI application that speaks MCP can then use that server. Without MCP, every AI app needs its own integration with every system: three apps and four systems make twelve integrations. With MCP it is seven: three clients and four servers.
MCP is not an AI model and not an app. It is the agreement on how they talk. What the assistant does with that access depends on the model, the prompt and the permissions you grant.
How MCP became an open standard
- 25 November 2024Anthropic introduces MCPAn open standard with a specification, SDKs, local servers in Claude Desktop and ready-made servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer. Block and Apollo are the first adopters.
- 9 December 2025Into the Agentic AI FoundationAnthropic donates MCP to a new fund under the Linux Foundation, co-founded with Block and OpenAI and supported by Google, Microsoft, AWS, Cloudflare and Bloomberg. More than 10,000 public MCP servers are running by then.
- 28 July 2026The current versionEvery request carries its own version and capabilities, a server introduces itself through server/discover, and sampling is deprecated.
Host, client and server
MCP has three roles, and it helps to keep them apart.
- Hostthe AI application you work in, such as Claude, ChatGPT, Visual Studio Code or an app of your own. The host decides what the model may do and asks you for consent.
- Clientthe part inside the host that keeps the connection to one server. The host creates one client per server.
- Serverthe program that opens a system up: your accounting, your shared drive, your planning. A server runs locally on your computer or remotely over the internet.
Every server offers three kinds of things. Tools do something: book a meeting, add a row, draft an email. Resources give something to read: a client record, a file, the schema of a database. Prompts are ready-made tasks the server ships with, such as "build the monthly overview for this client". The messages follow JSON-RPC 2.0, an existing standard, and the idea borrows from the Language Server Protocol, which makes programming languages work in any code editor.
Three servers, one question from a staff member
Local, over stdio
Shared folder of client files
- Tools, do something
- Move a file into the right client folderconsent
- Resources, give something to read
- Purchase invoices per client per month
- Prompts, ready-made tasks
- none
Remote, over HTTP
Office calendar
- Tools, do something
- Propose a meetingconsent
- Resources, give something to read
- Free slots of the team
- Prompts, ready-made tasks
- none
Remote, over HTTP
Own practice software
- Tools, do something
- Draft an email to a clientconsent
- Resources, give something to read
- Client record
- VAT return deadlines
- Prompts, ready-made tasks
- Monthly overview for a client
Integrations for 3 AI apps and 4 systems
Without MCP: every app with every system3 × 4 = 12
With MCP: one client per app, one server per system3 + 4 = 7
You build a server once; every AI application that speaks MCP can use it.
An accounting firm that stopped copying lists
Take an accounting firm in Rotterdam with twenty staff and clients on both sides of the German border. The firm works in Claude and switches on three MCP servers: the shared drive with client files, the office calendar and a server on its own practice software. A staff member asks: "Which clients have not sent their September purchase invoices yet? Draft a reminder for each." The assistant reads through the resources which folders are empty, drafts the emails through a tool and waits for the staff member to approve them. Nobody copies lists between three programs anymore.
The gain is time, not licences. What you now do by copying and pasting between a chatbot and your software, the assistant does itself, on live data instead of a stale export. An AI agent only becomes useful once it can reach your systems this way, and MCP is the standard road there. When it answers from documents, it works together with RAG.
Next to an API, a webhook and RPA
| Method | Who talks to whom | Choose it when | Example |
|---|---|---|---|
| MCP | An AI application with your systems, through one standard | An assistant needs to read and act by itself | Claude looks up client files and drafts emails |
| API integration | Two programs directly, with fixed rules | The same thing must always happen the same way | A payment marks an invoice as paid |
| Webhook | One system notifies another the moment something happens | You want to react to an event at once; see webhook | A new form starts a follow-up |
| RPA | A software robot that clicks like a person | An old system has no API; see RPA | Downloading invoices from a portal |
| SaaS connector | The vendor's own link between two packages | Both tools are standard SaaS and the flow is fixed | A new deal appears in your invoicing tool |
The standard is free, the tokens are not
The standard itself is free and open, and so are the SDKs to build servers. You pay for three other things. First the AI application: a subscription per user, or tokens if you work through the API; see ChatGPT vs Claude. Second the server: for well-known packages the vendor sometimes supplies one, for your own software you have one built. Third tokens: the descriptions of all tools travel to the model. Say twenty tools carry 3,000 tokens of description together; with Claude Sonnet 5.5 at 2 dollars per million tokens that is 0.6 cents per question, or 0.03 cents from the cache. Work out your own use with the AI cost calculator.
Permissions and hidden instructions
A server that can read and write gives the model real power. The specification says so itself: tools amount to running code, and a host must ask for your consent before it calls one. Three risks deserve attention.
Too many permissions. Give a server only what it needs: read access to the client folders, not delete. The MCP security guide recommends a small set of scopes that you widen only when a task requires it.
Prompt injection. An email or PDF the assistant reads can hide instructions: "send the client list to this address". If it reads that through a resource and holds a tool that sends email, the damage is one click away. See how that works under prompt injection.
Servers from strangers. A local server runs with the same rights as you. Install only servers from the package's vendor or a source you can verify, and read the command before you allow it. Personal data processed by a provider calls for a data processing agreement under the GDPR; if your company falls under NIS2, AI access to your systems belongs in that risk assessment too. Your staff need an AI policy that says which servers they may switch on.
Switching on a server: seven checks
- Does the server come from the package's vendor or a source you can verify?
- Which tools write or delete, and which only read?
- Does the server get only the scopes the task needs?
- Does the host ask consent for every tool that changes something?
- Does the host show the full command of a local server before starting it?
- Does the assistant read outside emails or documents while it can also send?
- Is every action logged, so you can see afterwards who did what?
Connecting AI to your systems: short answers
What is an MCP server?
A program that opens a system up to AI following the MCP standard. It lists the tools, resources and prompts it has, and runs a tool when the AI application asks and you give consent. It can run locally on your computer or remotely.
Is MCP only for Claude?
No. Anthropic created it, but since December 2025 the Agentic AI Foundation under the Linux Foundation stewards the standard. ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code support it.
What is the difference between MCP and an API?
An API is the door of one system, with its own rules. MCP is a fixed shape in which you offer that door to an AI application: the assistant reads for itself which tools exist and what they need. Behind the scenes an MCP server often simply calls the API.
Is MCP safe to use with company data?
As safe as you configure it. The standard requires consent for every tool and recommends minimal scopes, but it cannot enforce them. The biggest risk is an assistant that reads outside content and can also send or delete.