What Is MCP? The Model Context Protocol Explained

What is MCP? The Model Context Protocol is an open standard that lets AI applications such as Claude, ChatGPT, Gemini, and Microsoft Copilot connect to external systems in a consistent way: your CRM, your documents, your database, your accounting software. Think of it as a universal plug. You build one MCP connection for a system, and any AI application that supports MCP can use it. Anthropic introduced MCP in November 2024, and since December 2025 it has been governed under the Linux Foundation.

The short version:

MCP is an open protocol that gives AI applications standardized access to tools and data in other systems.

OpenAI, Google, and Microsoft support it; Anthropic reported more than 10,000 active public MCP servers by late 2025.

Security is the main concern: an MCP server gives an AI model real permissions, and attacks on that have already been documented.

Building your own MCP server makes sense when several AI applications need controlled access to the same internal system.

What is MCP, exactly?

Before MCP, every AI application needed its own integration with every system. Connecting Claude to your CRM and ChatGPT to the same CRM meant two separate integrations, each in its own format. With ten AI tools and twenty systems, that quickly gets out of hand.

MCP fixes this with one agreement on how an AI application and a system talk to each other. The protocol defines:

how an AI application discovers what a system offers;
how the model invokes an action and gets the result back;
how data and context are shared.

It is not an AI model or a product. It is a specification. Under the hood, messages use JSON-RPC 2.0: structured JSON with a fixed format for requests and responses. So is MCP "just JSON"? The messages are, but the value is in the agreed structure on top: tool discovery, descriptions, and a shared way to call them.

How does MCP work?

MCP has three roles:

Role	What it is	Example
Host	The AI application the user works in	Claude Desktop, ChatGPT, VS Code, Cursor, or your own agent
Client	The component inside the host that manages the connection to one server	Built into the host
Server	The program that exposes a system through MCP	An MCP server for your CRM, Google Drive, or database

An MCP server can offer three kinds of things:

Tools: actions the model can take, such as find_customer, create_task, or get_invoice.
Resources: data that can be loaded as context, such as a document or a record.
Prompts: predefined instructions or workflows for common tasks.

Connections run locally (the server runs as a program on your own machine, over "stdio") or over the network via HTTP. For remote servers, the specification describes OAuth-based authorization.

In practice: you ask Claude "which customers have an open quote older than thirty days?" Claude sees that your CRM's MCP server offers a search_quotes tool, calls it with the right filters, gets the list back, and summarizes it for you.

Why MCP became the standard

MCP went from an Anthropic project to the de facto standard in about a year:

November 2024: Anthropic introduces MCP as an open standard.
March 2025: OpenAI announces MCP support in its Agents SDK, the ChatGPT desktop app, and the Responses API. Sam Altman: "People love MCP and we are excited to add support across our products."
December 2025: Anthropic donates MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, and others.

At that point, according to Anthropic, there were more than 10,000 active public MCP servers and over 97 million SDK downloads a month. It is supported by ChatGPT, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code, among others.

For businesses, the move to the Linux Foundation mainly means stability: MCP is no longer one vendor's protocol, so investing in an MCP integration is less dependent on a single company.

MCP vs API vs RAG

These are the questions we hear most, and they are fair, because the concepts overlap.

	API	MCP	RAG
What it is	One system's interface, in its own format	A standard protocol between AI applications and systems	A technique for retrieving relevant documents and passing them to a model
Built for	Any software	AI applications and agents specifically	AI that grounds answers in your own data
Can it take actions	Yes	Yes, through tools	No, retrieval only
How they relate	The foundation an MCP server usually calls	Often wraps an existing API in an AI-friendly format	Can be offered through an MCP server

MCP does not replace your API. An MCP server usually calls your system's existing API. It adds a layer that AI models understand: descriptions of what each tool does and which parameters it expects.

MCP does not replace RAG. RAG is a way to find the right passages in your documents. An MCP server can expose that search as a tool. For more, see retrieval-augmented generation explained.

The security risks of MCP

This is where businesses need to pay attention. An MCP server gives an AI model access to real data and real actions. Whatever an attacker can get the model to do, they can do to your systems.

Tool poisoning. In 2025, Invariant Labs described attacks where malicious instructions are hidden in an MCP tool's description. The model reads the description; the user never sees it. An innocent-looking tool can instruct the model to exfiltrate data.

Prompt injection through data. When an agent reads emails, web pages, or documents, those can contain instructions the model tries to follow. Combine that with a tool that can send email or share files, and you have a data leak.

Vulnerabilities in local execution. In April 2026, security firm OX Security reported a systemic issue in MCP's local STDIO execution model, with at least ten CVEs across different projects. According to OX, Anthropic described the behavior as "expected" and places responsibility for input sanitization on developers. That is OX's account, but the lesson is clear: treat MCP servers as software with privileges, not as harmless plugins.

Practical safeguards:

Do not install random MCP servers from the internet on machines with access to company data. Use official vendor servers or build your own.
Grant minimal permissions. A server that only needs to read gets no write access.
Separate reading from acting. Require human confirmation for impactful actions such as sending, paying, or deleting.
Log every tool call so you can reconstruct what happened.
Review tool descriptions of the servers you use, and pin versions so an update cannot silently change behavior.

When should you build your own MCP server?

Not every AI project needs MCP. The rule of thumb:

Build your own MCP server when:

several AI applications need access to the same internal system, for example staff who want to query your in-house scheduling system from Claude or Copilot;
you run your own platform and customers or partners want to use it from their own AI tools;
you want one central place to control which actions AI may take on a system, with shared permissions and logging.

You do not need your own MCP server when:

you are building a single agent inside your own application. You can define tools directly in code through tool calling, without the extra layer;
a good official MCP server already exists for the system you want to connect;
you only need a one-off data exchange.

For how tool calling works and how an agent talks to your systems, see what is an AI agent. For the broader picture of agents that act on their own, see agentic AI vs generative AI.

Frequently asked questions

What is MCP used for?

MCP is used to connect AI applications to external tools and data, such as CRMs, file storage, databases, and internal business systems. It lets a model look up information and take actions in those systems through one standard interface instead of a custom integration per tool.

What is the difference between MCP and an API?

An API is the interface of one specific system, in its own format. MCP is a standard protocol AI applications use to talk to many systems. An MCP server usually calls the existing API and adds descriptions that an AI model can understand and act on.

Does ChatGPT use MCP?

Yes. OpenAI announced MCP support across its products in March 2025, and ChatGPT is listed by Anthropic among the applications that support MCP. Gemini, Microsoft Copilot, Cursor, and Visual Studio Code support it too.

What is MCP vs RAG?

RAG retrieves relevant passages from your documents and passes them to a model so it can answer from your own data. MCP is a protocol for connecting AI applications to systems, including for actions. They complement each other: a RAG search can be offered as a tool on an MCP server.

Is MCP secure?

MCP is as secure as the servers you run and the permissions you give them. Attacks such as tool poisoning and vulnerabilities in local execution have been documented. Use only trusted servers, grant minimal permissions, require human confirmation for risky actions, and log everything.

Next steps

Start by asking which systems your AI applications need and who should have access. If it is one agent for one process, direct tool calling is often enough. If you want to open up a system to several AI applications, a dedicated MCP server with tight permissions is the clean route. To discuss which approach fits your situation, take the free AI scan or read more about our services.

Sources

Anthropic: Donating the Model Context Protocol and establishing the Agentic AI Foundation (December 9, 2025)
Linux Foundation Announces the Formation of the Agentic AI Foundation (December 9, 2025)
TechCrunch: OpenAI adopts rival Anthropic's standard for connecting AI models to data (March 26, 2025)
Model Context Protocol: documentation and specification (accessed September 26, 2026)
Invariant Labs: MCP Security Notification: Tool Poisoning Attacks (April 2025)
OX Security: Critical, Systemic Vulnerability at the Core of Anthropic's MCP (April 15, 2026)

Get started today