Every useful AI agent needs to reach beyond the model: your CRM, your ticketing system, your documents, your databases. Historically each connection was custom glue code, repeated for every app and every model, a classic N-times-M integration problem.
The Model Context Protocol (MCP) is an open standard that fixes this. Introduced by Anthropic in late 2024 and since adopted widely across the AI ecosystem, it defines one common way for AI applications to discover and use external tools and data. A common analogy: MCP is a universal connector for AI, much as USB-C standardised how devices connect to peripherals.
How MCP works
MCP uses a client-server model over JSON-RPC:
- Host: the AI application the user interacts with (an assistant, IDE or agent platform).
- Client: a connector inside the host that maintains a connection to one server.
- Server: a lightweight program that exposes capabilities from a system, such as Jira, Salesforce, Postgres or a file store.
AI host
Assistant or agent app
MCP client
One per connected server
MCP server
Wraps a tool or data source
Your systems
CRM, ERP, DBs, APIs
What a server can expose
| Primitive | Controlled by | Purpose |
|---|---|---|
| Tools | The model | Actions the model can invoke, e.g. create a ticket, run a query. |
| Resources | The application | Data to read into context, e.g. a document or record. |
| Prompts | The user | Reusable, templated workflows a user can trigger. |
Servers run locally (over standard input/output) or remotely (over HTTP), and MCP includes an authorization approach built on OAuth for remote servers.
Why enterprises care
- Build once, reuse everywhere. One MCP server for an internal system works across compatible assistants and agents.
- Less lock-in. A standard interface makes swapping models or agent platforms far easier.
- Faster delivery. A growing ecosystem of ready-made servers means fewer custom integrations.
- Central governance. One well-managed gateway layer is easier to secure and audit than dozens of bespoke integrations.
Security and governance: do not skip this
MCP makes it easy to connect agents to powerful systems, which is exactly why it needs discipline:
- Least privilege. Scope each server's credentials narrowly and prefer read-only where possible.
- Vet servers. Treat third-party servers like any dependency: review, pin versions and prefer trusted sources.
- Beware prompt injection. Text returned by tools is untrusted input and can contain instructions aimed at the model. Validate, filter and require approval for sensitive actions.
- Authenticate and authorise per user. Actions should run with the end user's permissions, not a shared super-account.
- Log everything. Keep audit trails of tool calls, arguments and outcomes.
Considering MCP for your stack? See our enterprise AI agents service or talk to us.