What is MCP, and what does it mean for a business?

An AI assistant knows a lot in general but nothing about your business: who your customers are, which invoices are unpaid, what's in stock. To find out, it has to be connected to the programs where that data lives. MCP is now the standard way to make that connection. Here's what it is, how it works, how it differs from an API, and what to watch.

What MCP is, in short

MCP (Model Context Protocol) is an open protocol that connects AI applications to data sources and tools. Anthropic launched it in November 2024, and in December 2025 donated it to the Agentic AI Foundation, a fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft and AWS.

At the time of the donation, MCP was used by ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code, there were more than 10,000 active public MCP servers, and the SDKs had 97 million monthly downloads.

The usual comparison: MCP is to AI what USB-C is to devices. One kind of connector, and any program that has it works with any assistant that accepts it.

Why it exists

Before MCP, every connection was built separately: one integration between ChatGPT and a CRM, another between Claude and the same CRM, another between Copilot and the invoicing tool. Ten assistants and ten programs meant, in theory, a hundred integrations. With a common standard, each program builds one MCP server, and each assistant learns MCP once.

How it works

The specification has three roles:

A server can offer three kinds of things:

• resources: data the AI can read, such as a customer record or a document;
• tools: actions the AI can take, such as "find order", "create invoice", "send quote";
• prompts: ready-made instructions for frequent tasks.

When you ask the assistant "Which invoices from customer X are unpaid?", it looks at the tools it has, picks the right one from the invoicing server, gets the answer and writes you the result.

MCP vs API: what's the difference?

An API is an interface for developers: someone writes code that calls it, for a specific integration. An MCP server usually sits on top of the same API but presents it in a form the AI assistant understands on its own: every tool has a name, a description and parameters. The assistant discovers the tools when it connects and decides when to use them.

If your software has an API, an MCP server can be built for it. If it doesn't, that's the first step.

What a small business can do with MCP

Some examples that already exist:

• Payments. Stripe runs an official MCP server: the assistant can look up customers and payments, create payment links or invoices. Some actions, such as refunds, require confirmation in the Stripe Dashboard before they run.
• CRM. HubSpot has an MCP server that reads and writes contacts, deals, tickets and notes. You can ask "Which quotes went unanswered this week?" without opening the CRM. Our small business CRM guide covers the options.
• Automations. n8n can be an MCP server (your workflows become tools for Claude or ChatGPT) and an MCP client (agents in n8n use outside servers). How it compares with Make and Zapier is in n8n vs Make vs Zapier.
• Your own software. Your product database, bookings, stock or internal documents can get an MCP server, so staff can query them from the assistant they already use.

MCP is also how AI agents are built today: the agent gets a goal, and MCP servers give it the hands to work with.

The risks

An MCP tool means the AI can do something real: send an email, change an order, delete a contact. The specification says tools must be treated as code execution and that the host must get the user's explicit consent before invoking a tool. In practice:

1. Least privilege. The account behind the MCP server has only the permissions it needs. Read-only when reading is enough.
2. Confirmation for anything irreversible. Payments, deletions, messages to customers: a person approves.
3. Servers only from trusted sources. A tool description can carry hidden instructions for the AI. The specification says descriptions should be treated as untrusted unless the server is trusted.
4. Watch the combinations. An assistant connected to email and to a server that sends data out can be tricked by an email containing instructions. Stripe warns about this prompt-injection risk in its documentation.
5. Personal data. What the server returns reaches the AI model. Check where data is processed and what the provider's terms say. If the AI talks to customers directly in the EU, the AI Act applies too.

When a custom MCP server is worth it

It's worth it when:

• your team already uses Claude, ChatGPT or Copilot and wastes time copying data from programs into the chat;
• you have your own software or database with no existing connector;
• you want an agent that works on its own, for example one that answers enquiries, checks stock and drafts the quote.

It isn't worth it when your data sits in a program that already has an official connector: you turn it on and you're done. Nor for a fixed task that repeats identically; a classic automation is cheaper and more predictable there. What AI automation costs, model included, is in our pricing guide.

We build AI agents and MCP servers for the software a business already uses, with least-privilege access, confirmation for important actions and a log of everything the AI did. Details are on our AI agents page.