Updated September 20, 2026
MCP is being described as the USB-C port for AI. The analogy is helpful, but it can also hide the part you actually need to understand: MCP gives an AI application a standard way to discover and use outside tools and information.
Model Context Protocol does not make a model smarter. It gives the model a structured doorway to approved resources. That doorway still needs a lock, an access list and someone responsible for what comes through it.
MCP in one example
Suppose you ask an AI assistant, “Find next week’s customer calls and prepare a briefing from our CRM.” The model cannot do that from general training data. It needs live access to your calendar and customer records.
With MCP, the AI host can connect to servers that expose specific capabilities: search calendar events, read an approved CRM record, or create a draft document. The assistant sees the available tools, calls the relevant ones and uses the returned information in its response.
The three parts: host, client and server
| Part | Plain-English role | Example |
|---|---|---|
| Host | The AI application you use | A desktop assistant or coding environment |
| Client | The connection inside the host | Manages one MCP server connection |
| Server | Exposes approved data or actions | Calendar search, file access or database query |
The protocol was introduced by Anthropic in November 2024 and released as an open standard. Since then, tool makers and AI platforms have adopted the idea because every integration no longer needs a completely different interface.
Resources, tools and prompts
An MCP server can offer different kinds of capabilities. Resources are information the assistant can read. Tools are actions it may perform. Prompts are reusable instructions or workflows a server can make available.
This distinction matters for risk. Reading a product manual is not the same as sending an email. Searching a read-only database is not the same as changing a customer record. Treat every tool as a permission, not a feature tick box.
MCP is not the same as RAG
Retrieval-augmented generation, or RAG, usually finds relevant material from a knowledge source and places it in the model’s context. MCP is broader: it is a protocol for connecting AI applications to resources and actions. An MCP server might expose a RAG search tool, but the two terms are not interchangeable.
A simple way to remember it: RAG helps answer “what information should the model read?” MCP helps answer “how can this AI application communicate with an outside capability?”
Why businesses care
- Less one-off integration work: compatible clients can use a shared protocol.
- Tool discovery: the AI can see structured descriptions of available capabilities.
- Cleaner separation: the model, application and business system do not have to be one product.
- More portable workflows: a server may work with more than one compatible host.
That is the promise. Compatibility still varies, authentication needs care, and an integration can be badly designed even when it follows a standard.
The security questions people skip
An MCP connection may put valuable data and real actions within reach of an AI system. Malicious instructions can also be hidden inside documents or web pages. This is why “connect everything” is a poor starting point.
- Use read-only access for the first test.
- Install servers from a source you can identify and review.
- Keep secrets out of prompts and plain-text configuration.
- Approve sensitive actions such as sending, deleting, paying or publishing.
- Log tool calls and review unusual activity.
- Remove connections that are no longer used.
The OWASP Cheat Sheet Series now includes guidance for AI agents, MCP security, prompt injection and secrets management. Those are useful starting points before an experiment becomes part of normal work.
A safe first MCP project
Connect an assistant to a small read-only folder containing non-sensitive reference documents. Ask ten questions whose correct answers you already know. Check whether it selects the right resource, quotes the right passage and admits when the answer is missing. Do not begin with email, payments or your entire shared drive.
If the test works, add one narrowly scoped tool. Define what it may do, when approval is required and how you will spot misuse. That sounds cautious because it is. Protocols reduce connection friction; they do not remove operational responsibility.
For context on the systems using these connections, read AI agents in 2026. Then use our AI agent security checklist before connecting company data.
What can go wrong in an MCP connection?
- Over-broad tools: a server exposes write access when the task only needs search.
- Misleading descriptions: a tool name or description hides what the action really changes.
- Prompt injection: retrieved content tries to redirect the model or trigger a tool.
- Credential leakage: secrets appear in configuration, logs or error messages.
- Server changes: an update adds capabilities or changes behaviour without a fresh review.
- Confused identity: the connection acts with a shared account, making ownership hard to trace.
None of these problems makes MCP unusable. They mean the server belongs in the same inventory as an API integration or browser extension. Record its owner, source, version, permissions, connected data, approved hosts and last review date.
Questions to ask before installing a server
- Who publishes and maintains it?
- Can we inspect the code or a trustworthy security review?
- Which resources and tools does it expose?
- How does it authenticate, and where are credentials stored?
- Can we restrict it to read-only access or specific folders?
- What is logged, retained and sent to third parties?
- How will we revoke access and remove it?
Re-run those questions after a meaningful update. A connection that was safe last quarter may have new tools or dependencies today.
The part to remember
MCP is plumbing. Good plumbing makes useful things possible, but you do not judge it by how exciting the pipe looks. You judge it by what it connects, what may flow through it and whether you can shut it off when something goes wrong.
Sources
Would you give an assistant read access to your calendar? What about permission to create events? The gap between those answers is exactly where a sensible MCP policy begins.
