Short answer
What is MCP (Model Context Protocol) and what has changed?
Short answer
The Model Context Protocol (MCP) is an open standard that defines how an AI application connects to external systems, such as databases, CRMs, documents or tools, to read information and take actions. It works like a universal connector: each system is exposed once as an MCP server, and any compatible assistant or agent can use it.
It was created by Anthropic, the company behind Claude, which released it as open source on 25 November 2024 with the first connectors for Google Drive, Slack, GitHub and Postgres. The official documentation compares it to a USB-C port: one connector for very different systems.
In less than two years it has stopped being one vendor’s bet. The big AI providers have built it in, it has moved to a neutral foundation and, as of 12 October 2026, its current specification has been redesigned to run on ordinary company infrastructure.
- 25 Nov 2024
Anthropic launches MCP as an open standard
Specification, software development kits (SDKs) and local servers in Claude Desktop.
- 26 Mar 2025
OpenAI adopts it
Sam Altman announces support in the Agents SDK and, later, in ChatGPT and the Responses API.
- 9 Apr 2025
Google DeepMind joins in
Demis Hassabis announces that Gemini models and the Gemini SDK will support MCP.
- 19 May 2025
Microsoft and GitHub join the steering committee
They announce support in Windows 11 and Azure. On 21 May, OpenAI follows.
- 8 Sep 2025
The official MCP server registry is born
An open catalogue of public servers, in preview.
- 9 Dec 2025
Anthropic donates MCP to the Agentic AI Foundation
The foundation, under the Linux Foundation, is co-founded by Anthropic, Block and OpenAI.
- 28 Jul 2026
The 2026-07-28 specification
A stateless core and stronger authorisation. It is the current version.
One name, many ways to write it
MCP is one piece of an AI agent. An agent decides which steps to take and needs tools to take them; MCP is the standard way to hand it those tools. For the wider picture, see my guide to the difference between an AI agent, a chatbot and an automation and the article on what agentic AI is and what it already does in business.
What is an MCP server and how does it work?
An MCP server is a program that exposes a system (your CRM, a database, a document folder) in a format that any AI application compatible with the protocol understands. In the documentation you will also see them called model context protocol servers. According to the official architecture, three pieces are involved:
- Host: the AI application, such as Claude, ChatGPT or your own agent.
- MCP client: the component inside the host that connects to each server.
- MCP server: the program that offers a system’s data and actions.
Each server offers tools (actions such as looking up an order or sending an email), resources (context data, such as a customer record) and prompts, which are instruction templates for the model. The model decides what to use at each moment.
A local server runs on the same computer as the AI application. A remote one lives on the internet, often in the provider’s cloud, and the protocol recommends OAuth, the standard behind “Sign in with…” buttons, to obtain permissions.
Custom integration versus MCP
| Criterion | Custom integration | With MCP |
|---|---|---|
| How it connects | One build for every pair of AI tool and system | One server per system, usable by any compatible client |
| If you change model | The integration has to be adapted or rebuilt | The server is reused with Claude, ChatGPT, Gemini or Copilot |
| Authorisation | Solved case by case | Standard OAuth and, since 2026, central management through your identity provider |
| New risks | Those of any API | Prompt injection and unreviewed third-party servers |
| When it makes sense | One system and one AI tool, with no plans to change | Several systems or several AI tools |
MCP does not replace your APIs: servers are built on top of them. Google, for example, announced in December 2025 that Apigee will let a company expose its APIs as tools for agents.
MCP does not decide what AI reads on your website
Who already uses the Model Context Protocol?
Anthropic, OpenAI, Google and Microsoft all use it: the Linux Foundation describes it as adopted by Claude, Cursor, Microsoft Copilot, Gemini, VS Code and ChatGPT.
- Anthropic. Claude Desktop supported local servers from launch and, since 1 May 2025, Claude can connect to remote servers, with integrations such as Atlassian, Zapier, Asana and PayPal. That is why a search for “MCP Claude” only tells part of the story: Claude was the first client, not the only one.
- OpenAI. Support in the Agents SDK since 26 March 2025 and remote servers in the Responses API since 21 May 2025.
- Google. Demis Hassabis (Google DeepMind) announced support in Gemini models on 9 April 2025. On 10 December 2025 Google Cloud launched managed MCP servers for services such as Maps and BigQuery, with access control, auditing and defences against prompt injection. This fits with Gemini Enterprise, Google’s agent platform.
- Microsoft. It joined the steering committee on 19 May 2025 and, on 29 May, MCP became generally available in Copilot Studio, the tool for building agents in Microsoft 365 with Copilot Studio.
10,000+
active public MCP servers in December 2025
Anthropic, 9 Dec 2025
97M+
monthly downloads of the Python and TypeScript SDKs in December 2025
Anthropic, 9 Dec 2025
≈500M
monthly downloads of the official tier-1 SDKs in July 2026
MCP blog, 28 Jul 2026
≈2,000
entries in the official registry in November 2025, up 407% on September
MCP blog, 25 Nov 2025
My reading: MCP has stopped being a technical bet and has become infrastructure. The question is no longer whether your AI tools will use it, but what you are going to let them touch.
The official MCP server registry
The official registry launched in preview on 8 September 2025: an open catalogue of public servers, with information declared by their own owners. Companies can build private sub-registries on top of it, and the community can report spam, malicious code or impersonation so that entries are removed. My advice: treat it as a directory, not as a seal of quality.
Who is in charge now: the Agentic AI Foundation
On 9 December 2025 Anthropic donated MCP to the Agentic AI Foundation, a directed fund within the Linux Foundation co-founded by Anthropic, Block and OpenAI. Google, Microsoft, AWS, Cloudflare and Bloomberg are also platinum members. According to the official MCP blog, the Linux Foundation does not set the technical direction: the protocol’s maintainers do.
What’s new in the Model Context Protocol specification in 2026?
The big news of 2026 is the 2026-07-28 Model Context Protocol specification, published on 28 July and still the current version as of 12 October 2026. It makes the protocol “stateless”, so that it works with a company’s usual infrastructure, and it tightens authorisation. The changes, in business terms:
- Stateless core. Each request carries its own version and identity, so it can be spread across several servers with an ordinary load balancer.
- Header-based routing. Gateways and web application firewalls (WAFs) can authorise requests without reading their content.
- Safer authorisation. Clients validate the issuer of each authorisation, and credentials are bound to whoever issued them.
- Deprecation rules. Anything deprecated stays supported for at least twelve months. Migrating has a cost, especially if your application relied on sessions.
Other milestones of the year, from the protocol’s official blog:
- 26 January 2026: MCP Apps. Tools can display panels or forms inside the Claude or ChatGPT conversation.
- 16 March 2026: tool annotations. Marking a tool as read-only is a hint, not a guarantee: as the blog itself puts it, “an untrusted server can lie”.
- 18 June 2026: enterprise-managed authorisation. A stable extension for controlling access to MCP servers from your identity provider, with single sign-on (SSO), without each employee authorising each server. Okta is the first compatible provider; it is used by Claude and by servers such as Asana, Atlassian and Figma.
- 22 August 2026: a new roadmap. It prioritises agent identity, enterprise security and long-running tasks.
| Criterion | What it brought | What changes for a business |
|---|---|---|
| 2024-11-05 | First public version | Desktop trials for technical teams |
| 2025-03-26 | OAuth 2.1 authorisation and a new transport for remote servers (changelog) | Connecting cloud services becomes viable |
| 2025-06-18 | Credential protection, user confirmations and security guidance (changelog) | Harder for a malicious server to obtain your credentials |
| 2025-11-25 | Long-running tasks and policies from the identity provider (announcement) | Fits with corporate SSO and long processes |
| 2026-07-28 (current) | Stateless core and hardened authorisation | Scales and is monitored with your existing infrastructure |
My advice: ask which version
Is it safe to connect AI to your systems over MCP?
It is as safe as the design around it. The Model Context Protocol defines how the pieces connect, but it does not stop an agent with too many permissions from doing damage if someone tricks it.
The documented risks
- Indirect prompt injection. Malicious instructions hidden in a document or an email that the agent reads and obeys. Microsoft lists it among the threats to MCP in its Windows announcement of 19 May 2025.
- Tool poisoning. Invariant Labs demonstrated it on 1 April 2025: hidden instructions in a tool description, invisible to the user, led an agent to send private keys to a malicious server. In the “rug pull” variant, the server changes the description after you have approved it.
- Excessive permissions. The OWASP MCP Top 10, still in beta, includes privilege escalation, unauthorised servers (“shadow MCP”) and missing audit trails. The specification’s security guidance points out that a local server has the privileges of the application that launches it.
The most cited case involves GitHub. On 26 May 2025 Invariant Labs showed that a malicious issue in a public repository could make an agent publish data from private repositories. The flaw lay in the architecture, not in the server.
The “lethal trifecta”
How to reduce the risk
- Minimal, gradual permissions, as the specification itself recommends.
- Official or in-house servers, with a pinned version and reviewed descriptions.
- Human approval before writing, deleting, paying or sending.
- A dedicated identity for the agent, never an administrator’s, and isolated local servers.
- A log of every tool call and centralised sign-in wherever possible.
MCP and the GDPR: what Spain’s regulator says
MCP does not change your obligations: if an agent processes personal data, your company is answerable for that processing. Spain’s data protection authority, the AEPD, published guidance on agentic AI on 18 February 2026 (press release in Spanish). The guidance explicitly cites MCP as a standardised protocol between the agent (client) and the service it connects to (server). Its measures apply to anyone working under the GDPR:
- Minimisation: access policies, filtering of data flows and pseudonymisation.
- Identity and privilege management, and limits on the services the agent can reach.
- Effective human oversight, with checkpoints and the “four-eyes principle”.
- Traceability with strict retention periods and compartmentalised memory.
- Documenting the role of each third party, with its data processing agreement (Article 28 GDPR).
I cover how this fits with the rest of EU regulation in the guide to the EU AI Act and the GDPR for SMEs.
Model Context Protocol examples: what could an agent do with your systems?
It depends on what you connect and with which permissions. Tick the systems you would connect to see possible tasks, the controls you would need and an exposure level calculated with visible rules.
High exposure does not mean you cannot do it; it means the design matters more. That is what I review with every client as José Galán, Search & AI Visibility and AI agents consultant: what to connect first, with which permissions and where to put a person in the loop.
What does it mean for your business?
With the Model Context Protocol, connecting AI to your systems stops being a project tied to one vendor and becomes a governance decision: what you expose, to whom and with which controls. My reading by area:
LeadershipHigh impact
Less dependence on a single AI provider: one server works with several models. The key decision is which systems you open to agents and under what rules.
MarketingMedium impact
Analytics, the CRM or the content management system can feed assistants that prepare reports and segments. It does not change how AI finds you on the web.
Sales and customer serviceHigh impact
Where you notice it first: an agent that queries the CRM, ERP and email prepares calls or gives the real status of an order. It is also where the most personal data is at stake.
IT and dataHigh impact
Time to inventory the MCP servers in use, set an approved list, connect authorisation to your identity provider and log every call.
For a small business, the opportunity is to connect an agent to two or three key systems without depending on one vendor. That is what I do with custom AI agents: an agent that works with your data, connected through open standards and with least-privilege permissions. If you are weighing up where to start, in my AI consultancy for businesses we always begin with a specific process, not with the technology.
What should you do now?
Start by finding out what you already have and with a small, read-only use case, whether or not your team already uses the Model Context Protocol:
This week: take an inventory
Ask which AI tools your team uses and which connectors or MCP servers they have switched on. Servers nobody has approved are one of the risks in the OWASP MCP Top 10.
This week: pick one process and one system
A repetitive task that uses data from one or two systems. If you are not sure which, the MAPA method for mapping and automating processes with AI helps you choose.
This quarter: define your server list
Only official or in-house servers, with the version pinned and, where possible, authorisation connected to your identity provider.
This quarter: permissions, approval and logging
A dedicated identity for the agent, read-only access at first, human approval for writing or sending, and a log of every call.
This quarter: review the GDPR side
Document which personal data the agent sees, review your data processing agreements and check with your data protection officer whether you need a data protection impact assessment. For the diagnosis, you can use my free resources, such as the “Can AI read your website?” checklist and the MAPA template.
Key points
- MCP is an open standard for connecting AI to your systems: one server per system, usable by many models.
- Anthropic, OpenAI, Google and Microsoft support it, and the Agentic AI Foundation governs it.
- The current specification, 2026-07-28, scales better and strengthens authorisation.
- The real risks are prompt injection, poisoned tools and excessive permissions.
- Start read-only, with approved servers, human approval for writing and the GDPR reviewed.
Frequently asked questions about MCP (Model Context Protocol)
What is Model Context Protocol used for in a business?
MCP (Model Context Protocol) is an open standard for connecting AI applications to external systems. In a business, it lets an assistant or an agent query your CRM, ERP, documents or a database, and take actions in them, without building a separate integration for each AI tool. Anthropic created it in November 2024, and it is now governed by the Agentic AI Foundation.
What is an MCP server?
An MCP server is the program that exposes a specific system, such as a CRM, a document folder or a database, in the protocol’s format. It offers tools (actions), resources (context data) and prompt templates. It can run on your own computer or remotely, in the provider’s cloud, and any compatible client, such as Claude, ChatGPT or Visual Studio Code, can use it.
Is MCP only for Claude?
No. Anthropic created it and its first compatible client was Claude Desktop, but the protocol is open. OpenAI adopted it in March 2025, Google announced support in Gemini in April and Microsoft built it into Copilot Studio. Since December 2025 it has been governed by the Agentic AI Foundation, under the Linux Foundation, so the same server works with several AI providers.
What is the difference between MCP and an API?
An API is the door into one specific system, and each one has its own format. MCP is a common layer on top: it describes actions and data in a way that any compatible AI application understands and knows when to use. It does not replace APIs; many MCP servers are built on them. The advantage is that you connect once and reuse the connection with different models.
Is it safe to connect MCP to my company’s systems?
It can be, if you limit what the agent can do. The documented risks are prompt injection, tool poisoning with hidden instructions and excessive permissions. Use official or in-house servers with a pinned version, least-privilege permissions, read-only access to begin with, human approval before anything is written or sent, and a log of every action. Avoid combining private data, external content and outbound sending in one agent.
How does MCP fit with the GDPR?
MCP does not change your obligations: if the agent processes personal data, your company remains responsible for that processing. Spain’s data protection authority, the AEPD, cites the protocol in its February 2026 guidance on agentic AI and recommends minimising the data the agent can reach, managing identities and privileges, ensuring effective human oversight, keeping traceability with strict retention periods and documenting each provider’s role, with its data processing agreement.
What are the MCP servers in the official registry, and can I trust them?
The official registry, launched in preview on 8 September 2025, is an open catalogue of public MCP servers that their owners publish and maintain, with information they declare themselves. The community can report spam, malicious code or impersonation, and the maintainers can remove those entries. Even so, being listed is not an audit: check who publishes each server and what permissions it asks for.
Sources
Consulted and verified on 12 October 2026.
- Anthropic. Introducing the Model Context Protocol (25 November 2024).
- Anthropic. Donating the Model Context Protocol and establishing the Agentic AI Foundation (9 December 2025).
- Linux Foundation. Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF) (9 December 2025).
- Model Context Protocol. What is the Model Context Protocol (MCP)?, Architecture overview and Versioning (consulted on 12 October 2026).
- Model Context Protocol. Changelogs for versions 2025-03-26 and 2025-06-18, and Security Best Practices (version 2025-11-25).
- MCP blog. Introducing the MCP Registry (8 September 2025).
- MCP blog. One Year of MCP: November 2025 Spec Release (25 November 2025).
- MCP blog. MCP joins the Agentic AI Foundation (9 December 2025).
- MCP blog. MCP Apps: Bringing UI Capabilities To MCP Clients (26 January 2026).
- MCP blog. Tool Annotations as Risk Vocabulary (16 March 2026).
- MCP blog. Enterprise-Managed Authorization: Zero-touch OAuth for MCP (18 June 2026).
- MCP blog. The 2026-07-28 Specification (28 July 2026).
- MCP blog. The New MCP Roadmap (22 August 2026).
- Claude. Claude can now connect to your world (1 May 2025, updated 3 June 2025).
- OpenAI. New tools and features in the Responses API (21 May 2025).
- TechCrunch. OpenAI adopts rival Anthropic’s standard for connecting AI models to data (26 March 2025).
- TechCrunch. Google says it’ll embrace Anthropic’s standard for connecting AI models to data (9 April 2025).
- TechCrunch. GitHub, Microsoft embrace Anthropic’s spec for connecting AI models to data sources (19 May 2025).
- Google Cloud. Announcing official MCP support for Google services (10 December 2025).
- Microsoft. Securing the Model Context Protocol: Building a safer agentic future on Windows (19 May 2025).
- Microsoft. Model Context Protocol (MCP) is now generally available in Microsoft Copilot Studio (29 May 2025).
- Invariant Labs. MCP Security Notification: Tool Poisoning Attacks (1 April 2025).
- Invariant Labs. GitHub MCP Exploited: Accessing private repositories via MCP (26 May 2025).
- Simon Willison. The lethal trifecta for AI agents (16 June 2025).
- OWASP. OWASP MCP Top 10 (beta, consulted on 12 October 2026).
- AEPD (Spanish Data Protection Agency). Press release on its guidance on agentic artificial intelligence (in Spanish, 18 February 2026) and Agentic Artificial Intelligence from the perspective of Data Protection (English version 1.1, February 2026; the Spanish original is at version 1.2).
This article was created with the help of AI and reviewed by José Galán. I take great care over every post and every translation, but the odd mistake can still slip through. If you find one, write to me: you will be helping me improve.
Custom AI agents
Want an agent to use your systems without opening every door?
I design custom AI agents that connect to your CRM, ERP or documents through open standards such as MCP, with least-privilege permissions, a log of every action and human approval for anything sensitive. We start with one specific process, in read-only mode.
See how I design agents