Few technologies move from a single vendor's project to an industry standard in twelve months. The Model Context Protocol did exactly that: Anthropic released it in November 2024, OpenAI adopted it in March 2025, Google in April, Microsoft integrated it into Windows 11 in May, and in December 2025 Anthropic donated it to the Linux Foundation with more than 10,000 active public servers and 97 million monthly SDK downloads. If your business is thinking about Artificial Intelligence agents that actually do something useful — query your ERP, update your CRM, read your databases — MCP is the infrastructure piece that makes it viable. This guide explains what it is without going into code, what real risks it carries (there are some, with specific names attached) and when it makes sense to adopt it.
What is the Model Context Protocol (MCP)?
The Model Context Protocol is an open protocol that standardises how AI applications connect to external data and tools — the equivalent of USB-C for Artificial Intelligence: a universal connector instead of a proprietary cable for every device. The problem it solves is arithmetic. Without a standard, connecting 10 AI applications to 20 enterprise systems requires building and maintaining 200 custom integrations (N×M); with MCP, each application speaks the protocol once and each system exposes an MCP server once: 30 standard pieces (N+M). For a business, the practical consequence is that the chatbot, the co-pilot, and the agent you buy or build tomorrow will all be able to reuse the same connections to your systems, rather than starting from scratch with every new vendor.
How it works, without going into code
The architecture has three pieces. The host is the AI application the user interacts with (Claude, ChatGPT, an internal co-pilot). The host contains clients that connect to MCP servers: small programmes that expose a specific system — your database, your Slack workspace, your ERP — in a way the model can use. Each server offers the model three things: tools (actions it can execute: "create invoice", "look up customer"), resources (data it can read: documents, records) and prompts (pre-prepared task templates). Communication runs over a standard format (JSON-RPC), either locally or over a network. The office analogy: the MCP server is a specialist employee who knows how to operate a specific system and handles the agent's requests in a shared language — you hire the specialist once and any agent in the organisation can work with them.
From Anthropic protocol to neutral infrastructure: the timeline
| Date | Milestone |
|---|---|
| November 2024 | Anthropic releases MCP as an open standard |
| March 2025 | OpenAI adopts it (Agents SDK, ChatGPT) |
| April 2025 | Google DeepMind announces support in Gemini; Google launches A2A (complementary) |
| May 2025 | Microsoft Build: native MCP in Windows 11, with a registry and security requirements |
| December 2025 | Anthropic donates MCP to the Linux Foundation (Agentic AI Foundation), with OpenAI and Block as co-founders and the backing of Google, Microsoft and AWS |
| July 2026 | New version of the specification (28 July): stateless core, MCP Apps, hardened OAuth |
The milestone that matters most to a business is December 2025: by moving to a neutral foundation under the Linux Foundation, MCP stopped being "Anthropic's protocol" and became industry-governed infrastructure — as Kubernetes or Linux once were. The translation for procurement and architecture teams: the risk of betting on a standard controlled by a single vendor has disappeared, and this very week the next version of the specification is being published with the foundation already at the helm.
What does a business actually use it for?
The patterns already in production group into three families. Agents with access to internal systems: a support agent that queries the customer's history in the CRM, opens the ticket in the ITSM tool and drafts the response — three MCP servers, one agent. Operations automation: agents that prepare reports by crossing the financial database with timesheets, or that manage inventory against the ERP. Productivity for technical and business teams: the more than 10,000 public servers include connectors for GitHub, Slack, Stripe, SQL databases and cloud storage, ready to use. The most cited corporate case is Block (the parent of Square and Cash App): its internal agent operates with around 60 of its own MCP servers for 12,000 employees, with savings — self-reported by the company — of 50–75% on routine tasks. The transferable lesson is not the figure itself, but the architecture: few agents, many reusable standard connectors.
The risks you need to know before connecting anything
MCP connects your AI to your systems, and that turns every connection into an attack surface. The risks have names and serious research behind them. Tool poisoning (Invariant Labs, 2025; now its own category in the OWASP MCP Top 10): a malicious server hides instructions inside its tool descriptions to manipulate the model. Line jumping (Trail of Bits, 2025): that manipulation acts before any tool is invoked — the mere fact of having a malicious server connected already contaminates the conversation, bypassing human approval. And rug pulls: a legitimate server that changes its behaviour after earning trust. The defences that are already standard practice in 2026: an approved server allowlist (deny by default), a centralised MCP gateway that audits all agent traffic, OAuth identity with minimum permissions per tool, and mandatory human approval for destructive actions. If your agents touch regulated data, remember also that the high-risk obligations of the European AI Act have been enforceable from 2 August 2026 — the gateway and its audit logs are precisely the type of control that will be required.
Honest limits: when MCP is not the answer
Two caveats that enthusiasm often skips. First, context cost: every connected tool describes its schema to the model, and 20–30 tools can consume 15–30 KB of context before the user types their first message — more tools do not always mean a better agent; they mean more cost and more noise for the model. Anthropic itself proposes as a mitigation that agents execute code against APIs rather than invoking dozens of MCP tools directly. Second, not everything needs an agent: if the workflow is deterministic — every day, the same report, the same steps — a classic automation (RPA, scripts, native integrations) is cheaper, faster and more predictable. MCP shines when there is decision-making and natural language involved; it does not replace traditional integration, it complements it.
MCP and A2A: the standards map for the agent era
The common question: do MCP and A2A compete? No — they divide the work. MCP connects an agent to tools and data (vertical); A2A connects agents to each other (horizontal), and since April 2026 it has a stable version with more than 150 organisations behind it, also under the Linux Foundation. In a mature enterprise architecture both will coexist: your agents will speak MCP with your systems and A2A between themselves. For a small or mid-sized business, the clear priority in 2026 is MCP — it is what makes your first agent useful; A2A comes when you have several.
How to get started with MCP in your business
"The mistake we see is starting from the catalogue: connecting twenty MCP servers because they exist. A good deployment starts from the other end — one use case, one agent, the two or three systems that use case needs, and a gateway with an allowlist from day one. Security is not added afterwards: it is part of the design," says Alfons Marques, founder of Technova Partners.
The steps we recommend:
- Choose a use case with measurable return (support, back-office, reporting) and identify the 2–3 systems it needs.
- Prefer official servers or build your own for critical systems; avoid servers of dubious origin, however convenient they may seem.
- Govern from the start: allowlist, gateway with audit log, minimum permissions and human approval for irreversible actions.
- Measure and scale: if the first agent proves its value, every MCP connector you build is reused in the next one — that reuse curve is where the standard pays off. Our AI agents for business team designs exactly this kind of architecture, from use case to gateway.
If you first want to understand the underlying technology, our guide to what an LLM is explains the engine underneath every agent.
Clear on the use case but not the architecture? Tell us which systems you want to connect and we will propose a design with security built in from day one.
Conclusion
The Model Context Protocol solved the problem that was holding AI agents back in the enterprise — the N×M cost of integrations — and in one year became the de facto standard for the entire industry, now governed by a neutral foundation with more than 10,000 public servers. For an international business, the message is twofold: the infrastructure is already mature and neutral enough to build on, and the risks — tool poisoning, line jumping — are real but manageable with an allowlist, a gateway and minimum permissions. Start with one use case, not the catalogue; connect little and well; and let connector reuse do the rest.
Frequently asked questions about the Model Context Protocol
What is MCP in plain terms?
It is an open protocol — created by Anthropic in 2024 and governed since December 2025 by the Linux Foundation — that standardises how AI applications connect to external data and tools. It works like a universal connector: each system exposes an MCP server once and any compatible agent can use it, eliminating custom integrations for every application-system pair.
Is MCP only for Anthropic, or does it work with ChatGPT and Gemini?
It belongs to the whole industry. OpenAI adopted it in March 2025, Google DeepMind in April and Microsoft integrated it into Windows 11 in May 2025. In December 2025 Anthropic donated the protocol to the Agentic AI Foundation of the Linux Foundation, with OpenAI as a co-founder and the backing of Google, Microsoft and AWS. The MCP connectors you build work with the agents of any of these ecosystems.
Is it safe to connect my systems to an AI agent via MCP?
It can be, with the right defences. The documented risks — tool poisoning, line jumping, rug pulls — come mainly from connecting unaudited third-party MCP servers. Standard practice in 2026: an approved server allowlist, a centralised gateway with an audit log, minimum permissions per tool via OAuth, and human approval for destructive actions. With agents on regulated data, these controls also align you with the AI Act obligations enforceable from August 2026.
When should you NOT use MCP?
When the workflow is completely deterministic — the same report, the same steps, every day — a classic automation or native integration is cheaper and more predictable. And watch out for excess: every connected tool consumes model context (20–30 tools can mean 15–30 KB before you start), so connecting the entire catalogue makes the agent worse rather than better. MCP delivers value when there is decision-making and natural language in the workflow.
