Model Context Protocol
The Model Context Protocol (MCP) is an open standard, introduced by Anthropic in November 2024, that defines how AI applications connect to external tools and data. A system exposes its functions and content once, as an MCP server, and any compatible AI client can discover and use them, replacing a custom connector between every model and every system.
- Also known as
- MCP, MCP specification
- Introduced
- open-sourced by Anthropic on 25 November 2024; adopted by OpenAI in March 2025 and by Google DeepMind; donated on 9 December 2025 to the Agentic AI Foundation, a directed fund under the Linux Foundation
- Architecture
- hosts (the AI applications), clients (connectors inside the host, one per server) and servers (which expose capabilities), exchanging JSON-RPC 2.0 messages over standard input/output locally or HTTP remotely
- What servers offer
- tools (functions the model can call), resources (data and documents for context) and prompts (templated messages and workflows)
- Security model
- remote servers authorise clients with OAuth 2.1 and must accept only tokens issued for them; the specification requires user consent before data is exposed or tools are run, and treats tool descriptions as untrusted unless the server is trusted
- Adoption
- more than 97 million monthly SDK downloads across Python and TypeScript by December 2025; a July 2026 revision made the protocol stateless, carrying version and capabilities with each request
How the Model Context Protocol works in practice
Before MCP, connecting an AI assistant to a firm's CRM, document store and ticketing system meant a bespoke integration for each pair of AI product and system. With MCP each system is wrapped once as a server that lists what it can do in natural-language descriptions a model can read, and every MCP-compatible assistant or agent can use it. Software vendors now publish MCP servers alongside their APIs, and internal platform teams build them for proprietary systems.
In a financial firm the protocol is plumbing; the governance sits around it. Which servers an agent may reach, with whose credentials and what scopes; whether a tool that moves money or changes a customer record needs human confirmation; how every call is logged for audit. The distinctive risk is that the model reads tool descriptions and returned content as text, so a malicious document or a compromised server can try to instruct it — prompt injection through the tool layer, which can be used to pull data out through another connected tool.
For software companies MCP support is becoming part of the product: an application that agents cannot reach risks being bypassed by agents working through competitors' tools. In diligence of an AI business the questions are which servers it depends on, who maintains them, and how it limits what its agents can do.
Example
A mid-sized asset manager deploys an internal research assistant that needs its portfolio system, research library, CRM and compliance archive. Bespoke integrations were quoted at four projects of six weeks each, to be repeated for any second AI tool. Using MCP, the CRM vendor's server and an open-source document server take a week to configure, and the platform team writes servers for the portfolio and compliance systems in five weeks. Every tool is read-only except one that drafts, but cannot send, client emails. In the first quarter 240 analysts make 58,000 tool calls; the logs show 31 retrieved documents containing instructions aimed at the assistant, all stopped by a rule that content returned by a tool cannot trigger further tool calls on its own. When the firm adopts a second AI product, it connects to the same four servers in a day.
Common mistakes
- Treating MCP as a security layer; it standardises the connection, not the permissions. - Installing third-party servers without reviewing their code, their tool descriptions and their updates. - Giving an agent write access to payments or customer records with no confirmation step. - Passing broad user tokens through to servers instead of scoped credentials issued for each one. - Confusing MCP with retrieval-augmented generation: RAG supplies context, while MCP is a connection that can also act.