What Is MCP (Model Context Protocol) and Why It Matters

What is MCP, in plain English?

MCP is a standard plug: a system connects once, and any compatible AI can use it.

MCP, short for Model Context Protocol, is an open standard that defines how an AI application connects to external systems to read information and take actions. The official docs compare it to a USB-C port: just as USB-C standardized how devices connect, MCP standardizes how an AI connects to your data and tools.

Anthropic introduced it as an open-source standard on November 25, 2024. A year later, on December 9, 2025, it donated MCP to the Agentic AI Foundation, a Linux Foundation fund co-founded by Anthropic, Block and OpenAI. That matters for a business: MCP no longer depends on a single vendor, and it is used by clients such as Claude, ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code.

In practice, MCP is what lets you ask an assistant to “show me the customers who haven’t bought in 90 days and create a follow-up task for each rep,” and have it do that by querying your actual CRM instead of producing a plausible-sounding guess.

What problem does MCP solve compared with traditional integrations?

Without MCP, every AI-and-system pair is its own project; with MCP, each system connects once.

MCP solves integration sprawl. Before it, every AI assistant needed its own connector for every system: one for the CRM, another for invoicing, another for inventory. Switch models and you redid much of the work. Anthropic described the problem at launch: every new data source required its own custom implementation, which made truly connected systems hard to scale.

With MCP, a system exposes its capabilities once in a standard format, and any compatible application discovers and uses them. Your CRM’s API still exists; MCP is a layer on top that makes it readable and usable for an AI model.

Here is how it compares with a classic API integration:

How does MCP work: clients, servers and tools?

The AI app opens one client per server, and each server offers tools, resources and prompts.

MCP has three moving parts. The host is the AI application you use: Claude, ChatGPT, a code editor or your own agent. Inside the host there is one MCP client per connection. On the other side sits the MCP server, the program that exposes a specific system: your database, your store, your CRM.

Each server offers three kinds of capabilities. Tools are actions the model can run, such as creating a contact or looking up an order. Resources are context data, such as a database schema or a document. Prompts are reusable instructions for common tasks. The client first asks for the list of available tools, with their descriptions and accepted parameters, and then calls them when the model decides to.

Under the hood, messages travel as JSON-RPC 2.0 over two transports: stdio, when the server runs on the same machine, and Streamable HTTP, when the server is remote. For remote servers the spec recommends OAuth for authentication. There is also a mechanism called elicitation that lets a server ask the user for missing information or a confirmation before acting, which is essential when an action has consequences.

One thing worth knowing: the protocol keeps evolving. The current specification at the time of writing is version 2026-07-28, which among other changes deprecated an earlier feature called sampling. An MCP server is not something you install and forget; it needs maintenance.

What can an agent do with MCP in your CRM or ERP?

The value isn’t the protocol itself; it’s the questions and tasks your team stops doing by hand.

With an MCP server connected to your CRM or ERP, an AI agent can query real data and take narrowly scoped actions in response to a plain-language request. It is not another dashboard: it is the ability to ask your systems questions the way you would ask an analyst. These are concrete uses we consider viable today:

• Sales: “Which deals over $5,000 have had no activity in two weeks?” and then create a reminder for each owner.
• Inventory: check stock by warehouse and flag which SKUs are below minimum before a campaign launches.
• Customer service: pull an order’s status, notes and history before replying to a complaint.
• Online store: WooCommerce already offers, as a developer preview, MCP operations to query and update products and orders.
• Automation: n8n can expose complete workflows as MCP tools, so the agent triggers a tested process instead of improvising steps.
• Reporting: build a weekly summary that combines CRM and invoicing data without exporting spreadsheets.

What are the security risks of MCP, and how do you control them?

An MCP server inherits the permissions you grant it: control comes from scope, not from the model’s good intentions.

The core risk of MCP is that it connects a system that makes probabilistic decisions to real data and real actions. If the agent is allowed to delete records, sooner or later an ambiguous or malicious instruction may lead it to do exactly that. The official MCP security best-practices guide documents concrete attacks, and they translate directly into business decisions.

First, local servers run with the same privileges as the client: a server downloaded from a questionable source can run commands on the machine. That is why the guide requires showing the exact command and asking for approval before installing one, and recommends sandboxing it. Second, least privilege: the spec warns against wildcard scopes and proposes starting with a minimal, read-only scope and elevating only when an operation needs it. Third, tokens: an MCP server must not accept credentials issued for another service or pass them through, a practice the spec explicitly forbids.

In our implementations that becomes a few simple rules. A dedicated user for the agent, never the admin account. Read-only by default, with write access only on the tools the use case requires. Human confirmation for anything that moves money, deletes data or goes out to a customer. And a log of every call, so you know what the agent did and why. If a vendor can’t tell you what permissions their MCP server will have, it isn’t ready for your operation.

When is MCP worth it for a small business?

MCP pays off when people ask varied questions across several systems; for a fixed flow, classic automation still wins.

MCP is worth it when your team needs to query or operate several systems with requests that change all the time, and when those systems already have an API or an available MCP server. If someone spends the morning jumping between the CRM, invoicing and inventory to answer questions nobody could have predicted in a menu, there is a case.

It is not worth it when the process is always the same. Syncing store orders to invoicing every hour doesn’t need an AI model deciding anything: an n8n workflow does it cheaper, faster and with a smaller attack surface. It also makes little sense if your data lives in messy spreadsheets; an agent with access to bad data just gives wrong answers faster.

The cost has three parts: building or configuring the MCP server and its permissions, hosting it and keeping it current with the spec, and AI model usage, which is billed per use. The protocol itself is open, with no license fee. Our advice is to start with a single system, read-only, for a few weeks, and measure how many questions it resolves before granting write access.