The Model Context Protocol (MCP): How AI connects to your tools

When Claude reads your SharePoint files, when Copilot queries your CRM, or when an agent opens a ticket in your support tool, the same mechanism is working behind the scenes in most cases: the Model Context Protocol, or MCP. Launched by Anthropic in late 2024, this open standard has become, in less than two years, the universal interface connecting AI assistants and agents to enterprise data and applications. This article explains what it is, how it works, what it changes in practice for an organization, and what to look out for before integrating AI into your systems.

Article published in April 2025 and completely rewritten in September 2026. The first version referred to it as "Model Content Protocol"; the correct name is Model Context Protocol.

The problem that MCP solves

A language model knows nothing about your company. It has been trained on public texts finalized at a given date, and it is unaware of your procedures, your clients, and your current projects. For it to be useful at work, it needs access to this context: it needs to be able to read a document, search a database, consult a calendar, or write in a tool. Before MCP, each connection between an AI assistant and a software application was custom-developed. Three assistants and ten business tools meant thirty integrations to build and maintain, each with its own specific characteristics. Developers refer to this as an "M times N" problem.

MCP replaces these integrations with a common language. A tool that exposes an MCP interface becomes accessible to any compatible assistant; an MCP-compatible assistant can communicate with any MCP-compatible tool. The problem becomes "M plus N." The analogy everyone uses is that of USB-C: a single connector, regardless of the device plugged in. Anthropic drew inspiration from a successful precedent, the Language Server Protocol, which unified in just a few years how code editors communicate with language analyzers.

How it works, without jargon

The work is divided into three roles.host is the application you are communicating with: Claude, ChatGPT, Copilot, an agent that your company has built. The MCP server is a small program placed in front of a tool or data source (your SharePoint, your CRM, your ticket database, a file folder) that translates what that tool can do into a standard format. Between the two, the MCP clientIntegrated into the host, it opens the connection and transports the messages. A host can connect to multiple servers simultaneously, which allows an assistant to combine your email, documents, and sales data in a single task.

An MCP server exposes three types of elements, and the distinction matters for governance. tools These are actions that the model can decide to call: search, create a record, send a message. resources These are data items made available—a document, a customer record, the result of a query—that the application chooses to show or not to the model. prompts These are ready-made instructions that the user triggers themselves, for example, "summarize this file according to our template." There are three levels of control: the model decides on the tools, the application decides on the resources, and the user decides on the prompts. Each call is described in a readable format, allowing for logging of what the AI ​​consulted and what it did to arrive at its response.

What this changes for a company

The most visible consequence is that "connecting AI to the information system" has ceased to be an IT project and has become a standard feature. Major software vendors deliver MCP servers for their products, market assistants offer catalogs of connectors, and an IT department can deploy an internal server to expose a business database without rewriting anything in the original application. An assistant connected to the document repository responds based on current procedures rather than what they memorized during training; an agent connected to the support tool categorizes and qualifies tickets; a workspace connected to the sales exports compiles the monthly report.

The second consequence relates to traceability. Because each resource has an identifier and each tool used leaves a trace, it becomes possible to answer the question that was hindering adoption: "Where does this information come from?" A report generated by an agent can list the documents consulted during its creation. An administrator can see which MCP servers are active, who is accessing them, and what has been done. This transparency doesn't solve everything—the model is still trained on data you don't control—but it makes the immediate context verifiable, which is exactly what a lawyer, a management controller, or a quality manager expects.

The third advantage is portability. An MCP server built to expose your knowledge base can be used interchangeably with Claude, ChatGPT, Copilot, or a custom agent. The choice of assistant is no longer irreversible, and integration work is no longer lost when switching vendors. For a company comparing several tools, this is a compelling argument: investing in connectors rather than a specific assistant.

Where does MCP stand in September 2026?

The protocol was announced by Anthropic on November 25, 2024. OpenAI adopted it in March 2025, Google DeepMind in April 2025, and Microsoft integrated it into Copilot and its development platforms shortly thereafter. The commitment to openness was confirmed in December 2025 when Anthropic entrusted MCP to the Agentic AI Foundation, a Linux Foundation fund co-founded with Block and OpenAI: the standard no longer belongs to a single vendor, which is important for any organization that wants to build upon it. Official development kits are approaching half a billion downloads per month, and the MCP summit in New York in April 2026 brought together approximately 1,200 participants.

The specification has evolved considerably since its initial release. The July 2026 revision makes the protocol stateless, simplifying its large-scale deployment behind load balancers, strengthens authorization (strict sender validation, abandoning dynamic client registration in favor of metadata documents), formalizes time-consuming tasks in a dedicated extension, and progressively removes early mechanisms such as sampling and file roots in favor of simpler solutions. Each removal is announced twelve months in advance. For a business, the message is clear: MCP has moved beyond the experimental phase and is entering a standardization phase, with the associated lifecycle rules.

The risks, and how to manage them

Connecting AI to tools gives it the ability to act, and therefore to act maliciously. Security researchers documented two families of attacks specific to MCP as early as April 2025. The first is...prompt injection via content A document, email, or web page read by the agent contains hidden instructions that the model interprets as directives, causing it to send data where it shouldn't. The second is...tool poisoning A malicious or compromised MCP server misrepresents its tools to trick the model into exfiltrating information through another connector. This is compounded by classic vulnerabilities: servers exposed to the internet without authentication, overly broad permissions, and a lack of logging.

These risks are managed with the same reflexes as for any access to the information system, applied to a new type of user. Maintain an inventory of authorized MCP servers and install only those, just as you would manage a list of approved applications. Give each connector the minimum scope: read-only when writing is not necessary, a folder rather than a disk, a dedicated service account rather than administrator rights. Require human confirmation for binding actions (send, pay, delete, publish), which reputable hosts allow you to configure. Log all calls and review them in sample form. And train users to adopt a simple reflex: everything the agent reads is data, never an order. These rules have their place in the AI charter of the company, just like the rules on confidential data.

Where to start

You don't need to develop anything to benefit from MCP. The assistants your company has already deployed offer ready-to-activate connectors; the first step is to inventory them and decide, source by source, which ones are allowed to exist and with what scope. The second step is to choose an initial read-only use case, for example, an assistant that responds from a team's document repository, put it in the hands of that team, and measure what changes in its responses. Write-in use cases, where the agent interacts with the tools, come later, once the control framework is in place and the team knows what it is delegating.

The key point is that MCP is shifting the focus. Two years ago, the question was, “Can AI access our data?” The answer is now yes, for almost everything. The relevant question has become, “What data, for what purpose, and under what control?” This is an organizational issue, not a technological one, and that’s the good news: it can be addressed with the governance tools the company already has.

Sources. Announcement and documentation of the Model Context Protocol ; ticket The 2026-07-28 Specification from the official blog; MCP Is Growing Up, Agentic AI Foundation; page Model Context Protocol Wikipedia for the timeline. The first version of this article was based on a article by Arnault Chatel published on LinkedIn.

To go further: the difference between RAG and RIG To understand how AI uses your data, when AI becomes a colleague and transforms the organizational chart, ten use cases of Claude Cowork by job et The future of AI: between neural and symbolic approaches.