What Is the Model Context Protocol (MCP)?
The Model Context Protocol (MCP) is an open standard that gives AI applications a common way to connect to outside tools, data and systems. Anthropic released it in November 2024, and in December 2025 it became a founding project of the Linux Foundation's Agentic AI Foundation. Its own documentation compares it to a USB-C port for AI applications.
Reviewed by Hari Gopal Sharma, Co-Founder & CTO ยท Updated
Where MCP came from and who governs it
Anthropic announced and open-sourced the Model Context Protocol on November 25, 2024, describing it as a new standard for connecting AI assistants to the systems where data lives. It was created at Anthropic by David Soria Parra and Justin Spahr-Summers. On December 9, 2025, the Linux Foundation announced the Agentic AI Foundation, with MCP as one of its founding projects alongside Block's goose and OpenAI's AGENTS.md. Anthropic said the donation was meant to keep MCP open, neutral and community-driven. For a business, that matters because the standard is no longer owned by a single AI vendor, so building on it does not tie you to one model provider.
How MCP works in plain terms
MCP has three parts. The host is the AI application a person uses, such as Claude, ChatGPT or a coding tool. The server is a small program that sits in front of a system, like a CRM, a database or a file store, and describes what it offers. The client is the connector inside the host that talks to one server. A server can offer tools, which are actions the AI can request, such as searching orders. It can offer resources, which are data the AI can read, such as a record or a file. It can also offer prompts, which are reusable templates. The AI application discovers what a server offers and calls it when a task needs it.
Why MCP matters for a business
Before a shared standard, every link between an AI tool and a business system was its own custom integration, and it often had to be rebuilt when you switched AI products. With MCP, a system is exposed once as a server, and any compatible application can use it. The official documentation lists support across AI assistants such as Claude and ChatGPT and developer tools such as Visual Studio Code and Cursor. In practice this means less integration work and more freedom to change models later. It also means your internal systems can become reachable by AI far more easily than before, which is exactly why access rules and review need attention from the start.
MCP security risks you should know about
MCP is a way to connect things. It does not decide what is safe to connect. The specification says there should always be a human in the loop with the ability to deny tool invocations, and that clients should ask for confirmation on sensitive operations and log tool usage. The project's security guidance covers real attack patterns, including servers that pass tokens through to other systems, overly broad permissions, and local servers that can run commands on a user's machine. A separate risk sits on top: OWASP warns that hidden instructions in content an AI reads can steer its behavior. If an MCP server gives an AI write access, that risk becomes a business risk.
MCP and AI agents: how they fit together
An AI agent is a system where the model chooses which steps and tools to use toward a goal. MCP is one of the most common ways that agent reaches those tools. The agent decides it needs a customer's open orders, the host sends a request to the right MCP server, the server runs the query with whatever access it was given, and the result goes back to the model. The protocol itself does not dictate how the AI uses the information. That split is useful. It means the controls that matter most, such as which tools exist, what each can read or change, and who must approve an action, live in the server and the host, where your team can see and set them.
How we use MCP at AetherCraft
We use MCP when a client wants AI to work across the systems they already run, and we add access in stages. A new server starts read-only. When we add an action, it produces a draft that a named person approves before anything changes. Each server gets the narrowest credentials the job needs, and every tool call is logged. For a medtech parts and service company, Claude answers questions across five systems through enterprise MCP and says plainly when the data behind an answer is weak. A separate system on the same project, Parts & Inventory, ranks every part nightly without writing to the CRM. Read access came first there, and it was enough to be useful.
Questions to ask before you connect AI to your systems
Before anyone installs or builds an MCP server for your company, get clear answers to a few questions. Which systems will it reach, and does it only need to read? If it can write, what exactly can it change, and who approves each change? Whose credentials does it use, and are they limited to this one job? Where are tool calls logged, and who reviews them? If the server comes from a third party, who maintains it and how will you hear about security fixes? What happens when the AI reads an email or document containing instructions it should ignore? A team that cannot answer these is not ready to give AI write access yet.
Frequently Asked Questions
Who owns the Model Context Protocol?
Anthropic created MCP and released it as open source in November 2024. In December 2025, it was donated to the Agentic AI Foundation, a new foundation under the Linux Foundation, as one of three founding projects. Members announced at launch included Amazon Web Services, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI. The protocol is developed in the open and is not controlled by any single AI company.
Does MCP only work with Claude?
No. Although Anthropic created it, MCP is an open protocol. The official documentation lists support in AI assistants including Claude and ChatGPT, and in developer tools such as Visual Studio Code and Cursor, among others. A system exposed through one MCP server can be used by any compatible application, which is one of the main reasons companies choose it over a one-off integration.
Is MCP secure?
MCP includes an authorization approach and detailed security guidance, but a connection is only as safe as the way it is built and configured. The specification recommends a human able to deny tool calls, confirmation for sensitive actions and logging of tool use. Risks such as overly broad permissions, untrusted third-party servers and prompt injection still have to be handled by whoever builds and runs the system.
What is the difference between an MCP server and an API?
An API is the way software talks to a particular system, and every API has its own design. An MCP server usually sits in front of one or more APIs and describes them in a standard format an AI application understands, as named tools and readable resources. Your existing APIs do not go away. MCP adds a common layer so AI applications can find and use them consistently.
Can a non-technical team use MCP?
Yes, as users. Many AI applications let a person connect approved MCP servers with a few clicks, and the AI then uses them in conversation. Building a server, deciding what it can access and setting approval rules is technical work, and it should be done carefully. A good rule is that the business decides what the AI may do, and engineers make sure it cannot do more.
See It In Practice
Related Reading
Related Terms
Built for Your Industry
Book a Discovery Call. Eduardo Diaz leads every AetherCraft engagement personally.