Every useful AI assistant at work hits the same wall: it cannot see the systems where the work lives. The contract is in a shared drive, the order is in the ERP, the promise was made in email. For the first two years of workplace AI, each connection between an AI tool and a business system was built by hand, and each one broke differently.
The Model Context Protocol is the industry's answer to that wall, and it spread faster than most standards do. This guide explains in plain terms what MCP is, what problem it solves, who supports it, what it changes for a business, what it leaves unsolved, the security questions it raises, and how to start using it safely.
Key takeaways
- MCP is an open standard that lets any compatible AI application talk to any compatible business system through one interface.
- Anthropic released it in November 2024. OpenAI adopted it in March 2025, and it moved to a Linux Foundation fund in December 2025.
- MCP lowers the cost of access. It does not decide what matters, who owns the work or whether an action is allowed.
- Treat every MCP server as code that can act on your data: approve it, scope it and log it.
What is the Model Context Protocol?
The Model Context Protocol is an open standard for connecting AI applications to external data and tools. Anthropic introduced it on 25 November 2024 as "a new standard for connecting AI assistants to the systems where data lives" (Anthropic).
The specification describes three roles. A host is the AI application a person uses, such as a chat app or a coding tool. A client is the connector inside the host. A server is a small service that exposes one system, such as a drive, a database or a ticketing tool. Servers can offer three kinds of things (MCP specification):
- Resources: context and data, such as files or records, for the user or the model to use.
- Prompts: templated messages and workflows.
- Tools: functions the model can call, such as "search orders" or "create ticket".
A business analogy helps. MCP is to AI tools roughly what a standard power socket is to appliances. Any compatible plug fits any compatible socket. The specification itself says it took inspiration from the Language Server Protocol, which did the same job for programming languages and code editors.
What problem does MCP solve?
Before MCP, connecting five AI tools to ten business systems meant up to fifty separate integrations, each built and maintained by someone. Anthropic's announcement named the problem: "Every new data source requires its own custom implementation, making truly connected systems difficult to scale."
With a shared protocol, a system vendor builds one MCP server and every compatible AI app can use it. An AI app supports MCP once and can reach every system that has a server. Anthropic launched with ready-made servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer, and named Block and Apollo as early adopters.
Who supports MCP now?
Adoption moved quickly, and it crossed company lines.
- March 2025. OpenAI adopted the standard. Sam Altman wrote, "People love MCP and we are excited to add support across our products," with support available first in OpenAI's Agents SDK (TechCrunch).
- November 2025. On its first anniversary, the project reported that active MCP servers had grown from a few experiments to thousands, and released a specification update with long-running tasks and stronger authorization options (MCP blog).
- December 2025. Anthropic donated MCP to the Agentic AI Foundation, "a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI," with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. Anthropic reported "more than 10,000 active public MCP servers" and "97M+ monthly SDK downloads across Python and TypeScript," and said MCP had been adopted by ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code (Anthropic).
For a business leader, the meaning is simple. MCP is no longer one vendor's format. It is shared infrastructure, governed in the open, that most major AI tools now speak.
What MCP changes for a business
| Area | Before MCP | With MCP |
|---|---|---|
| Connecting a new AI tool | A project per system | Point it at existing MCP servers |
| Switching AI vendors | Rebuild every integration | Keep the servers, change the host |
| Internal systems | Rarely reachable by AI | One server makes them reachable by every approved tool |
| Agents | Limited to a few built-in tools | Can use any tool exposed through a server |
| Security review | One review per integration | One review per server, and a policy for which hosts may use it |
The second row matters most for strategy. A shared protocol lowers switching costs, so a company can choose AI tools on quality and price rather than on which integrations happen to exist. It also lets agents do more, which is why MCP sits underneath much of the move toward agentic AI in the enterprise.
What MCP does not do
MCP is plumbing. It carries context and actions between systems. Several things a business needs sit outside it:
- Meaning. MCP can hand a model a thousand emails. It cannot say which three matter to this quarter's goals.
- Ownership. It has no idea who should act on a situation or by when.
- Policy. It does not know your discount limits, approval rules or which customers are sensitive.
- Proof. It does not check that an action achieved what was intended.
- Enforcement. The specification is explicit: "MCP itself cannot enforce these security principles at the protocol level." Consent, access control and logging are left to the applications that implement it.
This is the difference between access and understanding. More context makes a model better informed. Turning that context into the right action for this company needs goals, priorities and owners. We explain the layers in memory vs context vs intelligence, and why retrieval alone falls short in RAG is not enough.
MCP security: the questions to settle first
The specification's own safety section is a good starting checklist. It says users must consent to and understand all data access and operations, that hosts must get explicit consent before invoking any tool, and that "tools represent arbitrary code execution and must be treated with appropriate caution." It also warns that descriptions of tool behaviour should be treated as untrusted unless they come from a trusted server.
The developer Simon Willison describes the main risk as a "lethal trifecta": an AI system that has "access to your private data," "exposure to untrusted content" and "the ability to externally communicate in a way that could be used to steal your data." He points out that MCP makes this easier to assemble by accident because "it encourages users to mix and match tools from different sources that can do different things" (Simon Willison).
In business terms: an assistant that can read your inbox, open a link from a stranger and send email has all three. A crafted message could instruct it to forward confidential files. The fix is design, not hope. Break the trifecta by removing one leg for any given agent, and keep outbound actions behind a person's approval. The enterprise AI governance guide covers how to set those rules.
Questions to ask before connecting an MCP server
- Who built and maintains this server, and do we trust them with this system?
- Which actions does it expose, and can we turn off the ones we do not need?
- Does it act with each user's own permissions, or with one shared account?
- Which AI hosts are allowed to use it, and who approved that?
- Is every tool call logged with who asked, what ran and what changed?
- Could an agent using it read untrusted content and send data out in the same session?
- How do we disconnect it quickly if something goes wrong?
How to start with MCP
- Inventory what is already connected.
Many AI tools in use may already support MCP. List the servers employees have added, and who added them.
- Start read-only.
Connect one system with read access only, such as a document store, and one approved AI host.
- Set a server approval policy.
Name who may approve new servers and which hosts may use them. Prefer servers from the system's own vendor or your own team.
- Add write tools one at a time.
When you allow actions, keep anything external or irreversible behind a person's approval, and log every call.
- Review monthly.
Count servers, tool calls, approvals and incidents. Remove servers nobody uses.
Measure progress by systems safely reachable, share of tool calls logged, and incidents traced to a connector. If agent count is growing too, the AgentOps guide covers the wider controls.
How GeniOS approaches the Model Context Protocol
Protocols like MCP make it easier for software to reach company data. GeniOS works on the question that comes after access: what does this information mean for the business right now? It reads where a company's work happens, such as email, calendar, chat and the business tools already in use, read-only to start.
It forms the company's goals from its own emails, decks and meetings, and checks every team's pending work against them. What reaches a person is one situation, what to do, why, one owner and a date. The owner answers Delegate, Done, Later or Not relevant.
Delegate hands work to a person or an AI agent, and nothing is sent until a human approves. An item closes only on proof, such as the email that went out. Connectors carry the context. Owners, approvals and proof are what turn it into work done.
Worked example: one buyer week with and without shared context
The names, dates and numbers in this example are made up to explain the idea. Vaultex makes safety footwear in Greater Noida and was GeniOS's first design partner. Its team uses an AI assistant connected through MCP servers to email, the shared drive and the production plan.
Harsh in sales asks the assistant to prepare Bata's quote: 12,000 pairs of S3 safety shoes at $12 a pair, about $144,000, for Friday's vendor review. Thanks to MCP, the assistant can open the previous quote, the price list and the thread with Bata in seconds. Without MCP, Harsh would have pasted each one in by hand.
Access is not judgement, though. The assistant drafts the quote at $12 because that is the price on file. It does not know that steel toe-cap costs rose 8% this week, in an email to Anushka in production, or that Bata's request for 60-day payment terms needs a decision first. It also does not know that Line 2 is busy with Reebok samples, or that Adidas's vendor audit needs IS 15298 test reports the same week.
With company goals and owners on top of the same connections, the picture changes. The cost rise is linked to the open Bata quote and raised to Harsh before Friday. Anushka is asked to confirm Line 2 capacity. The Adidas reports become their own item with an owner and a date. The quote email goes out only after Harsh approves the revised price, and the item closes when the sent email exists. MCP made the data reachable. The rest came from knowing what mattered.
Conclusion
The Model Context Protocol is one of the most practical changes in workplace AI so far. It replaces piles of custom integrations with one open standard that OpenAI, Anthropic and most major AI tools now support, governed under the Linux Foundation. For business leaders it lowers the cost of connecting AI and of switching vendors. It also widens what agents can touch, so approve servers deliberately, keep outbound actions behind a person, and log every call. Then add the layer MCP leaves out: what matters, who owns it and proof that it happened. To see that layer on your own work, see pricing or book a call.
Sources
- Anthropic, Introducing the Model Context Protocol, 25 November 2024
- Model Context Protocol, Specification, version 2025-06-18
- TechCrunch, OpenAI adopts rival Anthropic's standard for connecting AI models to data, 26 March 2025
- Model Context Protocol blog, One Year of MCP: November 2025 Spec Release, 25 November 2025
- Anthropic, Donating the Model Context Protocol and establishing the Agentic AI Foundation, 9 December 2025
- Simon Willison, The lethal trifecta for AI agents, 16 June 2025