MCP (Model Context Protocol) is an open standard that lets an AI assistant connect to your business systems, such as your CRM, ERP, inventory or CMS, through one common plug instead of a custom integration for every pair of tools. Build the connection to a system once, and any AI app that speaks MCP can read from it or act in it, within the permissions you set. This guide explains how MCP works in plain business terms, who supports it, how it compares with custom integrations and vendor plugins, where it pays off, how to secure it, and how to start without putting live data at risk.
What is MCP, in plain business terms?
MCP is a shared language between AI applications and the software that runs your business. Anthropic open-sourced it on 25 November 2024 to fix a simple problem: every new data source needed its own custom implementation, so connected AI was hard to scale.
The official documentation puts it this way: "Think of MCP like a USB-C port for AI applications." One port shape, many devices. For a business, the translation is direct. Your CRM gets one MCP connection, and your team can use it from Claude, ChatGPT or a coding tool without three separate integration projects.
In our pillar guide to AI trends for 2027, we called this shift "connection beats the model." An AI that cannot see your orders, stock and customer history can only give generic answers. MCP is the standard the major AI platforms now share for giving it that view.
How does MCP work?
MCP splits every connection into three roles: the AI app, a connector inside it, and a small program that represents your system. The official specification names them:
- Host: the AI application your team uses, such as Claude or Visual Studio Code.
- Client: a connector inside the host. The host creates one client for each server it connects to.
- Server: a program that exposes one of your systems (your CRM, your stock database, your CMS) to the AI.
Each server can offer three kinds of capability. Tools are actions the AI can call, such as "create a quote" or "update a deal stage." Resources are data the AI can read, such as a product catalogue or a customer record. Prompts are reusable templates, such as a standard monthly sales summary your managers run on demand.
Servers run in two ways, according to the architecture documentation. A local server runs on the user's own machine and typically serves one client. A remote server runs over HTTP, like any web service, and typically serves many. The current revision of the protocol, released on 28 July 2026, made the core stateless, so any request can land on any server instance behind a plain load balancer. In business terms, a remote MCP server now scales like an ordinary web API.
Who supports MCP today?
The major AI platforms your team is likely to use already do. When the Linux Foundation formed the Agentic AI Foundation in December 2025, MCP had more than 10,000 published servers and adoption in Claude, ChatGPT, Gemini, Microsoft Copilot, Cursor and VS Code.
Governance matters as much as adoption. Anthropic contributed MCP to the new foundation, which was co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. The protocol no longer belongs to one vendor. If you care about switching AI providers later, that is the strongest argument for building on it.
Usage keeps climbing. In the July 2026 release notes, the lead maintainers reported close to half a billion SDK downloads a month, with the TypeScript and Python SDKs each passing one billion total downloads. The project also adopted a minimum twelve-month deprecation window before features are removed, which gives you time to plan upgrades instead of reacting to them.
How does MCP compare with custom integrations and vendor plugins?
MCP wins when several AI tools need the same systems. A custom integration still wins for one fixed, high-volume job. Here is the honest comparison:
| Question | One-off custom integration | Vendor plugin | MCP server |
|---|---|---|---|
| Works with | One app, one workflow | That vendor's platform | Any MCP-compatible AI app |
| Setup effort | High, repeated per pair | Low, if one exists | Medium, once per system |
| Who controls permissions | You | The vendor | You (or the vendor, if you use theirs) |
| Changing AI provider | Rebuild | Often lost | Reconnect |
| Best for | Fixed automation with no AI judgment | Quick wins inside one tool | Several AI apps on core systems |
| Main risk | Maintenance sprawl | Lock-in, limited actions | Untrusted or loosely permissioned servers |
Two points the hype skips. First, MCP does not replace your APIs. An MCP server usually sits on top of the API your system already has, so a system with no API needs that work first. Second, the protocol is still moving. The July 2026 revision removed protocol-level sessions and deprecated older features, so whoever maintains your server has to keep it current. If you are still deciding whether you need an AI agent at all, read our comparison of AI agents, chatbots and automation first.
What can MCP do for a real business?
It lets an AI assistant work with live company data instead of pasted extracts. The uses we recommend first are the ones where staff copy data between screens today:
- CRM: summarise a client's history before a call, draft the follow-up, log the outcome.
- ERP and accounting: list overdue invoices, explain a variance, prepare a payment reminder for approval.
- Inventory: answer "what is running low in Jeddah this week?" and draft a reorder for a buyer to confirm.
- CMS: draft a page, run content and SEO checks, file it as a draft for an editor.
- WhatsApp: give a customer service agent the order status and delivery date while the chat is open. Our WhatsApp Business API playbook covers the integration side.
- Reporting: pull numbers from sales, finance and marketing systems into one weekly summary.
The pattern is the same in each case. Read first, draft second, and let a person commit anything that changes money, stock or a customer conversation.
How does HBS use MCP in its own business?
We run our own website this way. The HBS website CMS is connected through MCP, so an AI assistant drafts content, runs validation and SEO checks, and files the work inside the real system, not in a chat window someone has to copy from.
The lesson we pass on to clients: the value sits in the connection and its rules, not in the chat. Checks that live inside the system apply every time, whoever (or whatever) writes the draft. And because the connection follows an open standard, the same CMS connection works with any MCP-compatible assistant, so the choice of model stays open.
How do you keep an MCP connection secure?
Treat every MCP server like a new employee with keys: confirm who it is, give it the fewest permissions that do the job, and make it ask before it acts. The concern is real. Forrester's State of Agentic AI 2026 found that 49% of security decision-makers named agentic AI as a concern. Use this checklist:
- Use proper authorization for remote servers. For servers reached over HTTP, the MCP authorization specification is based on OAuth 2.1, and servers must accept only tokens issued specifically for them. Shared admin passwords have no place here.
- Grant the least privilege. The official security best practices warn against broad scopes such as "admin:*" and recommend a minimal starting set of low-risk read operations, with more scopes requested only when a task needs them.
- Keep a human in the loop. The tools specification says there "SHOULD always be a human in the loop with the ability to deny tool invocations." Require approval for anything that moves money, changes stock or messages a customer.
- Plan for prompt injection. OWASP lists prompt injection as LLM01 in its 2025 Top 10 and warns that instructions can arrive indirectly through websites or files the model reads. An email or a supplier PDF can carry hidden instructions, which is one more reason to limit what the AI can do without approval.
- Install only trusted servers. The specification treats tool descriptions as untrusted unless they come from a trusted server, and the security guide warns that local servers run with the same privileges as the AI app. Use servers from the system's vendor or your own team, and review the code of anything else.
- Log every tool call. The specification recommends that clients log tool usage for audit purposes. If you cannot see what the AI did, you cannot defend it to a client or an auditor.
How should your business start with MCP?
Start with one system, one read-only question and one accountable owner, then add write actions once the read side has earned trust. In practice:
- Map your systems. List the CRM, ERP, inventory, CMS and messaging tools you run. Note which ones have an API and who owns each.
- Ask about official servers. Ask each vendor whether it offers an official MCP server. Use it if it exists and its permissions are clear.
- Pick one read-only use case. For example: "summarise this client's last six months of orders before the sales call." Set the number it must improve, such as preparation time per call.
- Build or configure a thin server. Expose only the data that use case needs, behind proper authorization.
- Add write actions with approval. Let the AI draft the update, the quote or the reminder, and let a named person approve it before it reaches the system.
- Review after 30 days. Check the logs and the number. Move to the next system only if the first one hit its target.
Is MCP worth acting on now?
Yes, if you have at least one system with an API and a team that copies data out of it every week. The standard is open, governed by a neutral foundation and supported by the AI platforms your staff already use, so a connection you build now is not tied to one model. Our advice: own your MCP servers and their permissions the same way you own your data. The AI on the other side will change. The connection should not have to.
Want to know which of your systems is worth connecting first? Book a 15-minute call and we will map your systems, pick one read-only use case and set the number it should move. Or see how we build API and systems integrations for businesses in Egypt and the Gulf.
