What is MCP and why it exists: the Model Context Protocol explained without code

Since Anthropic released MCP as an open standard on 25 November 2024, an AI tool no longer needs its own integration with every business system: the same remote MCP server can now be used by both Claude and ChatGPT. What is MCP? The Model Context Protocol is an open protocol that gives an AI application access to data, tools and workflows outside the chat itself, such as files, a calendar, a database or an online store. For a business, the main decision it raises is what the AI may only read through MCP and what it may change.

This no-code guide explains why MCP was created, how a connection works, what a server can offer an AI and what to check before the first connection. If you are not yet sure what a language model can and cannot do, start with what an LLM is and what AI really cannot do. Which business processes are worth handing to AI is covered in the pillar on AI automation of business processes. And once you know what you want to connect, see how we build custom automations and integrations.

What is MCP and why was it created

MCP is a shared language between an AI application and the systems where a business keeps its data, so that each integration does not have to be built from scratch.

In its original MCP announcement, Anthropic described the problem directly: even the most sophisticated models are isolated from data, trapped behind information silos and legacy systems, and every new data source requires its own custom implementation. MCP was meant to replace these fragmented integrations with a single protocol. Alongside the specification, Anthropic also released SDKs and a repository of pre-built servers, for example for Google Drive, Slack, GitHub and Postgres.

The official MCP documentation compares it to a USB-C port. Just as USB-C gives a standard way to connect electronic devices, MCP gives a standard way to connect an AI application to external systems. According to the documentation, these are data sources (local files, databases), tools (search engines, calculators) and workflows (prepared prompts).

Without MCP, spreadsheets, e-mails and store exports get copied into the chat and the result is typed back by hand. With MCP, the AI application requests the data it needs directly from the system and, once you approve, can also act in it. You save the copying, and you also let the AI reach data it could not reach before.

Who runs MCP and what the protocol itself costs

MCP no longer belongs to one company. On 9 December 2025 the Linux Foundation announced the Agentic AI Foundation, and MCP was one of the three projects contributed to it as founding projects. According to the project governance page, MCP is now part of Model Context Protocol a Series of LF Projects, LLC, and both the code and the specification are available under the Apache 2.0 licence. Under the same rules, membership in technical governance is held by individuals, and no company has a reserved seat. The protocol itself therefore costs nothing. You pay for the AI application you use, and for the server if someone has to build or run it.

The current specification version is labelled 2026-07-28 (as of October 2026). According to the documentation, the date in the version marks the last backwards-incompatible change, not the release day of a new feature.

How an MCP connection works: host, client and server

The AI application (the host) creates a separate client for every MCP server it connects to, and the server offers it data and tools through that client.

The MCP architecture documentation names three roles. Once you understand them, you also understand where access decisions are made:

• Host is the AI application you work in, for example Claude Desktop, Claude Code or Visual Studio Code. It manages all connections and asks you for consent.
• Client is the part of the host that keeps a connection to one server. Connect two servers and the host creates two clients.
• Server is a program that provides context and capabilities to the AI application, for example access to files, a database or an error-tracking system.

Technically, client and server exchange messages in the JSON-RPC 2.0 format, and the specification says it took inspiration from the protocol that standardised programming language support across developer tools. What matters to a user is that the same server works with different AI applications, so the system vendor writes it once and you choose the application you prefer.

Local or remote server

MCP has two transports. A local server runs on your computer and communicates through standard input and output (stdio); a remote server runs on the internet and communicates through Streamable HTTP. The transport also decides what the server can reach:

	Local server (stdio)	Remote server (Streamable HTTP)
Where it runs	On your computer as an ordinary process	On the internet, at the provider
Who it serves	Typically one client	Typically many clients
Sign-in	The access token often sits in a local configuration file	Authorisation as defined by the protocol, MCP recommends OAuth
What it can reach	Everything your user account can read	What the sign-in lets it reach
Updates	On each computer separately	The provider fixes the server in one place

For remote servers in Claude, one more practical point applies. According to Anthropic's help centre, Claude connects to a custom connector from Anthropic's cloud infrastructure, not from your computer, and that includes the desktop app. The server therefore has to be reachable from the public internet. An internal system behind a company VPN or firewall will not connect until you allowlist Anthropic's IP addresses.

If a server needs nothing from your computer, meaning no files, local tools or local network, the MCP documentation recommends using its remote version.

What an MCP server offers: tools, resources and prompts

A server can offer an AI three things: tools that perform an action, resources the AI reads from, and prompts that you start yourself.

Open the description of any MCP server and you will see these three categories. From which of them a server offers, you can tell whether it only reads or also writes:

Server capability	What it does	Who decides to use it	Examples from the documentation
Tools	Perform an action: write to a database, call an API, modify a file	The model, when it decides it needs the tool	Search flights, send messages, create calendar events
Resources	Provide read-only data: file contents, a database schema, documentation	The application	Retrieve documents, access knowledge bases, read calendars
Prompts	Prepared instruction templates for specific work with the server	The user	Plan a vacation, summarise meetings, draft an e-mail

From a risk point of view, tools are what matters. The model calls them itself when it decides, based on your request, that it needs them. The specification therefore requires the host to obtain explicit user consent before invoking any tool. The documentation also lists how applications handle this: approval dialogs for individual calls, settings that pre-approve safe operations, and a log of every tool run with its result.

Communication runs both ways. Through a feature called elicitation, a server can ask you for a missing detail or for confirmation of an action. If a question from the server pops up while you work, you are answering the server, not the model.

So when approving, do not permanently allow everything at once. If a server offers write tools and you approve them once and for all, the AI will use them without asking whenever it thinks it makes sense.

What MCP brings a business and what it does not solve

MCP shortens the path from a question to business data, but it does not make the model a more reliable source or the integration a safer system.

Where MCP makes sense

The MCP documentation gives examples such as an assistant with access to Google Calendar and Notion, or a company chatbot that connects to several databases so people can analyse data by asking questions in chat. For online stores, two recent examples straight from platform vendors are more interesting (as of October 2026):

• WooCommerce announced on its developer blog on 21 October 2026 that from version 11.3 the MCP connection to a store goes through the WordPress MCP Adapter plugin. For sign-in it recommends a WordPress application password for a user with only the capabilities the AI client needs.
• Shoptet, an e-commerce platform, lists an MCP server for its Shoptet Premium plan among the AI features of its admin in its product news of 14 October 2026.

On the AI application side, Claude supports remote MCP servers through custom connectors, and OpenAI's developer documentation describes how to make an MCP server available through a plugin in ChatGPT and Codex and through the API. In practice, choosing an AI tool does not tie you to one vendor's integrations.

What MCP does not solve

• Answer quality. According to the documentation, MCP covers only the exchange of context and does not dictate how an AI application uses the model and the data it receives. A model that gets the right data can still misread it.
• Security on your behalf. The MCP specification itself states that it cannot enforce its security principles (user consent, data privacy, tool safety) at the protocol level. Consent, permissions and data protection are the job of the application, the server and whoever configures them.
• Choosing a trustworthy server. The official MCP server registry says on its own page that it is still in preview. It verifies the publisher's namespace but leaves security scanning of the code to package registries and other catalogues.
• Recurring flows with fixed rules. If a task repeats in the same order every day, for example order, invoice and confirmation, it belongs in classic automation. The difference is explained in the article on automations for small businesses in n8n and Make.

Before your first connection, be clear about what you expect from MCP. If you want the AI to query your data and help with irregular work, MCP is the right route. Build a fixed recurring process as an automation.

MCP security: what to check before the first connection

Every connected server receives part of your access, so where it comes from, what it may change and who updates it all matter.

In its help article on custom connectors, Anthropic warns that they connect Claude to services Anthropic has not verified, and that Claude gets access to data in the connected services and can modify it, within your permissions. It therefore recommends using the Allow always option only for a server and tool you trust. During Research, Claude can call connector tools automatically without further approval, so it recommends disabling tools that write to other applications. According to the same guide, a malicious server may contain hidden instructions that try to steer the AI into an unintended action.

Local servers carry their own risk. The MCP guide on local server security describes a local server as an ordinary process of your user account, not a plugin in a sandbox. It inherits environment variables including tokens and API keys, can read anything your account can read, such as SSH keys, cloud credentials, browser profiles and your home directory, and can open connections to anywhere on the internet. The model reads the tool descriptions a server sends as instructions, so those too must be treated as untrusted input.

On Claude team plans, shared access becomes a question as well. If a connector uses a shared credential, such as a single API key, everyone who uses it gets that key's access rather than their own. How to handle keys and webhooks in automations is covered in the article on automation security.

Five questions to answer before connecting

1. Who publishes the server? You can tie it to a real publisher and a source repository, and you install exactly the package the documentation points to, not a similarly named copy. According to the MCP guide, a registry listing is not an endorsement.
2. Does it have to run on your computer? If it needs none of your files or local tools, use the remote version.
3. Which tools write? Turn those on only after a trial on a harmless task, and allow them permanently only when you trust the server.
4. What access will the server get? Its own narrowly scoped credentials for each server, nothing inherited or shared with another tool.
5. Who will update it? The MCP guide recommends installing a specific version rather than the latest one and updating it deliberately when a security advisory lands. One example is the seven security advisories for the official TypeScript SDK published between 30 September and 15 October 2026, covered in the article on the MCP SDK vulnerability.

Until you can answer each of these questions, do not connect the server. Otherwise you are giving access to business data to a program when you do not know who is behind it or who will fix it.

Getting started with MCP in a business: the first connection in five steps

Start with one task, one server from your system's vendor and tools that only read.

1. Pick one task. One where you copy data into an AI chat by hand today, for example a weekly order overview or searching internal documents.
2. Find the official server. Check the documentation of the system you want to connect. A server from the vendor itself beats an unknown package from the internet, and a remote version beats a local one.
3. Connect it in your AI application. In Claude, a remote server is added as a custom connector by entering its URL. According to Anthropic's help centre, custom connectors are available on the Free, Pro, Max, Team and Enterprise plans, but Free is limited to one. On the Team plan only an owner (Owner or Primary Owner) adds them to the organisation, and members then connect individually. As of October 2026.
4. Narrow the permissions. In the connector settings, keep only the tools the task needs and switch off writing for now. If the server signs in as a system user, create a separate user with minimal permissions for it, as WooCommerce recommends for the application password.
5. Tidy up regularly. If you do one thing, the MCP guide on local servers says, open your AI application's configuration, remove the servers you no longer use, and check where each remaining one comes from and which version it runs.

You can follow these steps on your own as long as you are using a ready-made server from the vendor and read-only tools. Bring in an expert when the AI is to write to orders, invoices or customer data, when you need to connect an internal system that has no official server, or when one credential would be shared by the whole team.

MCP in practice: what it means for a smaller business

A smaller business is better off starting by choosing and configuring a ready-made server from its system's vendor than by developing its own.

If you sell through Shoptet or WooCommerce, both platforms have a documented route to MCP as of October 2026 (Shoptet on its Premium plan), so you can take the first step without programming. It gets harder with systems that run only on an internal network, such as an older warehouse application. A remote connector in Claude cannot reach them without network changes, which makes it an architecture decision rather than a single click.

So the main question when choosing is what you let the AI reach. The same server works with Claude and ChatGPT, so you can switch AI applications later. The access you granted the server, however, stays until you revoke it yourself.

How we handle it at Denva: for automations and integrations, we first write down with you which tasks repeat and how much manual work they cost, and we tell you openly what is not worth automating. We design the integration so it is clear what happens at each step and where AI enters the flow, test it on your real data and hand it over documented, with training. For MCP, this means that before anything is connected it is clear which tools the AI gets and which it does not.

Conclusion: when to connect MCP and when to wait

Try MCP now if your business already uses AI, you copy data into it by hand and your system's vendor offers an official server. Start with read-only tools and one task. Hold off until you can answer the five questions above. That applies above all when the AI would write to orders, invoices or customer data. In that case, first write down what it may do and who will watch over it. If you have no concrete task, do not connect anything yet.

FAQ

Frequently asked questions.

What does MCP stand for?

MCP stands for Model Context Protocol. It is an open standard through which AI applications such as Claude or ChatGPT connect to external systems: files, databases, tools and workflows. Anthropic released it on 25 November 2024.

Is MCP free?

The protocol itself is, as both the code and the specification are under the Apache 2.0 licence. You pay for the AI application and its plan, for example the Claude Free plan includes one custom connector according to Anthropic (as of October 2026), and for building or running the server if your system's vendor does not provide one.

What is the difference between MCP and an API?

An API is the interface of a specific system; MCP is a standard way to make it available to AI applications. An MCP server can wrap an existing API and offer it as tools, resources and prompts that any MCP-compatible application understands.

Who owns and maintains MCP?

MCP was created at Anthropic, which contributed it in December 2025 to the new Agentic AI Foundation under the Linux Foundation. The project is now part of Model Context Protocol a Series of LF Projects, LLC. Membership in technical governance is held by individuals, and no company has a reserved seat.

Is it safe to connect AI to business data through MCP?

It can be, but safety comes from the configuration, not the protocol. The MCP specification states that it cannot enforce its security principles on its own. Use servers from a verified publisher, enable only the tools you need, allow writing only after a trial and give each server its own narrowly scoped access.