MCP explained for business leaders

Over the past year, nearly every software vendor has announced an “MCP server”. Your CRM has one, your ticketing system has one, and your developers probably want to connect a few more. If you’re deciding what to approve, here’s what MCP is, what it’s good for, and what to ask first.

MCP in one paragraph

The Model Context Protocol is an open standard for connecting AI assistants and agents to the systems your business already runs on. A system offers an MCP server: a list of things an AI may do there, such as “search tickets” or “look up an invoice”. Any AI tool that speaks MCP can then use that list. Think of it as a common plug: build the socket once, and every compatible assistant can use it.

Why it took off

A new assistant or a new system adds one connection, not a row of them.

Before MCP, every pairing of an AI tool and a business system was its own integration. Three assistants and four systems meant twelve integrations to build, secure and keep running, and adding a fifth system meant three more.

With a shared standard, each system builds one MCP server and each assistant learns MCP once. The same setup needs seven things to build, and adding a system adds one. You still decide access for every pairing, but you’re no longer writing a custom integration for each. That arithmetic is why vendors rushed to publish servers: one piece of work makes their product usable from every major AI tool.

It isn’t one vendor’s standard anymore

Anthropic introduced MCP in November 2024. In December 2025 it donated MCP to the Agentic AI Foundation, a new fund under the Linux Foundation, co-founded with Block and OpenAI and supported by Google, Microsoft and AWS. The technical decisions stay with MCP’s open maintainers, through public proposals.

Support is now broad:

AI tools that speak MCP: ChatGPT (in beta, with full write access on Business, Enterprise and Edu plans), Microsoft Copilot Studio, GitHub Copilot in VS Code, Google’s Gemini tools and Claude.
Vendors with official servers: GitHub, Atlassian (Jira and Confluence), Salesforce, Stripe and Notion, among many others.
The major clouds: AWS, Azure and Google Cloud all build MCP into their agent platforms. ATC-003 compares how AWS and Azure do it.

The standard is a safe bet. The ecosystem around it is young. The specification still changes, with the latest version published in July 2026, and the official registry of servers is still in preview.

Where the value is

There are three ways a business gets value from MCP, and they come with different levels of risk.

1. Your people’s AI assistants reach your systems. An employee asks Copilot or ChatGPT to summarize the open tickets for a customer, and the assistant reads them from Jira through Atlassian’s MCP server. This is usually the quickest win, because the vendor builds the server and your AI tool already speaks MCP. Often it’s an admin setting and a sign-in.

2. Your own agents reach your systems. If you’re building an agent, wrap your internal APIs in MCP servers once. Any model or agent framework can use them, so you’re less tied to one AI vendor. On AWS and Azure, a gateway can put your existing APIs behind MCP without rewriting them.

3. Your customers’ AI reaches your product. Publishing an MCP server is becoming what publishing an API was ten years ago: a way to be part of other people’s workflows. If your customers increasingly work inside AI assistants, an MCP server is how your product shows up there.

What MCP doesn’t do

MCP is plumbing. It doesn’t:

Make the AI more accurate. A wrong answer delivered through MCP is still wrong.
Decide what’s allowed. The server can do whatever its credentials allow, and the AI can ask it to do any of those things. The real boundary is the permission you give the server, not the instructions you give the AI. ATC-006 shows what that looks like for a database.
Vet anything. The official registry checks who owns a server’s name, not whether the server is safe.

The risks, in business terms

An MCP server is a new door into your systems. The AI reads whatever the server returns, including text written by outsiders: an email, a support ticket, a web page. That text can contain instructions, and the AI may follow them. In May 2025, researchers showed that a malicious issue in a public GitHub repository could make an agent using GitHub’s official MCP server leak data from private repositories. Nothing was wrong with the server. The agent simply had too much access while reading untrusted text.

Unvetted servers are a supply-chain risk. Community servers are code from strangers, running with your credentials.

Approved isn’t the same as unchanged. A server can change its behavior after you’ve reviewed it. Security researchers call this a “rug pull”. In September 2025, a package impersonating the email service Postmark’s MCP server worked normally for several versions, then an update made it quietly copy every email it sent to an attacker.

Shadow connections are easy. Any employee with a capable AI tool can connect a server to it, so decide who can turn it on, and set that explicitly. GitHub Copilot for business, for example, has a policy called “MCP servers in Copilot”. Since October 22, 2026, enterprise policies that were never configured follow a new default that may switch features like this on.

Data leaves through the AI. Whatever a server returns goes to the AI model, and so to whichever vendor runs that model. Check that this matches your data policies.

None of this is unique to MCP. Any integration that gives AI access to your systems carries the same risks. MCP just makes connecting so easy that these decisions get made quickly, often by whoever is in a hurry. OWASP, the security community behind the best-known web risk lists, now keeps a separate Top 10 for MCP, still in beta.

Eight questions to ask before connecting one to company data

Who built it, and who maintains it? An official server from the vendor is very different from a community package with one maintainer.
Can it change things, or only read? Start with read-only. For anything that writes, sends or pays, require a person to confirm. Stripe’s server, for example, asks for confirmation before refunds.
Whose permissions does it use? The best servers act as the signed-in user, with that person’s own access. A shared account with broad access turns every user into an administrator.
What’s the narrowest access it can work with? Grant that, not the default.
Where does the data go? Which AI vendor sees the results, and what do they keep?
Is every call logged, and does anyone look?
How are updates controlled? Pin the version and review changes, like any other software.
Can we switch it off in one place? A gateway or an admin policy should let you disconnect it for everyone at once.

If a vendor can’t answer these clearly, that’s your answer.

What it costs

The protocol is free and open. The costs are elsewhere:

AI usage. Every tool list and every result an assistant reads counts as input tokens. A server that returns whole records when a summary would do makes every question more expensive. ATC-009 shows where those costs hide.
Gateways. On AWS, AgentCore Gateway charges $0.005 per 1,000 tool calls, which is negligible. On Azure, MCP support comes with API Management’s dedicated tiers (not the Consumption tier), so the cost depends on whether you already run it.
Licenses. Some AI tools only allow full MCP use on business plans.
People. The real cost is reviewing servers, setting permissions and watching logs. Budget for it the way you would for any new integration.

MCP and A2A

You’ll also hear about A2A, the Agent2Agent protocol. MCP connects an agent to tools and data. A2A connects agents to each other, so an agent from one vendor can hand work to an agent from another. Google launched A2A in 2025, and it joined MCP at the Agentic AI Foundation in August 2026. Most businesses need MCP well before they need A2A.

How to start

Find out what’s already connected. Ask your teams which AI tools they use and what those tools connect to. You may already have MCP in use.
Pick one read-only use case with an official vendor server, such as letting support staff search past tickets from their AI assistant.
Route it through one control point: an admin policy in the AI tool, or a gateway in your cloud.
Measure usage, cost and whether people actually use it.
Add write actions only with a human approval step, one at a time.

MCP is quickly becoming the standard way AI connects to business systems. The question for leaders isn’t whether to allow it, but where to put the controls before it spreads on its own.

Status as of October 2026. Sources: Introducing MCP (Anthropic), MCP joins the Agentic AI Foundation, MCP specification changelog, 2026-07-28, MCP Registry, MCP security best practices, GitHub MCP exploit (Invariant Labs), Malicious postmark-mcp package (Snyk), OWASP MCP Top 10, MCP in VS Code (GitHub), Copilot default policy for new features, Stripe MCP, AgentCore pricing, API Management MCP servers, A2A joins AAIF.