MCP in plain words: how AI connects to your data and tools

An AI assistant that only knows what you paste into the chat is useful, but limited. As soon as you want it to read your CRM, check last month’s figures or create a ticket, it needs a connection to those systems. The Model Context Protocol, MCP, is the standard way to make that connection.

The problem it solves

Anthropic introduced MCP in November 2024 as an open standard. Its announcement named the problem plainly: even the most capable models are constrained by their isolation from data, trapped behind information silos and legacy systems, and every new data source requires its own custom implementation.

Without a standard, every pairing of an AI application and a system needs its own integration. With MCP, a system is connected once and can then be used by every application that speaks the protocol. The official site compares MCP to a USB-C port for AI applications: one standard plug instead of a drawer full of adapters.

How the pieces fit together

MCP has three roles.

• Host: the AI application you work in, such as Claude Desktop, Claude Code or Visual Studio Code.
• Client: a component inside the host that keeps one connection to one server. A host connected to five servers runs five clients.
• Server: a program that offers data and capabilities. It can run on your own computer, like a server that reads local files, or on the internet, operated by a software vendor.

A server can offer three kinds of things:

• Tools: actions the model can call, such as querying a database or calling an API.
• Resources: information to use as context, such as file contents or database records.
• Prompts: reusable templates for recurring tasks.

In practice it goes like this. The client asks the server which tools it offers. Each tool comes with a name, a description of what it does and a precise list of the inputs it expects. The application adds those tools to what the model may use. When the model decides it needs one, the application sends the call to the right server and puts the result back into the conversation. Under the hood, the messages follow a common format called JSON-RPC; local servers talk to the application directly, remote servers over HTTP, and MCP recommends OAuth for signing in.

As a user, you mostly see none of this. In Claude, an MCP server shows up as a connector; in ChatGPT, a workspace can add custom MCP servers through plugins.

Where MCP stands today

In December 2025, Anthropic donated MCP to the Agentic AI Foundation, a fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. By then, according to Anthropic, MCP had been adopted by ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code, and there were more than 10,000 active public MCP servers. The specification keeps evolving; the current version is dated 28 July 2026.

What it means for your company

MCP is plumbing, not a policy. The specification says so itself: MCP cannot enforce security principles at the protocol level. Whether a connection is safe depends on how the application and the servers are built and set up. The specification spells out the principles: users must consent to and understand what data is accessed and what actions are taken, applications must get explicit consent before a tool is used, and tools deserve caution because they amount to running code.

MCP is plumbing, not a policy. Safety comes from how you set it up.

Five questions to ask before you connect your own data:

1. Who built this server? OpenAI advises against connecting a custom MCP server unless you know and trust the application behind it, and warns that any server may receive sensitive data from your conversations.
2. Does everyone sign in as themselves? With OAuth, each person connects with their own account, so the server acts on that person’s behalf, with that person’s rights. The specification also requires that an access token is issued for that specific server and not passed on to others.
3. Is access as narrow as it can be? MCP’s security guidance recommends starting with the smallest set of permissions and adding more only when a task needs them.
4. Are reading and writing separated? Reading data is one thing; sending, deleting or paying is another. ChatGPT, for example, currently asks for manual confirmation before write actions.
5. Can you see what happened? A log of who used which tool, and when, makes problems visible and keeps responsibility clear.

One risk deserves a special mention. Text the AI reads through a tool, such as an email or a web page, can contain hidden instructions. OpenAI calls this prompt injection: if the model follows them, it may take actions that neither the user nor the developer intended.

Zaela uses this standard. It works in Claude (desktop, Cowork and Code), ChatGPT or any assistant that supports MCP: your people connect one link, and the right tools come along through one gateway. Your AI sees exactly what you may see, keys are encrypted and never visible, not even to the AI, and every action is logged.