Direct answer: What is MCPMCPA standard that lets an AI program use your tools and data under clear permissions.Open the glossary? MCP (Model Context Protocol) is an open protocol that connects AI applications to the data and tools in your systems. 1 small MCP server exposes selected data and actions from an ERP, a spreadsheet, a database, or a CRM. AI clients such as Claude, ChatGPT, OpenClaw, and Hermes AgentAI agentAn AI program that performs work steps by itself, for example reading a message, drafting a reply, and recording the result.Open the glossary use it through 1 standard method. The existing system is not rebuilt.
Main condition: this holds when your source system has an APIAPIThe official door 2 systems use to exchange data, without anybody copying it by hand.Open the glossary, a database, or files a program can read, and your team uses an AI client that supports MCP. The definitions in this article use specification revision 2026-07-28. Limit: MCP is not an AI model, not a finished application, and not a security guarantee. You still set access rights, human approval, and an audit log yourself. This article does not cover the 5 MCP specification revisions; read the 5 MCP versions article (in Indonesian) for that.
We read these sources on 13 September 2026: the official Model Context Protocol specification, revision 2026-07-28 and the MCP governance page. The simulation in this article uses labelled dummy data, not real customer data.
The problem: every AI connection is written again
Every AI client has its own way to connect to your systems. Without a standard such as MCP, the IT team writes a separate integration for each new application, and that work repeats every time another AI client needs the same access.
Staff often copy data from an ERP or a spreadsheet into a chat window by hand, and that copy goes stale as soon as the source system changes. Without a standard, there is no uniform way to limit what an AI may read and write on each system. Sources: the official MCP introduction and the MCP architecture page.
MCP defined in 3 sentences
The Model Context Protocol specification describes MCP as an open protocol that connects LLM applications to external data sources and tools. The official site uses the USB-C analogy: 1 standard way to connect an AI application to many outside systems, the way 1 port serves many devices. Source: the MCP introduction.
Anthropic announced MCP as an open source project on 25 November 2024, with local server support in Claude Desktop and several ready-made servers. MCP now lives under "Model Context Protocol", a project under LF Projects, LLC, with the specification and code under the Apache 2.0 licence. Sources: the Anthropic announcement and the MCP governance page.
The diagram above shows that shift. Without a standard, every AI client connects straight to every system, and the number of connections grows fast as the number of applications grows. With 1 MCP server as the connection point, the number of connections drops, and the source systems on the right do not change at all.
3 roles: host, MCP client, and MCP server
The specification splits the MCP architecture into 3 roles. A host is the AI application that starts the connection, for example Claude Desktop on a manager's laptop. An MCP client is the connector inside the host. An MCP server is the service that gives context and capabilities, like 1 small door into your ERP or another system. Source: the MCP specification.
1 MCP client talks to exactly 1 server, while 1 host can manage many clients at once. The host is also the one that enforces security policies, user consent, and authorization decisions, not the AI model itself. Source: the MCP architecture page.
In the diagram above, the host manages 2 MCP clients, each connected to 1 server. Each server exposes 3 features to its source system, and the amber dot marks the consent the host asks for before a tool runs.
3 server features: tool, resource, and prompt
An MCP server offers 3 features to the host. A tool is a function the model runs. A resource is context data with a unique URI, for example a file or a database schemaSchemaExtra description inside page code that tells a search engine what the page is, for example an article, a service, or a question and answer.Open the glossary. A prompt is a message template the user selects explicitly. Each feature is controlled by a different party, as the table below shows. Source: the MCP specification.
| Server feature | Who controls it | Content | Business example |
|---|---|---|---|
| Tool | The model, with human approval from the host | A function the model runs | check_stock, find_customer, draft_invoice |
| Resource | The host application | Context data with a unique URI | A price list, a sales table schema |
| Prompt | The user | A message template selected explicitly | Summarise a customer complaint in an SOP format |
The tool row above also applies to write actions. The specification states that there should always be a human in the loop who can deny a tool call, so human approval is not an optional extra for a risky action such as changing a price or sending a message. Source: the MCP tools specification.
What MCP is not
4 things below are often misread. Not an AI model: MCP does not answer questions; the model inside the host answers, and MCP only connects that model to data and tools. Not a finished application: an MCP server must be built for your source system, not bought as a ready product. Not a security guarantee: the specification leaves consent and enforcement to the host and the server builder, so access rights, human approval, and an audit log stay your job. Not mandatory OAuth 2.1: authorization is optional and advised for remote servers, while a server that runs over stdio takes credentials from the environment. Sources: the MCP specification and the MCP authorization specification.
Example: a shop owner asks Claude for stock
The simulation below uses dummy data for 1 fictional shop with 1 MCP server that has 2 read tools, check_stock and check_stock_history, on a stock spreadsheet. The product name and stock count are examples for explanation, not real customer data.
| Input (what the owner typed) | Recorded (on the MCP server) | Output (what the owner saw) |
|---|---|---|
| "How much Arabica Coffee 250 g do we have?" | tools/call check_stock with sku KA-250; consent given in the host; result 42 units | "Arabica Coffee 250 g stock: 42 units as of 09:12 local time." |
| "When was this stock last restocked?" | tools/call check_stock_history with sku KA-250; result 3 days ago, 50 units added | "Last restocked 3 days ago, 50 units added." |
| "Add 20 units to this stock." | no write tool on this server; the model answers without calling a tool | "This server only reads. Add stock through the point-of-sale app, or ask for a write tool with approval." |
The third row shows the limit of a read tool: this server has no write tool, so the model declines to add stock and points the owner to the point-of-sale app or to building a write tool with approval. The host still asks for consent before every tool call. Source: the MCP tools specification.
When MCP is relevant for your business
Use the checklist below before you start an MCP project. When most items are not met yet, clean up your data and process first, then come back to MCP.
- The source system has an API, a database, or an export file a program can read. Owner: the IT lead. Evidence: a link to the API documentation or a sample file.
- There are 3 repeated questions staff ask every day. Owner: the operations lead. Evidence: a list of those 3 questions.
- Each system has a data owner who can grant test access. Owner: the business owner. Evidence: a job title per system.
- The team already uses 1 AI client that supports MCP, such as Claude, ChatGPT, OpenClaw, or Hermes Agent. Owner: the team lead. Evidence: the client name and plan.
- Personal data columns are already flagged for filtering under Law 27/2022 (the PDP Law). Owner: the data owner. Evidence: a list of those columns.
- Stop criterion: without 3 repeated questions, postpone the MCP project and clean up the data first.
For the benefits per department, read 7 benefits of MCP for companies. For the technical message flow of 1 tool call, read how MCP works: host, MCP client, and MCP server.
Frequently asked questions
Is MCP the same as ChatGPT or Claude? No. Claude and ChatGPT are hosts, applications that start the connection to a server. MCP is the connection rule that host uses, not the application itself.
Who owns MCP now? Anthropic announced MCP on 25 November 2024. MCP now lives under "Model Context Protocol", a project under LF Projects, LLC, with the Apache 2.0 licence.
Do I have to replace my existing system? No. An MCP server reads and writes to the existing system through its own API or database. The source system itself is not rebuilt.
Is MCP safe for customer data? Security is not an automatic part of MCP. The specification leaves consent to the host, so security comes from the access rights, human approval, and audit log you set up yourself.
How much does an MCP server cost? The cost depends on the number of tools, the number of source systems, the authentication method, and the hosting location. Read the MCP server cost article for the formula and the packages.
Next step
The limit that still applies: MCP connects, but access rights, human approval, and an audit log stay your job and the server builder's job. On our own systems, 3 MCP servers serve content, quotes, and scheduling for the OpenClaw and Claude agents. Write actions on those servers use explicit confirmation, per-scope access rights, and an audit log.
If your team wants an MCP server that exposes selected data and actions from a system you already use, without rebuilding that system, Send your brief explains the scope and the packages for the MCP Server Development Service. If you want to ask first, Book a free consultation.
Sources
- Model Context Protocol: specification revision 2026-07-28
- Model Context Protocol: official introduction
- Model Context Protocol: architecture
- Model Context Protocol: tools specification
- Anthropic: Model Context Protocol announcement
- Model Context Protocol: governance
- Model Context Protocol: authorization specification
