What is MCP? The Model Context Protocol, explained for business leaders.
The plumbing that lets AI work inside your systems, not just beside them.
The short answer
MCP (Model Context Protocol) is an open standard that lets AI tools like Claude, ChatGPT and Microsoft Copilot connect to business systems such as email, files, CRM and accounting software.
Instead of a custom integration for every pair of AI tool and system, each system is connected once and any MCP-compatible AI can use it, with the permissions you set.
Key facts.
- Anthropic launched MCP as an open standard on 25 November 2024.Anthropic, November 2024 · source
- On 9 December 2025 Anthropic donated MCP to the Agentic AI Foundation, a fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg.Anthropic, December 2025 · source
- ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code are among the products that have adopted MCP.Anthropic, December 2025 · source
- At the donation, Anthropic counted more than 10,000 active public MCP servers and 97 million monthly downloads of its official software kits.Anthropic's figures, December 2025 · source
- By July 2026, MCP's lead maintainers reported close to half a billion downloads a month across the official software kits.MCP lead maintainers, 28 July 2026 · source
- The current version of the specification is 2026-07-28.Model Context Protocol, October 2026 · source
- The specification's security guidance says an AI app that sets up a local MCP server in one click must get the user's explicit consent first, and warns that such servers run with the same privileges as the app.MCP security best practices, version 2026-07-28 · source
What is MCP, in plain English?
MCP is how an AI assistant reaches the rest of your business, through one standard plug instead of a custom build for every system.
Out of the box, an AI assistant only knows what you paste into it. MCP is how it reaches the rest of your business: your files, your inbox, your CRM, your project tools. People call it "USB-C for AI", and the MCP project uses the same comparison: one standard plug, so any AI tool can connect to any system that supports it.
Before MCP, connecting an AI tool to a system meant a custom build for each combination. Five AI tools and ten systems could mean fifty integrations. With MCP, each system is connected once. If you are new to the basics, start with our guide to what AI is, then come back.
How does MCP work?
There are three parts: the AI app your people use, a connector inside it, and a small server for each system.
You do not need to build any of them to benefit, but it helps to know the words a vendor will use.
- Server CRM
- Server SharePoint
- Server Project tool
- Server Accounting
| Part | What it is | Example |
|---|---|---|
| MCP host | The AI app your people use | Claude, ChatGPT, Microsoft Copilot |
| MCP client | The connector inside that app that speaks MCP | Built in; you rarely see it |
| MCP server | A small service that exposes one system's data and actions to AI | A server for your CRM, SharePoint or project tool |
A server can offer three things, as the MCP specification overview sets out: resources the AI can read (documents, records), tools it can use (create a ticket, draft an email, update a record), and prompts, which are saved instructions for common tasks. The AI decides when to use them, and the permissions you grant decide what it is allowed to do.
In most business tools today, MCP shows up under a friendlier name, such as "connectors". Anthropic, for example, describes Claude's connector directory as powered by MCP.
MCP vs an API.
An API is a system's own way of talking to software; MCP describes that API in one standard way AI can use.
An API is how one piece of software talks to another, and every system's API is different. MCP sits on top: it describes a system's API in a standard way that AI can understand and use without a developer wiring each one up. Most MCP servers are a thin layer over an existing API, so MCP does not replace your data pipelines or integrations; it gives AI a common way in.
Who supports MCP?
MCP started at Anthropic, but it is no longer one vendor's standard.
Anthropic, the company behind Claude, launched MCP in November 2024. Since December 2025 it has been governed by the Agentic AI Foundation under the Linux Foundation, with Google, Microsoft, AWS, Cloudflare and Bloomberg among its supporters. ChatGPT, Gemini and Microsoft Copilot all support it, and Microsoft documents how to extend a Copilot Studio agent with MCP.
For a NZ business that matters for one reason: you are less locked in. A connection built for one AI tool can work with another, so the choice of tool can change without rebuilding every integration. Our comparison of AI tools sets out the platforms side by side.
What can MCP do for a business?
MCP is what turns an AI assistant into something that works inside your systems.
Typical uses we see scoped:
- Answer from your own knowledge. Staff ask a question and the AI searches SharePoint, Google Drive or your wiki and answers with sources.
- Draft in context. A reply to a client drafted with their CRM history and the relevant policy, ready for a person to check and send.
- Update systems. Meeting actions turned into tasks in your project tool, or notes logged against the right client record.
- Report across systems. A weekly summary pulled from sales, finance and support data that used to take someone half a day.
These are the building blocks of agentic AI, where a large language model works through steps on its own and an orchestration layer keeps the steps in order. Our guide to what AI agents are goes further, and our CEO briefing explains why AI agents are doing actual work. For the time saved per task across use cases we have scoped, see AI examples from New Zealand businesses.
How does New Zealand law apply to MCP?
There are no MCP-specific rules in New Zealand, but personal information an AI reads through a connector is still covered by the Privacy Act 2020.
The Privacy Commissioner's AI guidance starts from the position that the Privacy Act 2020 applies to everyone using AI tools in New Zealand, and recommends a privacy impact assessment before you use one. A connector widens what the AI can see, so include each connector in that assessment and update it when you add one. Our guide to AI and the Privacy Act goes through the principles in plain English.
Not legal advice. This page explains the general position. For decisions about your organisation, talk to a lawyer.
Our view: connect after you govern, not before.
Most AI programmes stall because the AI sits in a browser tab, away from the work. Connection fixes that, which is why integration is the layer that pays. We cover why in the integration layer nobody buys.
But order matters. We build guardrails before process, process before knowledge, and knowledge before connection. Connect an ungoverned AI to your systems and you speed up the mess, with access to everything.
MCP is the plug. Governance decides what it is allowed to plug into.
What are the risks of MCP?
Connecting AI to real systems is where the value is, and also where the risk changes.
An AI that can only chat can give a bad answer. An AI connected through MCP can read your files and take actions.
| Risk | What it means | What to do |
|---|---|---|
| Unvetted servers | Anyone can publish an MCP server; a local one runs code on the user's machine with their permissions | Approve servers centrally; use official servers from the system's vendor where they exist |
| Too much access | A connector given broad permissions can reach far more than the task needs | Grant the least access needed, read-only where possible, and review it |
| Prompt injection | Instructions hidden in an email or document the AI reads can try to redirect it | Keep a person approving actions that send, delete or pay. See prompt injection |
| Shadow connections | Staff connect AI tools to work systems without IT knowing | Control connectors from the admin console. See shadow AI |
| Privacy | Personal information read through a connector is still covered by the Privacy Act 2020 | Include connectors in your privacy impact assessment. See AI and the Privacy Act |
The MCP specification's own security best practices set out these risks for developers, including user consent before a local server runs and least-privilege permissions. Prompt injection is also number one on the OWASP list of AI security risks. Ask any vendor or developer building for you how they follow both.
How should a NZ business get started with MCP?
Use the connectors you already have, set the rules first, and measure one workflow before you build anything custom.
- Find out where you stand. The free NZ AI Benchmark is 40 questions, takes about 20 minutes, and shows whether your governance and processes are ready for connected AI.
- Start with the systems your AI tool already offers. Claude, ChatGPT and Copilot each list built-in connectors. Use those before anything custom.
- Set the rules first. Decide who can add connectors and what data AI may read or change. The free AI Champions Committee Resource Pack has the policy and register templates, and our AI policy guide covers what to write down.
- Give AI your knowledge before your systems. The Organisational Brain Toolkit sets up your company context in Claude or Copilot, so connected AI has something good to work from.
- Pick one workflow and measure it. Choose a weekly task that spans two systems, time it now, then connect and compare.
- Keep a person on the send button for anything that reaches a customer, moves money or deletes data.
For custom connections into your own systems, that is integration work we scope case by case through the AI Operating System.
Frequently asked questions.
What does MCP stand for?
Model Context Protocol. "Model" is the AI model, "context" is the information and tools it can reach, and "protocol" means an agreed standard for how they connect. Anthropic launched it in November 2024, and it is now governed by the Agentic AI Foundation under the Linux Foundation.
Do I need MCP to use AI in my business?
No. You can get a lot from AI tools on their own. MCP matters when you want AI to work with your own systems: reading your files, using your CRM or updating records. Most businesses meet it first as the built-in connectors in Claude, ChatGPT or Copilot.
Is MCP safe?
MCP is a standard, so safety depends on how it is used. Official connectors from trusted vendors, least-privilege permissions, admin control over who can add connectors, and a person approving important actions keep the risk manageable. Unvetted servers and broad access are where problems start.
Does Microsoft Copilot support MCP?
Yes. Microsoft is among the supporters of the Agentic AI Foundation, and Microsoft Copilot is listed among the products that have adopted MCP. In Copilot Studio, Microsoft's tool for building agents, you can connect an agent to an MCP server and use its tools and resources. Check what your Microsoft 365 plan and admin settings allow, as availability varies.
What is an MCP server?
An MCP server is a small service that makes one system, such as a CRM, file store or project tool, available to AI through the MCP standard. It tells the AI what it can read and what actions it can take, within the permissions you grant.
Is MCP the same as an AI agent?
No. MCP is the connection, an agent is the worker. An AI agent uses MCP connections to read information and take steps across systems. Without connections an agent can only talk; with them it can do. That is why connections need the same care as any other access you give software.
Sources.
- Introducing the Model Context Protocol, Anthropic (25 November 2024; accessed 21 October 2026)
- Donating the Model Context Protocol and establishing the Agentic AI Foundation, Anthropic (9 December 2025; accessed 21 October 2026)
- The 2026-07-28 specification, MCP blog (28 July 2026; accessed 21 October 2026)
- What is the Model Context Protocol?, Model Context Protocol project (accessed 21 October 2026)
- Specification overview, version 2026-07-28, Model Context Protocol project (July 2026; accessed 21 October 2026)
- Security best practices, version 2026-07-28, Model Context Protocol project (July 2026; accessed 21 October 2026)
- Extend your agent with Model Context Protocol, Microsoft Learn (updated October 2026; accessed 21 October 2026)
- LLM01: Prompt injection, OWASP GenAI Security Project (2025; accessed 21 October 2026)
- Artificial intelligence (AI), Office of the Privacy Commissioner (September 2023; accessed 21 October 2026)
- Privacy Act 2020, Parliamentary Counsel Office (latest version; accessed 21 October 2026)
Related topics
Keep going.
Your next step
Connect AI to your systems, in the right order.
Book a Discovery Call and we will look at which of your systems are worth connecting first, and what needs to be in place before you do.
Changelog: 21 October 2026, first published.