MCP, the Model Context Protocol, is an open standard for connecting AI assistants and agents to tools and data sources. Instead of every assistant needing its own bespoke integration to your CRM, your files or your booking system, a system exposes an MCP server once and any MCP-capable assistant, Claude, ChatGPT, Copilot, Gemini and others, can use it. Anthropic released it in November 2024 and in December 2025 donated it to the Agentic AI Foundation under the Linux Foundation, co-founded with OpenAI and Block and supported by Google, Microsoft and AWS, so it is now vendor-neutral. For a UK SME it means three things: connectors you have built or bought are more likely to outlast a change of assistant; the assistant you already pay for can reach your systems with less custom work; and the security questions, what a connector may read and do, and who authorised it, need answering deliberately, because a connector is exactly what prompt injection would exploit.
- What it is
- An open standard for AI-to-tool connections
- Who governs it
- Linux Foundation’s Agentic AI Foundation, since Dec 2025
- What it means for you
- Portable connectors; permissions to decide
The problem it solves
Before a common standard, connecting an assistant to a business system meant custom code for each pair: this assistant to this CRM, that assistant to that drive. Every new assistant meant rebuilding the connections, and every vendor’s connector was its own lock-in. MCP defines one way for a system to describe what it offers, the data it can return and the actions it can take, and one way for an assistant to call it. A firm exposes its booking system as an MCP server once; any assistant that speaks MCP can then read availability and make a booking, subject to the permissions the firm grants.
Who is behind it now
Anthropic released MCP as an open-source project in November 2024. Adoption across the main assistants and developer tools followed through 2025, and on 9 December 2025 Anthropic donated it to the newly formed Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, with Google, Microsoft, AWS, Cloudflare and Bloomberg among the supporters; Block’s goose and OpenAI’s AGENTS.md were donated alongside it. The foundation’s stated purpose is to keep the protocol open, neutral and community-governed. For a buyer that is the point: a standard no single vendor controls is one worth building on.
What it changes for an SME buying AI
Three practical changes. First, the assistant you already pay for can reach your systems through connectors, either ones the vendor supplies for common products or ones a supplier builds for your own software, which lowers the cost of the “answer from our data” and “act in our system” features that used to need a full build. Second, a connector built to the standard is portable: if the firm moves from one assistant to another, the connection to the CRM comes along. Ask any supplier whether what they build for you is exposed as an MCP server and who owns it. Third, the pricing of AI features shifts from bespoke integration to per-use running cost, which the firm should have stated per unit before go-live as with any feature.
RelatedIntegrating AI with the systems you already run A knowledge assistant on your own documents What AI features cost to run
The security questions it raises
A connector is a door. Everything an assistant can reach through it is what a prompt injection could misuse, which the NCSC says cannot be fully prevented, so the controls sit on the door. Each connector is authorised deliberately by an administrator, not switched on by a user. It has the least access that does the job: read availability, not the whole customer table; create a booking, not delete one. Actions that send, pay, delete or change access require a person to confirm. Every call is logged with who or what made it. Third-party MCP servers are treated like any other supplier, with the due diligence questions answered and a record kept. And a connector is removed when the process it served ends. That list is short, and it is the difference between a useful assistant and a hole in the wall.
RelatedAI security risks for a UK small business AI vendor due diligence checklist
How to use it without being locked in
Own the server. When a supplier connects your systems to an assistant, the MCP server that exposes your data should be code you own, in your accounts, documented in the runbook, with the credentials in your vault. Then the assistant is replaceable and the connection is not. Prefer vendor-neutral connectors for common products where they exist. Keep the permissions list as a document, reviewed with the AI policy. And test that a second assistant can use the same server before you rely on the portability, which takes an afternoon.
RelatedYour data when a supplier builds your software What an AI agent is, and when an SME needs one
Common questions
What does MCP stand for?
Model Context Protocol: an open standard for connecting AI assistants and agents to tools and data sources such as a CRM, files or a booking system.
Who owns MCP?
Nobody, since December 2025: Anthropic donated it to the Agentic AI Foundation under the Linux Foundation, co-founded with OpenAI and Block and supported by Google, Microsoft and AWS.
Does MCP work with ChatGPT, Claude and Copilot?
Yes. The main assistants and developer tools support it, which is why a connector built to the standard can be reused across them.
Is MCP safe?
As safe as the permissions you grant. A connector is a door, so it is authorised by an administrator, has least privilege, requires human confirmation for consequential actions, logs every call, and is treated as a supplier if a third party runs it.
Do I need to understand MCP to buy AI?
Only enough to ask two questions: is the connection to our systems built to the standard and owned by us, and what exactly may it read and do.
Does MCP replace the need for custom integration?
It reduces it. Common products have connectors; your own systems still need a server built and owned by you, which is a smaller job than the bespoke integrations it replaces.