An MCP server is a program that exposes a software's tools and data in a standard format. A compatible artificial intelligence agent connects to it, asks for the list of available actions, and uses them without a single line of integration written for it. MCP stands for Model Context Protocol, and it has become the normal way to connect AI to a CRM, an ERP or an accounting system.
Anthropic published the protocol in November 2024 and describes it as a USB-C port for AI. The image holds up. Before it, every tool needed its own wiring. This guide explains what an MCP server actually does and where to find the ones that exist. It also covers what the protocol costs in context, and what to lock down before opening access to your data.
What exactly is an MCP server?
An MCP server acts as a translator between a piece of software and an AI agent. It publishes a list of actions, each with its name, description and expected fields. The agent reads that list, picks the action matching the request, fills the fields and runs it. No specific prompt is needed for any of this.
The architecture comes down to three roles. The host is the AI application you use, Claude, a code editor or a workflow orchestrator. The client is the host component holding one connection, one per server. The server is the program serving the tools. It runs either on your machine or remotely over HTTP, and that is the only practical difference between a local and a remote server.
The current specification dates from July 2026. It makes the protocol stateless, meaning each call carries its own version and capabilities instead of depending on an open session. For an IT department, that is the difference between a service that sits behind a load balancer painlessly and one that does not. The same standardisation logic appears in Claude skills, which carry the method where MCP carries the access.
Why the protocol replaced custom integrations
Before MCP, equipping an agent with a tool meant coding every call to its programming interface, one by one. I filmed the demonstration on a specific case, Notion. For an agent to really work inside Notion, you must give it page creation, reading and property updates. Add block handling and database handling on top. A good fifteen actions to write, then to maintain at every documentation change.
The Notion MCP server replaces that project with a single connection. The agent asks for the tool list, receives it with the schemas, and runs. When the publisher adds an action, it shows up on its own. That is where the real gain sits, in the maintenance avoided far more than in the setup.
The protocol also opens up tools that had no public interface at all. Airbnb is the textbook case, with a community server exposing listing search although no official interface allows it. In an orchestrator such as n8n, a community node is enough to connect these servers, list their tools, then run one.
Claude connected to accounting: the Pennylane example
The clearest example for a French business owner remains accounting. I connected Claude to Pennylane and I have been running the books in natural language since. Spotting unpaid supplier invoices, analysing the main cost lines, preparing an eight-week cash plan. Questions are asked out loud, answers come back with the real figures from the file.
Pennylane has since published its own MCP server, open to accounting firms and companies from the Essentiel plan upwards. Access is read-only, checked in October 2026: the assistant consults, it neither creates nor changes anything. Write access is announced for later, with human validation. Connecting is a matter of adding a custom connector in Claude's settings, and authentication goes through a standard Pennylane window.
The internal shift this produces deserves to be stated plainly. An assistant that answers brings an honest productivity gain, without changing anything in the organisation. An agent that reads your real figures changes the nature of the question being asked. I detailed the full setup in a LinkedIn post in June 2026, and it is the topic that has triggered the most questions from executives since.
Vendor-official, community or internal: which server to pick
Three server families coexist and they do not call for the same checks. The official server is published by the tool's vendor. The community server is published by a third party, often on a public programming interface, sometimes on a product that has none. The internal server is the one your teams build on your own systems.
An official registry has existed since September 2025 to find public servers. Beware the misreading it invites: the verification it performs covers name ownership, through repository authentication or domain records. It says nothing about code quality or security. A verified registry entry is an authenticated business card, not an audit. On the ChatGPT connectors side, the catalogue logic is the same.
Who holds the protocol today
The governance question comes up fast in a management committee, because nobody wants to build on a format held by a single player. Anthropic handed MCP to the Agentic AI Foundation, a dedicated fund under the Linux Foundation, in December 2025. The board brings together Amazon, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI.
The alignment of the major vendors is real and predates that donation. OpenAI built the protocol into its agents development kit in spring 2025, and Google followed a few weeks later. Microsoft wired it into Copilot Studio, Windows, GitHub and Azure AI Foundry. For a company choosing today, lock-in risk on this specific point is low.
Should you connect everything? The context question
No, and this is the point most guides leave out. Every connected server publishes the description of all its tools, and those descriptions occupy the model's working memory permanently. Three rich servers are enough to eat a serious share of the available budget, before the first question is even asked.
The debate broke into the open in March 2026, when Perplexity announced it was dropping the protocol for internal use, in favour of classic programming interfaces. Its chief technology officer pointed at two things, the weight of tool definitions and authentication friction. The nuance matters: the company kept its public MCP server for outside developers. The complaint targets loading everything, not standardised access.
- Connect by use case, not by available tool. A sales agent has no need for the accounting server.
- Switch off what you do not use. A server turned on out of curiosity and never removed costs context in every conversation.
- Prefer progressive discovery when your client offers it, because it loads tools at the useful moment instead of exposing everything at startup.
This trade-off meets the one separating workflows and agents. A known, stable process is handled very well by a fixed sequence, cheaper and more predictable. MCP becomes interesting when the sequence of actions is not known in advance.
Securing access before opening the tap
This is the part IT departments handle first, and they are right to. France's CERT-FR published an alert in April 2026 about agentic AI automation products installed on workstations. Its position is clear: use limited to isolated test environments, with no production data, no secrets, no personal or banking data.
Two of its recommendations transfer directly to an MCP deployment. Restrict the tools reachable by the agent to the strict minimum, and require human validation before any side-effect action. Reading an invoice and issuing a transfer are not handled the same way, and the protocol does not draw that line for you.
| Risk | What happens | The control |
|---|---|---|
| Poisoned tool | Hidden instructions inside a tool description, which the model reads and you do not | Allowlist of approved servers, review of descriptions |
| Change after the fact | The server alters its tools once access has been granted | Pin the tool list and alert on any difference |
| Indirect injection | Hidden instructions inside data returned by the tool, a ticket or an email | Human validation before any action that writes or sends |
| Over-broad rights | An access token opening far more than the use case needs | One service account per use, read-only by default |
None of this is specific to MCP, but the protocol widens the surface in one go, since a single connection brings dozens of actions. The rest of the reflexes to install sit in our guide to AI agent security.
Which MCP server should you start with in your company?
Start with an official server, read-only, on a tool whose data you already know well. Accounting and sales tracking are the two best grounds, because questions there are frequent and answers verifiable at a glance. The French state made exactly that choice by launching the data.gouv.fr MCP server in February 2026. It gives natural-language access to around 74,000 datasets and interfaces in the catalogue, as counted in July 2026.
The next level up means building your own servers on your internal systems. In the case study published by Anthropic, Zapier reports 89% AI adoption among its employees and more than 800 agents deployed internally. The company builds its own servers, which help Claude navigate its codebase. That is the stage where the protocol stops being a demo gadget.
Tandem has supported more than 50 companies and around 100 engagements on these topics, and the most frequent mistake never concerns the technology. It consists of connecting ten servers in one afternoon, then noticing the answers degrade. One server, one use case, one measurement, then the next. Our teams train your staff on Claude at that precise pace.
