Model Context Protocol: wire an agent to your tools without chaos
MCP (open standard, Anthropic late 2024): host, client, server, JSON-RPC tools. Schema token cost, security. Computer use as a section. SME guide.
MCP: a tool standard, not magic
Model Context Protocol (MCP) is an open standard introduced by Anthropic in November 2024 to wire AI apps to data sources and tools homogeneously. Common analogy: a USB-C port for AI apps.
Typical architecture: a host (agent / app) creates MCP clients; each client talks to a server that exposes tools and resources. Client and server often use JSON-RPC. The model discovers tools via natural-language descriptions and call schemas.
MCP does not replace your business API. It makes it consumable by several clients (Claude, other assistants, agentic IDEs) with a common contract. Without a stable API, MCP formalizes chaos.
Ecosystem: prebuilt servers (Drive, Slack, GitHub, Postgres, browsers, etc.) and SDKs. Multi-client adoption is the real build-once argument.
What you expose (and hide)
Each tool has a name, a model-facing description, a parameter schema. Fewer tools at first: 3 to 7 well tested. Read before write.
Useful in SMEs: search_docs, get_ticket, draft_reply, create_task. Dangerous without guardrails: delete_*, send_email_unattended, update_price, export_all_customers.
Tool schemas consume tokens before any user request. If you wire several MCP servers, audit that entry cost (see context engineering).
Security and governance
Treat an MCP server like a privileged microservice: client auth, per-tool authorization, rate limiting, structured logs, separate environments.
Threats: prompt injection hijacking a tool, exfiltration via an overly broad read, unexpected tool chaining, multi-tenant confusion.
Mitigations: allowlist, schema validation, sandbox, HITL on writes, PII filtering on output, adversarial prompt tests.
Secrets never in the prompt. Vault or env vars. Owner per server (who adds a tool, who reviews).
Computer use and browsers
When there is no clean API, computer use / browser control expands integration. Powerful, fragile, security-sensitive. Reserve for legacy UIs and isolated POCs (VM, least privilege, session recording).
For critical paths prefer API + MCP. Same discipline as a headless CI agent.
SME roadmap
1) One use case. 2) Read-only MCP server. 3) One write + HITL. 4) Token and error metrics. 5) Expand.
On Claude Code: a build or ticket MCP changes the loop, but each active server inflates session context (see Claude Code article).
If you want a clean allowlist and audit trail, we can scope in 20-40 minutes.
FAQ
- Is MCP mandatory?
- No. A well-designed REST API often suffices. MCP pays off when several AI clients share the same tools.
- Who created MCP?
- Anthropic open-sourced the protocol in November 2024. Spec, SDKs and example servers are public; the multi-client ecosystem is growing.
- Self-host an MCP server?
- Yes, and recommended for internal data. Isolate the network, monitor like a prod service.
- MCP and personal data?
- Every read tool can expose PII to an LLM. Minimization, masking, legal bases. Not the whole Drive by default.
- How many tools at the start?
- 3 to 7. Beyond that, non-regression and schema cost explode before the use case is proven.
- Link to multi-agent?
- MCP tools one or many agents. Multi-agent architecture (router, specialists) is another article.
Scope your first AI agent
20 minutes to review your tools, data and the first useful case. No jargon, no commitment.