Skip to content
Adrythm
Book 20 minutes
AI and automation

Model Context Protocol (MCP)

MCP / MCP server / MCP connector

In short

The Model Context Protocol, or MCP, is an open-source standard for connecting AI applications such as Claude or ChatGPT to outside tools and data. Each connection can let an AI tool read data or act in another system. Its specification says MCP cannot enforce its security principles at the protocol level, leaving that to the applications built on it.

MCP is an open-source standard for connecting AI applications to external systems. Its documentation compares it to a USB-C port: a service builds one MCP server, and AI applications that support MCP can connect to it. That documentation names AI assistants such as Claude and ChatGPT, and development tools such as Visual Studio Code, among those that support it.

The specification describes three roles. Hosts are the AI applications, clients are connectors within a host, and servers provide context and capabilities. A server can offer resources, which are data, prompts, which are templated messages, and tools, which are functions the AI model can execute. Anthropic introduced MCP. In December 2025 it donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI.

The MCP specification lists as key principles that hosts must obtain explicit user consent before exposing user data to servers and before invoking any tool. The same page says MCP itself cannot enforce these principles at the protocol level. Its implementation guidelines, such as building consent flows and access controls, are written as SHOULD for implementors.

The MCP tool in OpenAI's Responses API asks for approval before each tool call by default, and lets developers skip approvals once they trust a server. OpenAI warns that servers may change how their tools behave unexpectedly.

OpenAI says data sent to an MCP server is subject to that server's retention and residency policies. Anthropic says the MCP connector in its Claude API, a beta feature, is not covered by zero data retention (ZDR) arrangements. Anthropic keeps data exchanged through it, including tool definitions and results, under its standard retention policy.

A local server is a program downloaded and run on the same computer as the client. Where a client offers one-click setup for a local server, the MCP security guide says it MUST show the exact command and require explicit user approval first. The guide also recommends warning users that such servers run with the client's privileges.

In practice

A roofing company connects its AI assistant to its calendar and its customer records through MCP servers. The company uses OpenAI's API under a zero data retention agreement. The calendar server is the official one from the calendar provider. The records server comes from an outside developer. Data sent to either server falls under that operator's own retention and residency policies, whatever the agreement with OpenAI says. Either operator can also change how its tools behave. Before switching the servers on, the company reads both policies, takes extra care over the outside developer, and allows only the read tools the assistant needs.

Not the same as

API
An API is one service's own interface for other software. MCP is a shared standard for AI applications, and an MCP server can connect an AI tool to a service's API.

Why it matters to you

Each MCP connection can give an AI tool access to data, or the ability to act, in another system. OpenAI treats every MCP server as a third-party service with its own terms, so each one is another place the data can go. OpenAI tells its API customers that making sure a server meets their retention and residency requirements is their responsibility.

What to ask or check

  1. 01Which MCP servers is your AI tool connected to, and who runs each one?
  2. 02Does the business use the official server published by each service, or one from an outside developer?
  3. 03If the business has a zero data retention or data residency agreement with its AI provider, does each MCP server meet those terms too?
  4. 04When someone adds a local MCP server in one click, does your AI tool show the exact command and ask for approval first?

What people get wrong

That connecting through MCP comes with security built in. The MCP specification says the protocol itself cannot enforce its security principles, which leaves consent, tool limits and approvals to the people who build and set up each connection.

Red flags

  • An MCP server from an outside developer standing in for a service that publishes an official server of its own.
  • A business with data retention or residency commitments sending customer data through an MCP server whose own policies nobody has checked.

Keep reading

AI agent

An AI agent is a model that has been granted the ability to take actions, not just produce text. OWASP says the damage one can do comes from three grants: excessive functionality, excessive permissions and excessive autonomy. What it is allowed to do matters more than how good it is.

Prompt injection

Prompt injection is when text an AI system reads becomes an instruction it follows. OWASP notes the text does not have to be visible to a person, only parsed by the model, and that no fool-proof prevention is known. The UK's national cyber security body says the same.

API

An API is the way one piece of software talks to another without a person in the middle. MDN describes it as a contract between the application offering it and whatever uses it. The part that matters commercially is that the contract belongs to whoever publishes it, and it changes.

Privacy-enhanced AI

Privacy-enhanced AI means an AI system built so your data is not exposed or quietly reused. NIST lists it as one of seven characteristics of trustworthy AI, and states the honest catch: privacy techniques can cost accuracy. The FTC has required firms to delete models built on unlawfully obtained data.

Training data

Training data is what a model learned from. The question owners ask is whether their own data joins it, and there is no single answer: OWASP names three separate stages, pre-training, fine-tuning and embedding. A commitment worth having names the stage and comes in writing.

Retrieval augmented generation

Retrieval augmented generation is how an AI answers from your documents without being trained on them. OWASP describes it as combining a pre-trained model with external knowledge sources at answer time. So the documents sit in a store the system reads from, and who can read that store is the question.

Want this explained against your own numbers?

Twenty minutes, a straight answer, and no follow-up sequence if you decide not to work with us.

Book 20 minutes