What Is MCP (Model Context Protocol)? A Business Guide

MCP is the reason "AI that knows our own data" stopped being a custom development project. It's an open standard for plugging AI assistants into the systems you already run (your files, your CRM, your ticketing system) without building a one-off integration for each one.

If a vendor has pitched you an AI agent in the last year, MCP is probably underneath it. Here's what it is, what it changes, and the part most pitches leave out.

The short version

• MCP is a standard, not a product. Anthropic published it in November 2024 and other vendors adopted it.
• It's already shipping. Microsoft made MCP generally available in Copilot Studio in May 2025.
• The business case is cost. Connecting AI to your systems moves from custom development to configuration.
• The risk is real. OWASP published an MCP Top 10 in 2025; shadow servers and tool poisoning lead the list.
• Fix permissions before you connect anything. An assistant inherits whatever access you give it.

What is the Model Context Protocol?

MCP is an open standard that lets AI assistants read from and act on outside systems through one common interface. Anthropic published it in November 2024. The announcement describes it as "an open standard for connecting AI assistants to the systems where data lives, including content repositories, business tools, and development environments."

Think of it as a universal adapter between an AI model and your business software.

The problem it solves is spelled out in the original announcement: "even the most sophisticated models are constrained by their isolation from data, trapped behind information silos and legacy systems. Every new data source requires its own custom implementation."

That last sentence is the whole business case. Before MCP, connecting an AI tool to your practice management system meant paying a developer to build and then maintain a bespoke integration. Now the connection is a standard one, and increasingly somebody has already built it.

Why does this matter for a small business?

Because it changes the price of "AI that actually knows our stuff" from a development project to a configuration job.

Generic AI is easy to buy and hard to value. A chatbot that can write an email is useful to everyone and decisive for nobody. What owners actually want is an assistant that can answer "what did we quote this client last spring," and that requires the assistant to reach into your systems.

MCP is how it reaches. That's the difference between a tool your staff try for two weeks and one they keep using.

Is this shipping, or is it still a preview?

Shipping, and inside the Microsoft stack most SMBs already pay for. MCP went generally available in Microsoft Copilot Studio on May 29, 2025, per Microsoft's own announcement. Microsoft's documentation now covers connecting an agent to an MCP server as a standard task.

That matters more than any vendor's roadmap. When a standard lands in Copilot Studio as a GA feature, it's no longer a bet. It's the plumbing.

Anthropic's original release also shipped reference connectors for systems small businesses actually use, including Google Drive, Slack, GitHub, and Postgres. Early adopters named in the announcement included Block and Apollo.

What can you actually do with it?

Concrete examples, not hypotheticals:

• Answer questions across systems. "Pull this client's open invoices and their last three support tickets." Two systems, one question, no export to spreadsheet.
• Draft with real context. A proposal that references the actual scope and pricing from the last engagement, because the assistant can read the last engagement.
• Trigger work, not just describe it. Create the ticket, update the CRM record, file the document in the right library, rather than telling a person to go do it.
• Search what search can't reach. Line-of-business applications with terrible built-in search become answerable in plain language.

The pattern that pays off is narrow and repetitive. One workflow, done fifty times a week, by people whose time is expensive. That's where we see automation earn its cost, and it's the same finding we described in AI automation for professional services firms.

What's the catch?

You're handing an AI model credentials and permission to act. That's a real security change, and the security community has already catalogued how it goes wrong.

OWASP published an MCP Top 10 in 2025, a risk list in the same format as its well-known web application list. Three entries deserve an owner's attention:

• MCP09: Shadow MCP Servers. Staff connect an AI assistant to company systems without telling anyone. Same shape as the shadow IT problem you already have, with broader reach.
• MCP03: Tool Poisoning. A malicious or compromised connector feeds the model instructions it treats as legitimate, and the model acts on them.
• MCP01: Token Mismanagement and Secret Exposure. The credentials that let the AI reach your systems get stored badly, and now they're an easier target than the systems themselves.

Note that OWASP labels the list a beta, with a further release planned. That tells you the risk set is still being mapped. It's an argument for governing this deliberately, not for waiting until the list is finished.

The failure mode we expect to see most in SMBs is the first one. An employee wires a personal AI tool into the company file store because it makes their week easier, and nobody finds out until something leaks.

If you haven't set a rule yet, our AI usage policy guide and our post on preventing shadow AI data leaks are the place to start.

What should you do about it right now?

Four things, in order.

Decide who's allowed to connect what. Before anyone builds anything. A one-page rule stating which AI tools are approved and who authorizes a new connection prevents the shadow-server problem outright.

Fix permissions first. An AI assistant inherits the access you give it. If your file permissions are loose, MCP doesn't create that problem, it just makes it visible fast. Same lesson as SharePoint oversharing and Copilot.

Start with read-only. Let the assistant look before it touches. Most of the value in the first ninety days is retrieval, and read-only access has a fraction of the blast radius.

Pick one workflow. Not a platform, a workflow. Measure the hours it takes back. Then decide whether to widen it.

Do you need to build anything?

Often, no. If your systems are mainstream, a connector may already exist, and the work is configuration and governance rather than development. That's the cheap version, and it's worth checking before anyone quotes you a build.

Custom work earns its keep when the system holding your important data is niche or homegrown: the industry-specific application your whole operation runs on, with no published connector. That's when we build one, and it's the same work as our Microsoft Graph connector and custom AI application projects.

If you're weighing a Copilot-based agent against something purpose-built, we compared the two in Copilot agents vs custom AI agents.

Frequently asked questions

Is MCP a Microsoft product or an Anthropic product?

Neither, and that's the point. Anthropic published it as an open standard in November 2024, and other vendors adopted it, including Microsoft, which shipped MCP support in Copilot Studio as a generally available feature. An open standard means you're less likely to be locked into one AI vendor's connectors.

Do we need MCP if we already have Microsoft 365 Copilot?

Not for what Copilot already does. Copilot reads your Microsoft 365 content out of the box. MCP matters when you want an assistant to reach systems outside that tenant: your CRM, your practice management software, your ERP. If everything important already lives in Microsoft 365, you have less to gain here.

Does connecting AI to our systems mean our data trains someone's model?

That depends entirely on the AI service you connect, not on MCP. MCP is a transport standard; it says nothing about training. Read the terms of the specific assistant and tier you're using, and confirm it in writing before connecting anything client-related. Business and enterprise tiers of major providers generally exclude customer data from training, but verify rather than assume.

How do we know if employees are already doing this?

You probably don't, which is the problem. Consumer AI tools with connector support are a browser sign-in away, and nothing in a default small-business setup blocks or logs it. Conditional access policies, application controls, and reviewing which third-party applications have been granted access to your tenant are how you get visibility.

Is this worth our attention at 20 people, or is it an enterprise thing?

Worth your attention, because the setup cost is low and small teams feel the time savings faster. A 20-person firm where three people spend an hour a day hunting for information in four systems has a clearer case than a large company with a data warehouse. The governance still has to happen first.

Where this goes

Agents that read and act across your systems are becoming the normal way business software works, and the standard underneath them is now settled enough to build on. The businesses that get value from it will be the ones that fixed their permissions and set their rules before they turned it on.

We help businesses across NY, NJ, CT, PA, and Southwest Florida figure out where AI belongs in their operation, and where it doesn't. If you want a straight answer about your systems, book a complimentary consultation and we'll look at what you're running and what's actually worth connecting.