What is MCP (Model Context Protocol) in simple words?

MCP is an open standard for plugging AI agents into tools and data. How it works, its security risks, and whether your small business needs it.

By the KutrimBots teamPublished November 9, 202610 min read

MCP (Model Context Protocol) is an open standard, introduced by Anthropic in November 2024, that gives AI applications one common way to connect to tools and data, so a connector built once works in many AI apps. An AI app such as Claude, ChatGPT or VS Code runs an MCP client for each MCP server it connects to, and each server offers tools the AI can call, resources it can read and prompts it can reuse. Most small businesses don't need to set up MCP themselves: it matters if you build AI tools or run coding agents, while business platforms with built-in agents and app connections handle the plumbing for you.

This guide explains MCP without jargon, how it differs from an API and from RAG, the security risks, and where it shows up in KutrimBots.

Why does everyone keep talking about MCP for AI agents?

Because in about a year it went from one company's proposal to a shared standard that most major AI products support, so a tool built once can plug into many AI apps.

Date	What happened
25 November 2024	Anthropic introduces MCP as an open standard, with ready-made servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer
26 March 2025	OpenAI adds MCP support to its Agents SDK, as Simon Willison reported the same day
1 April 2025	Invariant Labs publishes a security warning about "tool poisoning" in MCP
9 December 2025	Anthropic donates MCP to the Agentic AI Foundation, a Linux Foundation fund co-founded with Block and OpenAI and supported by Google, Microsoft, AWS, Cloudflare and Bloomberg
28 July 2026	A new stable revision of the specification, 2026-07-28, makes each request self-contained and adds server discovery

By Anthropic's December 2025 count, there were more than 10,000 active public MCP servers and 97 million monthly downloads of the Python and TypeScript SDKs, and MCP had been adopted by ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code.

How does MCP work?

An AI app (the host) opens one connection, called a client, to each MCP server; the server lists what it offers, and the AI picks what it needs during a conversation.

Part	What it is	Example
Host	The AI app you use	Claude Code, Claude Desktop, VS Code
Client	The connection the host keeps to one server	One per server
Server	A program that offers context and actions	A filesystem server on your laptop, Sentry's server in the cloud
Tools	Actions the AI can run	"Search issues", "create a file", "query the database"
Resources	Data the AI can read	A file's contents, a database schema
Prompts	Reusable templates	A few worked examples for using the tools well

The official architecture guide describes a simple loop. Messages use JSON-RPC 2.0. The host asks a server what tools it has; each tool comes with a name, a description and the inputs it needs; the model decides to call one; the host sends the call; the result comes back as context for the model's next step.

Servers run in two ways. Local servers run on your own machine and talk to one app through standard input and output. Remote servers run on a company's platform and serve many users over HTTP, where the docs recommend OAuth for sign-in. Servers can also ask you for input or a confirmation mid-task, which the spec calls elicitation. As of the 2026-07-28 revision, two older client features, sampling and logging, are deprecated.

What's the difference between an MCP server and an API?

An API is a service's own interface for programs; an MCP server wraps one or more APIs in a standard, self-describing form that any MCP-aware AI app can discover and call.

	API	MCP server
Built for	Programmers writing code against one service	AI apps that pick tools during a conversation
How the AI learns it	Someone writes custom code for each app	The server lists its tools, with descriptions, on request
Integrations needed	One per app per service	One server, usable by any MCP host
Sign-in	API keys or OAuth, service by service	Same underneath; remote servers are encouraged to use OAuth
Example	Sentry's REST API	Sentry's MCP server, which gives AI apps access to Sentry

MCP doesn't replace APIs; most MCP servers sit on top of one.

MCP vs RAG vs AI agents: what's the difference?

They answer different questions: RAG is how an AI looks things up, an agent is an AI that works towards a goal, and MCP is the plug that connects either one to outside systems.

RAG (retrieval-augmented generation) fetches relevant passages from your documents and adds them to the prompt, so answers rest on your data.
An AI agent runs a model in a loop with instructions, tools, memory and approvals until a job is done. Our guide to how AI agents work covers that loop.
MCP standardises how agents and chat apps reach tools and data. An agent might use an MCP server that does retrieval, so the three often appear together.

Is MCP safe?

MCP is a plug, not a guard: how safe it is depends on which servers you connect and what you let them do.

Tool poisoning. On 1 April 2025, Invariant Labs showed that instructions hidden in a tool's description, invisible to the user but read by the model, can steer an AI into reading private files such as SSH keys and leaking them.
Silent changes. A server you approved can change its tool descriptions later. Invariant recommends showing users full descriptions and pinning versions with checksums.
Over-broad permissions. One token that can do everything turns a small mistake into a big one. MCP's security best practices call for starting with minimal scopes and adding more step by step, and forbid passing a client's token straight through to another service.
Instructions inside data. An email or web page the AI reads can contain text that tries to give it orders.
Unvetted servers. Anyone can publish a server; many are hobby projects.

A sensible rule set: install servers only from vendors you trust, give each one the smallest access that works, keep approvals on for anything that sends, pays, posts or deletes, and keep a log. Are AI agents safe? covers approvals in more depth.

Does my small business need MCP?

Usually not directly. If you use AI agents through a business platform, connecting your apps is the platform's job; MCP matters when you build or wire up AI tools yourself.

Your situation	Do you need to deal with MCP?
You want agents for email, leads, bookings and invoices	No. Pick a platform with those built in and app connections you can sign into
Your AI app lets you add servers and you need a niche tool	Maybe. Check whether the tool's vendor publishes an official MCP server
You or your developer use Claude Code, Cursor or Codex	Yes. Adding MCP servers is how those tools reach your systems
You sell software	Maybe. An MCP server lets your customers' AI use your product
You are building your own AI product	Yes. MCP saves writing a custom integration per AI app

How does KutrimBots use MCP?

Mostly behind the scenes, plus one place where you can connect agents you run yourself.

Agent tools. Each KutrimBots agent connects to KutrimBots' own MCP server with its own token. It sees its team tools (who is on the team, hand work to a teammate, ask you for a tool, propose a new hire) plus the tools of the plugins it has been given, so an HR agent sees Team & HR and a sales agent sees CRM & Leads. A website visitor chatting with an agent gets only the visitor tools, never the agent's own. Approval rules live with each tool: an agent can't approve leave or publish a page without you.
App connections. In Apps, 500+ connectors cover 1,500+ apps such as Gmail, Outlook, Slack, Notion, HubSpot and Shopify. You connect each once with the app's own sign-in, and every agent can use it, with no servers to install.
Agent Protocol. This plugin connects AI agents you run elsewhere, such as Claude Code, Codex, OpenCode, DeepSeek, Hermes or OpenClaw, on your computer or a server, to your KutrimBots agent through an end-to-end encrypted inbox. The small client on your machine only dials out over HTTPS, keeps its keys on that machine, and can act as an MCP server for Claude Code, Codex or any MCP client.

To connect a coding agent with Agent Protocol:

Open Agent Protocol in KutrimBots and choose "Add an agent": pick the agent, where it runs (your computer or a server) and which KutrimBots agent it reports to.
Copy the setup prompt. Its access code works once, for 10 minutes.
Paste it into the agent's chat, or run it headless. It installs a small client and a skill, makes its own keys and logs in.
Optionally add the client as an MCP server in Claude Code or Codex, so KutrimBots messages appear in your session and permission prompts reach your phone.
Ask your KutrimBots agent for something, such as "ask the server agent to run the test suite and report back".
Answer permission requests on the card in your chat, in Agent Protocol or on your phone. Requests nobody answers are denied after 10 minutes.

Your KutrimBots agent treats messages from connected agents as information, not instructions, and never answers a permission request itself; that decision is always yours. If you're weighing a self-hosted agent instead, see how KutrimBots compares with OpenClaw and Hermes Agent.

Example scenario

Example scenario: a 6-person web agency in Ahmedabad runs Codex on a ₹1,500-a-month cloud server for maintenance work, and uses KutrimBots agents for sales and admin.

7:40 PM: a client says their site feels slow. The owner, away from her desk, tells her KutrimBots agent: "Ask the server agent to check response times on the client's site and the server's memory."
7:41 PM: the command goes through the encrypted inbox. Codex runs its checks.
7:52 PM: Codex reports that average response time has risen from about 300 ms to 2.1 seconds and memory is at 94%, and asks permission to restart the web service.
7:53 PM: the permission request reaches her phone; she approves it.
8:01 PM: Codex reports response times back near 300 ms. Her agent summarises it in two lines, and she replies to the client.

Meanwhile the agency's sales agent works in Gmail and HubSpot through Apps connectors. Nobody in the office installed or configured an MCP server for that.

What doesn't MCP solve?

MCP standardises the connection; it doesn't make the AI smarter or safer on its own.

It doesn't choose permissions for you. Scopes, approvals and logs are still your platform's job, and yours.
It doesn't vouch for servers. Quality and safety vary widely.
The specification still moves. The 2026-07-28 revision deprecated some features, so older servers and clients may need updates.
Many servers assume a developer will install, configure and update them.
In KutrimBots, Agent Protocol needs a computer or server you control with Node.js 18 or later, and the connected agent can only do what it can already do there.

If you would rather use agents than wire them up, KutrimBots has a free 7-day trial on Solo: add a card or UPI, nothing is charged today, and it then costs $20 a month for up to 5 agents, with Agent Protocol, the built-in plugins and 2,000 app actions a month through the 500+ connectors included (as of November 2026). See plans and limits.

Frequently asked questions

Who created MCP and who runs it now?

Anthropic introduced MCP in November 2024. In December 2025 it donated the protocol to the Agentic AI Foundation under the Linux Foundation, and its maintainers continue to run it in the open.

Is MCP free and open source?

Yes. The specification, the official SDKs and reference servers are open, and anyone can build a client or server without a licence fee. Individual servers may connect to paid services.

Is an MCP server the same as an API?

No. An API is a service's own interface; an MCP server usually wraps an API so any MCP-aware AI app can discover its tools and call them without custom code.

Do I need to know how to code to use MCP?

To build a server, yes. To use one, many AI apps let you add a server from a settings screen, and business platforms such as KutrimBots handle connections through their own app connectors.

Which AI tools support MCP?

As of November 2026, it is supported by ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot and Visual Studio Code, among others, according to Anthropic's December 2025 announcement and the official MCP docs.