Model Context Protocol (MCP)

Rather than building a custom integration for every tool, an AI client can call any MCP server that exposes the needed capability. The standard has been adopted across the major AI vendors.

The analogy that holds is a device driver model. Before MCP, connecting an assistant to your ticketing system, your data warehouse, and your file store meant three bespoke integrations, each with its own auth handling and its own maintenance burden. With MCP, each of those exposes a server that speaks a common protocol, and any compliant client can use it. That is what made agentic tooling spread quickly through 2025: the integration cost dropped sharply.

For security teams the significant change is that MCP is how agents reach the real world. An MCP server is a set of capabilities exposed to a model, so it defines the blast radius. The questions worth asking are the ones you would ask of any service account: what can this server do, what credentials does it hold, whose identity does it act under, and is it read-only. A server offering read access to a wiki is a very different risk from one that can execute database writes or send mail, and the protocol itself does not distinguish them for you.

Two failure modes are worth naming. First, tool descriptions are text the model reads, so a malicious or compromised server can attempt prompt injection through the description itself. Second, the convenience of installing a community server invites the same supply chain problem as any dependency, with less scrutiny than most teams apply to a package manager.