What is MCP? The protocol that lets AI read and operate your business systems

The biggest limitation of AI assistants was never their intelligence, but their isolation. ChatGPT or Claude could reason brilliantly about your question, but couldn’t look into your analytics, update your CRM or search your emails. MCP changes exactly that, and it’s the reason AI does real work at our agency every day instead of just chatting. I run several MCP servers for ClickForest myself, so I’m not explaining this from a brochure but from practice. In this article: what MCP is, why the entire AI industry standardised on it in record time, what you can concretely do with it as an SME, and what to watch out for before you connect AI to your systems.

What is MCP (Model Context Protocol)?

MCP, in full Model Context Protocol, is an open standard that securely connects AI assistants to your own data, tools and systems. Anthropic, the company behind Claude, introduced the protocol on 25 November 2024 and described it as a standard for “secure, two-way connections between data sources and AI-powered tools”. The official MCP documentation uses the most striking metaphor itself: MCP is like a USB-C port for AI applications.

The comparison is spot on. In the past, every connection between an AI and a system required its own custom-built integration, just like every device used to have its own charger. MCP replaces all those custom plugs with one universal connection: build one MCP server for your system, and every AI assistant that speaks MCP can work with it. And importantly: that plug works both ways. Through MCP the AI can not only read data but also take actions, such as creating a task, drafting an email or updating a record in your CRM. From day one, companies like Block, Replit and Sourcegraph joined in (Anthropic). The CTO of payments company Block summed up its importance: “Open technologies like the Model Context Protocol are the bridges that connect AI to real-world applications, ensuring innovation is accessible, transparent, and rooted in collaboration.” It’s also the foundation on which ClickForest builds AI integrations for Flemish SMEs in Mechelen and Antwerp, but more on that below.

Why did MCP become the standard in record time?

Because even Anthropic’s biggest competitors embraced it. That’s exceptional in tech: normally everyone fights for their own standard, but with MCP the whole industry chose the same plug within a year. OpenAI chief Sam Altman announced in March 2025 that “people love MCP” and that OpenAI is rolling it out across all its products (TechCrunch). Google followed two weeks later:

“MCP is a good protocol and it’s rapidly becoming an open standard for the AI agentic era.”

— Demis Hassabis, CEO of Google DeepMind (TechCrunch)

The milestones at a glance:

Since December 2025, MCP is no longer Anthropic property: the protocol was placed with the Agentic AI Foundation under the Linux Foundation, co-founded by Anthropic, Block and OpenAI and supported by Google, Microsoft and AWS among others (Linux Foundation).

“Donating MCP to the Linux Foundation as part of the AAIF ensures it stays open, neutral, and community-driven as it becomes critical infrastructure for AI.”

— Mike Krieger, Chief Product Officer at Anthropic (Linux Foundation)

For you as a business owner this means: MCP is not a bet on a trendy tool that disappears next year, but neutral infrastructure the whole industry builds on.

How does MCP work in practice?

Surprisingly simply, at least conceptually. There are three roles: the AI assistant (Claude or ChatGPT, for example), an MCP server per system you want to unlock, and the protocol that makes them speak the same language. The MCP server is the power strip: a small program that sits next to your system and tells the AI which actions are possible.

A concrete example from our own operation: our Google Analytics MCP server tells Claude “you can request reports here”. When I ask “how many visitors came from ChatGPT last month?”, Claude calls that server, fetches the real numbers and answers with data instead of a guess. The AI no longer makes things up about your business; it simply looks them up. The same principle works for your CRM, mailbox, webshop, accounting or calendar. And because it’s a standard, you only build that integration once: every MCP-compatible assistant can use it afterwards. To understand the difference with Claude Skills, reusable instruction packs rather than data connections, read the explainer on Claude Skills.

What can you concretely do with MCP as an SME?

Everything where “if only my assistant could see my data” is the sigh. The leap is from an AI that gives general advice to an AI that knows your numbers, customers and inventory. A few applications that simply work today:

• Reporting without export hassle: the AI reads your GA4 and Search Console data itself and answers “which pages dropped last month?” with real numbers.
• CRM work in plain language: “create a task to follow up on Client X and summarise the latest emails” becomes one sentence instead of five screens.
• Webshop insights: query inventory, orders and returns through your AI assistant, and even become sellable to your customers’ AI agents, because Shopify too is going all-in on these endpoints.
• Unlocking internal knowledge: making documents, quotes and procedures searchable for a chatbot or an internal helper that gives your actual answers.

If you want to go beyond individual questions, MCP is also the foundation under AI agents that carry out tasks independently: an agent without access to your systems can do nothing, an agent with MCP integrations becomes a digital colleague. How such agents can strengthen your marketing I described earlier.

What does ClickForest itself do with MCP?

We partly run our agency on it. ClickForest runs several MCP servers: a self-built one for image generation, plus Google’s official connector for Google Analytics, the existing open-source server for Search Console, and connectors for CRM and mail among others. We built that image-generation server ourselves with Claude Code; why we do that with AI as an accelerator but with review and craftsmanship, you can read in vibe coding and Claude Code.

The effect on daily operations is hard to overstate. SEO reports that used to be copy-paste work from five dashboards are now one question to the assistant. Competitor analyses, blog research with real search data, generating on-brand images: it all runs through the same universal plug. That exact experience is what we apply when ClickForest builds custom software and AI integrations for Flemish SMEs in Mechelen and Antwerp: we don’t sell theory, we build what we use ourselves every day. Which assistant fits best, Claude, ChatGPT or Perplexity, depends on your use; I made that comparison earlier in the practical guide.

Is MCP safe? The honest caveats

MCP is a door to your data, and a door needs a lock. The risks are real, well documented and manageable: use trusted servers, give each integration minimal permissions and have sensitive integrations set up thoughtfully. Do that, and you capture the gains without leaving a back door open.

Researchers at Invariant Labs demonstrated so-called tool poisoning in April 2025: a malicious MCP server can smuggle hidden instructions into its tool descriptions that the AI reads but you never see (Invariant Labs). Those were controlled demonstrations, not data breaches at companies, but the lesson is clear: only install MCP servers from trusted sources. Microsoft, which built MCP into Windows, itself warns that a successful attack in an agentic environment can escalate to code execution on your system (Microsoft).

The sharpest rule of thumb comes from developer and AI researcher Simon Willison:

“The problem with Model Context Protocol—MCP—is that it encourages users to mix and match tools from different sources that can do different things.”

— Simon Willison, independent AI researcher (simonwillison.net)

Willison calls the dangerous combination the “lethal trifecta”: access to private data, exposure to untrusted content and the ability to communicate externally. Combine those three carelessly, and an attacker can trick your AI into leaking data. Trusted servers protect against tool poisoning, but the trifecta applies even to servers you fully trust: the real remedy is breaking the combination itself. The practical translation for an SME: give every integration as few permissions as possible, avoid an uncontrolled outbound route, use official or self-built servers instead of random downloads, and have sensitive integrations set up by someone who knows these risks. Set up securely, MCP is a huge asset; set up carelessly, it’s an open back door.

How do you start with it as an SME?

Small, with existing building blocks, and with your most valuable data last. You don’t need to have anything built right away: Claude now offers 75+ ready-made connectors based on MCP (December 2025 figure), and Claude Desktop can run local MCP servers too. Connect something low-stakes first, like your calendar or analytics, and experience what it does for your work.

The real leap comes with your own systems: the planning tool, order system or customer database that has no ready-made connector. That’s where you build a custom MCP server, and that’s exactly what ClickForest does within building custom software with AI for Flemish SMEs in Mechelen and Antwerp: first determine which integration actually pays off, then build securely with least-privilege access, and expand from there. The broader approach to AI in your business, from automation to training, is on the AI for growth hub.

Conclusion: MCP is the quiet infrastructure under useful AI

This is what to remember:

1. MCP is the USB-C for AI. One open standard to connect AI assistants to your data and tools, instead of custom work per integration.
2. The whole industry backs it. Anthropic invented it, OpenAI, Google and Microsoft embraced it, and since late 2025 the Linux Foundation governs it as neutral infrastructure.
3. This is where AI becomes useful. Not the chatbot that talks nicely, but the assistant that reads your real numbers and operates your real systems.
4. Security is not an afterthought. Trusted servers, minimal permissions and a thoughtful setup make the difference between a digital colleague and an open back door.

My honest assessment after working with it daily: MCP is the most important AI development for SMEs that almost nobody knows by name. Your customers will never ask “do you use MCP?”, but they do notice the difference between a business where AI actually pitches in and one where it stays at talk. ClickForest builds those integrations for Flemish SMEs in Mechelen, Antwerp and across Flanders, from the first connector to a custom MCP server. Curious what an AI integration could mean for your business? Book a video call or get in touch, and we’ll look at which data your AI should see first.