Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.
What Is Model Context Protocol (MCP)?
Model Context Protocol (MCP) is an open standard that lets AI applications interact with external tools, data sources, and workflows through a consistent interface. It separates the AI client from the systems it needs to use, making integrations more reusable across compatible models and applications.
How MCP works#
MCP uses a client-server architecture. An AI application, such as a desktop assistant, coding agent, or enterprise chatbot, acts as an MCP client. The client connects to one or more MCP servers, which expose capabilities to the AI application.
An MCP server can provide three common types of capabilities:
- Tools: Actions the model can request, such as querying a database, opening a ticket, calling an API, or writing a file.
- Resources: Data the application can retrieve, such as documents, repository files, database records, or system metadata.
- Prompts: Reusable prompt templates or workflows that help structure interactions with a particular system.
The model does not usually connect directly to every underlying service. Instead, the MCP client manages the conversation with the server, discovers available capabilities, and passes relevant requests and results to the model.
A typical flow looks like this:
- The user asks an AI application to perform a task.
- The application determines whether an MCP capability is relevant.
- The client sends a structured request to an MCP server.
- The server validates the request and interacts with the underlying system.
- The server returns data or an action result.
- The AI application presents the result or asks for confirmation before taking a consequential action.
MCP standardizes the interaction pattern, but it does not automatically make an integration safe. Authorization, input validation, output handling, secret management, network controls, and audit logging remain the responsibility of the implementation and deployment environment.
Technical notes: Conceptual tool request
An MCP tool call is conceptually similar to a structured API request:
{
"name": "search_tickets",
"arguments": {
"query": "failed production deployments",
"limit": 10
}
}
The actual protocol messages, transport, authentication, and capability negotiation depend on the MCP implementation and client-server configuration. Administrators should avoid assuming that a tool exposed through MCP has read-only behavior. Review what the underlying function can do, including indirect effects such as triggering automation or changing records.
Where you’ll encounter MCP#
You’ll encounter MCP when an AI product needs controlled access to systems outside its model context. Common examples include:
Coding and developer tools
An AI coding assistant may use MCP to inspect local repositories, search documentation, query issue trackers, interact with source control, or work with development databases. Depending on configuration, these capabilities may include file modification, command execution, or deployment-related actions.
Enterprise assistants
Organizations may connect AI assistants to knowledge bases, document stores, ticketing platforms, collaboration systems, and internal APIs. MCP can provide a common integration approach instead of building a separate connector for every AI application.
Security and IT operations
MCP servers can expose alert search, asset inventory, case management, vulnerability data, or approved remediation workflows. This can help analysts investigate incidents using natural-language interfaces, but high-impact actions should require explicit approval and strong authorization.
Teams can also use tabletop exercises to test how they would respond to a compromised MCP server or unsafe tool call. See this guide to running a tabletop exercise for a practical planning framework.
Local automation
Developers and power users may run MCP servers on workstations to expose local files, scripts, browsers, databases, or command-line tools to an AI client. Local deployment does not eliminate risk. A compromised client, malicious prompt, unsafe tool, or overly broad filesystem permission can create a path to sensitive data or unauthorized actions.
If an MCP server runs on employee endpoints, endpoint protection such as Malwarebytes can complement application-level controls, although it does not replace authentication, authorization, or server-side validation.
SaaS and platform integrations
Software vendors may use MCP to make their platforms available to compatible AI clients. The important operational question is not simply whether a product supports MCP, but which tools it exposes, what identity they use, and what actions they can perform.
Security considerations for practitioners#
Treat every MCP server as an integration with a defined trust boundary. Before enabling one, document:
- The client applications allowed to connect
- The server’s identity and ownership
- Tools, resources, and prompts it exposes
- Credentials and permissions used against downstream systems
- Whether actions are read-only, write-capable, or destructive
- Data that may be returned to the model or user
- Logging, approval, and revocation procedures
Use least-privilege service accounts and separate read and write capabilities where possible. Do not place long-lived production secrets in configuration files that are accessible to local users or AI tools. Validate arguments on the server side rather than trusting the model or client to provide safe values.
Treat prompts and retrieved content as untrusted input. Prompt injection can influence how an AI system selects or uses tools, particularly when an MCP server exposes write operations or access to sensitive data. Security teams can apply testing concepts from interactive application security testing when evaluating application behavior around tool calls and external data.
Monitor for unusual tool activity, including unexpected access to sensitive repositories, high-volume data retrieval, repeated failed authorization attempts, and write operations outside normal workflows. Keep an inventory of MCP servers because unmanaged local servers can become invisible routes into corporate systems.
Technical notes: Basic review checklist
[ ] Identify every MCP client and server
[ ] Record exposed tools and their allowed arguments
[ ] Confirm authentication and authorization behavior
[ ] Restrict filesystem, network, and API permissions
[ ] Require approval for destructive actions
[ ] Prevent secrets from entering prompts and model context
[ ] Log tool calls, results, errors, and identities
[ ] Test shutdown, credential rotation, and access revocation
For teams standardizing password hygiene and vaulting shared credentials, 1Password (Try 1Password →) provides centralized access policies and audit visibility.
Related terms
The model that interprets user requests and generates text or tool-call decisions.
An AI application that can plan tasks, use tools, and take actions across multiple steps.
A model capability that produces structured requests for an application to execute.
A programmatic interface that allows software to request data or actions from another system.
The AI application or component that connects to MCP servers.
A service or process that exposes tools, resources, or prompts to an MCP client.
A design that retrieves external information and supplies it to a model before response generation.
A security principle requiring identities and applications to receive only the access they need.
Malicious or unintended instructions that influence an AI system through user input or retrieved content.
A protocol for communication between AI agents, whereas MCP primarily connects an AI application to external capabilities and data.