What is MCP? When to connect your systems to an AI agent
A practical guide to the Model Context Protocol in 2026: what MCP is, where it stands, its real limits, and when to use it instead of a direct API integration.
TL;DRMCP (Model Context Protocol) is an open standard for connecting AI applications to your data and tools. Use it when the same system must be available to several AI clients or agents, or when you want users to connect your product to the AI tools they already use. For a single, fixed workflow, a direct API integration is usually simpler and cheaper.
Key takeaways
- MCP is an open standard that lets any compatible AI application use your systems through one server, instead of a custom integration per AI tool.
- It is now governed by the Agentic AI Foundation under the Linux Foundation and supported by ChatGPT, Claude, Gemini, Microsoft Copilot, Cursor, and VS Code.
- Its main cost is context: every tool definition takes space in the model's context window, so large tool catalogs make agents slower and more expensive.
- Use MCP when several AI clients need the same system; use a direct API integration for one fixed workflow you fully control.
- An MCP server is a door into your systems. Start read-only, with narrow scopes and tokens issued specifically for that server.
MCP, the Model Context Protocol, is an open standard for connecting AI applications to the systems where your data and work live. This guide explains what MCP is in plain terms, where the standard stands in 2026, its real limits, and how to decide between an MCP server and a direct API integration.
Dream Makers is a senior LatAm engineering team that architects and deploys software systems and AI automation. Integrations are the foundation of our work: data contracts, auth patterns, and error handling across CRMs, payments, workspace tools, and internal platforms (how we work).
What is MCP?
MCP is an open-source standard for connecting AI applications to external systems. The official documentation compares it to a USB-C port: instead of building a custom integration for every AI tool, you expose a system once through an MCP server, and any compatible AI application can discover what it offers and use it.
The three pieces
- Host. The AI application a person uses: ChatGPT, Claude, an IDE such as Cursor or VS Code, or your own agent.
- Client. The connector inside the host that talks to one MCP server.
- Server. A program that exposes a system, such as your CRM, a database, or a document store, in the MCP format.
What a server can offer
A server describes its capabilities so the AI application can decide when to use them. The main building blocks are tools (actions the model can call, like "create invoice" or "search tickets"), resources (data the application can read, like files or records), and prompts (reusable templates for common tasks).
What changes for a business
Without a standard, every AI tool needs its own integration with every system. With MCP, you build one server per system and it works across clients. That matters most when several teams or products need the same system, or when your customers want to connect your product to the AI tools they already use.
Where does MCP stand in 2026?
MCP has become the most widely supported way to connect AI applications to tools and data. Since December 2025 it has been governed by a neutral foundation under the Linux Foundation, the major AI clients support it, and the July 2026 specification made servers easier to run at scale.
Neutral governance
In December 2025, Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, Cloudflare, and Bloomberg. At the time, Anthropic reported more than 10,000 active public MCP servers and over 97 million monthly SDK downloads. For a business, neutral governance lowers the risk of betting on one vendor's protocol.
The 2026-07-28 specification
The latest release removed protocol-level sessions, so servers no longer need to hold state between requests and can scale horizontally like any web service. It also added a discovery call for a server's capabilities, made long-running Tasks an official extension, and strengthened authorization.
The roadmap
The maintainers' August 2026 roadmap focuses on five areas: messaging for long-running agent loops, a single HTTP-based transport, agent identity and enterprise-ready security, improved primitives (including progressive discovery so large tool catalogs do not overload the model), and better SDKs.
Platforms are shipping MCP
Vendors now expose their own data through MCP. Microsoft's Work IQ, in preview since September 2026, shares business skills with agents through a Work IQ MCP server, and Atlassian connects ChatGPT and Codex to Jira and Confluence context through MCP integrations. We cover what this means for your data in why AI agents need business context.
What are MCP's real limits?
MCP's main limits are context cost and authentication. Every tool definition a client loads takes space in the model's context window, so connecting many servers with many tools makes agents slower and more expensive. Authentication across many servers also adds friction. Both are known problems, with mitigations available today.
Context cost
Anthropic described the problem in November 2025: when agents load every tool definition up front and pass every intermediate result through the model, "direct tool calls consume context for each definition and result." In one example, rewriting a workflow so the agent wrote code against MCP tools instead of calling them one by one cut usage from about 150,000 tokens to about 2,000.
The Perplexity debate
In March 2026, Perplexity's CTO said the company had stopped using MCP internally in favor of direct APIs and command-line tools, citing context overhead and authentication friction, according to press coverage of the company's Ask 2026 conference. The criticism is fair for a team that controls both the agent and every system it calls. It carries less weight when you need many different AI clients to reach the same system.
How to keep the cost down
- Expose fewer, better tools. A server with eight well-described tools beats one with eighty thin wrappers around API endpoints.
- Connect only what a task needs. Do not load every server into every agent.
- Return compact results. Filter and summarize on the server instead of sending whole records back to the model.
- Let code do the plumbing. For data-heavy steps, have the agent write code that calls tools, so intermediate data never passes through the model.
Should you use MCP or a direct API integration?
Use MCP when the same system must be available to several AI clients or agents, or when your customers should be able to plug your product into their own AI tools. Use a direct API integration when you have one fixed workflow, you control both ends, and you want the lowest cost and the most predictable behavior.
| MCP server | Direct API integration | |
|---|---|---|
| Best for | One system, many AI clients or agents | One workflow you fully control |
| Who decides which calls happen | The model, from the tools you expose | Your code |
| Reuse | Any MCP-compatible client can connect | Built for one consumer |
| Context cost | Tool definitions and results use context | Only what you choose to send to the model |
| Typical example | Letting sales use ChatGPT and an internal agent with the same CRM | A nightly job that classifies new tickets with one model call |
| Main risk | Over-broad tools or scopes | Brittle point-to-point code as systems multiply |
Most mature systems use both. Deterministic flows call APIs directly, and an MCP server opens the same capabilities to agents and assistants where flexibility is worth it.
How do you secure an MCP server?
Treat an MCP server as a door into your systems. Only accept tokens issued for that server, request the narrowest scopes possible, start with read-only tools, require human approval for destructive actions, and log every call. Local servers run with the user's privileges, so only install ones you trust.
Rules from the MCP security best practices
- No token passthrough. The specification forbids servers from accepting tokens that were not issued for them and forwarding them downstream. It breaks audit trails and lets a stolen token be reused across services.
- Minimize scopes. Start with a small, low-risk scope set and ask for more only when a privileged operation is first attempted. Avoid wildcard scopes such as
admin:*. - Consent for local servers. Clients must show the exact command a local server will run and get explicit approval, and should run it in a sandbox with minimal privileges.
- Verify state handles. Since MCP is stateless, servers that track a cart or workflow pass an ID back and forth. Possession of that ID must never count as authentication.
Our baseline for a first MCP server
- One system, read-only. Expose search and read tools first, measure how they are used, then add writes.
- Writes behind approval. Anything that sends, pays, deletes, or changes permissions waits for a person.
- Per-user identity. The server acts with the permissions of the person or agent calling it, never with a shared admin key.
- Logs and limits. Record every call with the caller's identity, and rate-limit by caller.
The same principles apply to any agent that uses your server; see how to secure AI agents in production.
How we approach MCP
We start from the integration layer, not the protocol. If a system's API, data contracts, and auth are solid, adding an MCP server on top is a small, safe step. If they are not, MCP will expose those problems to every AI client at once. Read more about our agent architecture work and our security baseline.
Want your product or internal systems to work with AI assistants? Tell us which system, who should use it, and from which AI tools, and we will tell you whether you need an MCP server, a direct integration, or both. Contact Dream Makers.
Sources
- Model Context Protocol, "What is the Model Context Protocol (MCP)?": modelcontextprotocol.io
- Anthropic, "Donating the Model Context Protocol and establishing the Agentic AI Foundation" (Dec 9, 2025): anthropic.com
- MCP Blog, "The New MCP Roadmap" (Aug 22, 2026): blog.modelcontextprotocol.io
- Model Context Protocol, "Security Best Practices" (2026-07-28): modelcontextprotocol.io
- Anthropic Engineering, "Code execution with MCP: Building more efficient agents" (Nov 4, 2025): anthropic.com/engineering/code-execution-with-mcp
- Noqta, "Perplexity Drops MCP Internally, Shifts to APIs and CLIs for AI Agents" (2026): noqta.tn
- Microsoft Dynamics 365 Blog, "Work IQ: Business and workplace intelligence in the flow of work" (Sep 25, 2026): microsoft.com
Frequently asked questions
What does MCP stand for?
MCP stands for Model Context Protocol. It is an open-source standard for connecting AI applications, such as ChatGPT, Claude, or an internal agent, to external systems like databases, files, business apps, and workflows.
Is MCP only for Claude?
No. Anthropic created MCP in November 2024 and donated it to the Agentic AI Foundation, a fund under the Linux Foundation, in December 2025. ChatGPT, Gemini, Microsoft Copilot, Cursor, Visual Studio Code, and many other clients support it.
Does MCP replace APIs?
No. An MCP server usually sits on top of your existing APIs and describes them in a way AI applications can discover and use. You still need well-designed APIs, authentication, and data contracts underneath.
Is MCP secure?
MCP defines authorization based on OAuth and publishes security best practices, but security depends on implementation. Servers must only accept tokens issued for them, request the narrowest scopes possible, and avoid exposing destructive actions without human approval. Local servers run with the user's privileges, so only install ones you trust.
Why did some companies move away from MCP?
In March 2026, Perplexity's CTO said the company had moved away from MCP internally toward direct APIs and command-line tools, citing context-window overhead and authentication friction. Both problems are on MCP's 2026 roadmap, and for many teams the trade-off still favors MCP when several AI clients need the same system.