Model Context Protocol: wire an agent to your tools without chaos

MCP: a tool standard, not magic

The Model Context Protocol (MCP) is an open standard introduced by Anthropic in November 2024 to wire AI applications to data sources and tools in a homogeneous way. The common analogy makes it a USB-C port for AI apps.

The typical architecture rests on three roles: a host (the agent or the app) creates MCP clients, and each client talks to a server that exposes tools and resources. Client and server most often communicate over JSON-RPC. The model discovers the tools through natural-language descriptions and call schemas.

MCP does not replace your business API. It makes it consumable by several clients (Claude, other assistants, agentic IDEs) with a common contract. Without a stable API, MCP only formalizes the chaos.

The ecosystem includes prebuilt servers (Drive, Slack, GitHub, Postgres, browsers) and SDKs. Multi-client adoption is the real argument for build once.

What you expose (and hide)

Each tool carries a name, a model-facing description and a parameter schema. Start with few tools, three to seven well tested, and favor reads before writes.

In an SME, the tools that help right away are called search_docs, get_ticket, draft_reply or create_task. The ones that turn dangerous without guardrails are called delete_*, send_email_unattended, update_price or export_all_customers.

Tool schemas consume tokens before any user request. If you wire several MCP servers, audit that entry cost (see context engineering).

Security and governance

Treat an MCP server like a privileged microservice: it needs client authentication, per-tool authorization, rate limiting, structured logs and separate environments.

The classic threats are well known:

• A prompt injection that hijacks a tool
• Exfiltration through an overly broad read
• Unexpected tool chaining
• Confusion between tenants

So are the countermeasures:

• An allowlist and schema validation
• A sandbox and HITL on writes
• PII filtering on the output
• Adversarial prompt tests

Secrets never go into the prompt: use a vault or environment variables. And every server has an owner, who decides who adds a tool and who reviews it.

Computer use and browsers

When there is no clean API, computer use and browser control expand the integration surface. The approach is powerful, but fragile and security-sensitive. Reserve it for legacy screens and isolated POCs, with a VM, least privilege and session recording.

For critical paths, prefer the API and MCP duo, with the same discipline as a headless CI agent.

SME roadmap

The roadmap fits in five steps:

1. Pick one single use case
2. Stand up a read-only MCP server
3. Add one write, with HITL
4. Track token and error metrics
5. Expand

On the Claude Code side, a build or ticket MCP changes the work loop, but each active server inflates the session context (see the Claude Code article).

If you want a clean allowlist and audit trail, we can scope it in 20-40 minutes.