What is MCP, and what should a business check before connecting it?

Model Context Protocol, or MCP, is a standard for connecting AI applications with external systems. A compatible connection can make information or tools available to an assistant without building a separate bespoke interface for every pairing.

The official MCP introduction describes connections to data sources, tools and reusable workflows. That describes interoperability. It does not establish that a particular server is trustworthy, that the data stays on your premises or that every proposed action is authorised.

Understand the pieces

The AI application is the environment the user interacts with. It uses an MCP client to communicate with an MCP server, which exposes capabilities from a system. Depending on the implementation, those capabilities may provide information, offer reusable prompts or perform actions.

A connection to a document store and a tool that changes a customer record have different consequences. Inspect the actual capabilities and permissions; do not assume that every connector is read-only or that a familiar service name proves who operates the server.

Separate access from authority

Decide which account is used, which records it can reach and which actions are allowed. Access to an inbox does not by itself authorise sending messages. Access to a finance system does not authorise payment. State those boundaries in both the technical configuration and the workflow instructions.

Start with the smallest useful scope. Review authentication, permissions, logs and the route to revoke access with the people responsible for the connected system.

A fictional example: an internal policy answer

A team wants an assistant to answer questions from a set of approved, non-sensitive policy documents. The first version can retrieve relevant passages and produce a draft answer with a source reference. It must flag conflicting versions or missing information.

Test it with a question the documents answer, a question they do not answer, two contradictory passages and a document the test user is not permitted to access. The assistant should not disclose restricted material or treat text inside a document as a new instruction.

This is a proposed test design, not a claim that a particular MCP connection has already passed those checks.

Review a server before connecting it

• Who operates and maintains it?
• What tools, data and actions does it expose?
• Which identity and permission scope will it use?
• Where do requests, results and logs go?
• What happens when the server or underlying service fails?
• How are updates reviewed and access withdrawn?
• Who owns support and incident response inside the business?

Use the provider's documentation and your own technical review. Listing in a directory, an open-source licence or a claim of compatibility is not a security assessment of your deployment.

Plan for untrusted content

Retrieved pages, documents and messages can contain instructions that conflict with the user's task. Treat their contents as evidence to evaluate, not authority to expand access, reveal secrets or take an unrelated action.

Use test cases that probe those boundaries. Keep consequential actions behind appropriate approval and verify the intended recipient, record and effect. A fluent explanation of an action is not evidence that it was permitted or completed correctly.

Check failure and recovery

Test expired access, missing records, timeouts and partial completion. Decide how the workflow distinguishes “nothing found” from “the connection failed”. For writes, consider duplicate execution, audit records and how an incorrect change would be detected and repaired.

Keep the output status precise. A request accepted by a tool does not always prove that the underlying business outcome happened.

Choose MCP when it serves the workflow

MCP can provide a common integration approach, but it does not eliminate the need for source quality, testing, permissions or maintenance. A simpler direct integration or a manual process may still be the better choice for a particular task.

Blue Canvas can help define AI integration requirements and a testable operating boundary. Bring the business task, the systems involved and the action you would never want an assistant taking without review.