What is MCP (Model Context Protocol) and how does it connect AI with business systems?

What is MCP (Model Context Protocol) and how it connects AI to business systems

MCP (Model Context Protocol) is an open standard for connecting AI applications to external systems, data, and tools. Through MCP, an AI assistant can, in a controlled way, read information from a CRM, look up a document, query a database, or perform a permitted action in a business system. MCP is not an AI model and does not replace an API - it standardizes the way AI discovers and uses the available capabilities.

At Sirius Software we view MCP as an integration layer between the AI assistant and the company's existing software infrastructure. Its real value isn't simply "letting AI see the data," but giving it precisely the defined access, context, and actions needed for a specific workflow.

What does MCP stand for?

MCP is short for Model Context Protocol. It's a standard through which an AI application can discover what data and functions a given external system offers and use them in a structured way.

Anthropic introduced MCP on November 25, 2024, as an open standard for connecting AI assistants to the systems where company data lives - content repositories, business applications, and development environments. The idea is to replace individual custom integrations with a common protocol that different AI applications can understand.

The official documentation uses the USB-C analogy: just as a standard port lets you connect different devices, MCP provides a common way for AI applications to connect to external systems.

What is an MCP server?

An MCP server is a software component that provides an AI application with specific data, instructions, and actions via the Model Context Protocol. It can run locally on the same computer or remotely as a secure internet service.

It's important to distinguish the protocol from the server:

• MCP is the communication standard.
• The MCP server is the specific implementation that connects one or more systems to an AI application.
• The MCP client maintains the connection to the server and passes the available context to the AI application.
• The MCP host is the application in which the AI assistant runs - for example ChatGPT, Claude, or a development environment with MCP support.

An MCP server for a CRM, for example, could let the AI assistant find a customer, read the communication history, and prepare a summary. If the business explicitly allows it, a separate tool could create a task or update a status. Read access and change actions should be separated through distinct permissions.

How does MCP work in practice?

MCP works through a client-server architecture, in which the AI application discovers the capabilities offered by the MCP server and uses only those permitted for the specific user. The protocol standardizes the description of tools, input parameters, and results, but does not determine how the AI model itself should reason.

A typical process looks like this:

1. The user asks a question or assigns a task to the AI assistant.
2. The AI application determines which connected MCP servers can provide the required data or actions.
3. The MCP client receives a list of the permitted tools and resources.
4. The AI model chooses an appropriate tool and prepares the required parameters.
5. The MCP server checks access and executes the request against the internal system or its API.
6. The result is returned in structured form to the AI application.
7. The AI assistant uses the received context to answer or to propose the next action.

Per the architecture current as of August 26, 2026, MCP uses JSON-RPC 2.0 to exchange messages. stdio can be used for local processes, while Streamable HTTP is used for remote servers.

What does an MCP server provide?

An MCP server can provide three main types of capability: tools, resources, and prompts. These distinguish actions, data, and pre-prepared work instructions from one another.

Tools - actions

Tools are functions the AI application can call. For example:

• searching for a customer in a CRM;
• checking stock availability in an ERP;
• creating a task;
• generating a report;
• sending a request to an internal API;
• recording an approved change.

Every tool has a name, a description, and a schema for its input parameters. The more clearly and narrowly an action is described, the easier it is for the AI application to use it correctly.

Resources - data and context

Resources are sources of information the AI application can read. These can be:

• company documents;
• product catalogs;
• database records;
• technical documentation;
• contract templates;
• current statuses from an internal system.

A resource should not automatically mean access to the entire database. Good architecture provides only the necessary scope and applies the same or stricter access rules as the underlying system.

Prompts - reusable instructions

Prompts are pre-prepared templates for a specific workflow. For example, an MCP server could provide an instruction for analyzing a customer inquiry that uses specific company rules and permitted tools.

The official description of tools, resources, and prompts is part of the protocol's architecture.

What is the difference between MCP and an API?

MCP does not replace an API. In most real projects, the MCP server uses existing API interfaces and presents them to AI applications in a standardized way. The API remains the technical contract between systems, while MCP adds a layer for AI to discover and use data and actions.

If an ERP system already has a well-designed API, there's no need to rewrite it. The MCP server can use the API as a foundation and expose only the tools suited to the AI scenario.

What is the difference between MCP and function calling?

Function calling lets a given AI model request the execution of a pre-described function, while MCP standardizes how AI applications discover, connect to, and use external tools and data. The two technologies can work together.

With function calling, the developer usually describes the functions directly within the specific AI application. With MCP, these capabilities are provided by a separate server and can be used by various compatible clients. The AI application, in turn, can present the discovered MCP tools to the model through its own tool- or function-calling mechanism.

The practical takeaway is simple: function calling addresses how the model requests a function within a specific platform, while MCP addresses how external capabilities are described and connected via a common standard.

What is the difference between a local and a remote MCP server?

A local MCP server runs on the same machine as the AI client, while a remote MCP server runs as a network service and can serve multiple users. The choice affects deployment, access, maintenance, and security.

A local server isn't automatically safe, because it can have access to files, processes, and local access data. A remote server should not be publicly accessible without appropriate authentication and authorization mechanisms.

What can MCP be used for in business?

MCP delivers the most value when the AI assistant needs to work with several real business systems and use current data under clear access rules. The right scenarios are specific, repeatable, and valuable enough to justify the integration.

AI assistant for CRM and sales

An MCP server can provide controlled search over customers, deals, tasks, and communication history. The AI assistant can summarize a customer profile, identify a missing next step, or prepare a proposal, without the data having to be copied manually into the conversation.

Reports from ERP and inventory systems

The AI assistant can check stock levels, product parameters, order status, or other permitted data. Actions such as changing a price, placing a supplier order, or adjusting a quantity should be separated from reporting and protected with additional permissions and confirmation.

Working with internal documents

MCP can connect an AI application to procedures, technical documentation, contract templates, or an internal knowledge base. This lets the answer be grounded in current company information, rather than only the model's general knowledge.

Customer service

An AI assistant can combine information from a ticketing system, a CRM, product documentation, and service statuses. MCP provides a common way to access these sources, but the quality of the answer still depends on the data, the permissions, and the escalation rules to a human.

Software development and operations

A development environment with MCP support can receive context from repositories, an issue tracker, monitoring, or internal documentation. This does not mean AI should get unrestricted rights to change code or the production environment. Access should follow the principle of least privilege.

When does it make sense to build your own MCP server?

A custom MCP server makes sense when a company has specific systems, data, or processes that off-the-shelf integrations don't cover well enough. The decision should start from a specific business scenario, not from a wish to simply use a new technology.

A custom MCP server is a reasonable choice when:

• you use a custom CRM, ERP, CMS, or internal platform;
• you need to unify several systems into one AI workflow;
• off-the-shelf connectors don't support the needed actions;
• you have specific roles, approvals, and access rules;
• you need to keep the business logic within your own control layer;
• you want one integration usable by more than one compatible AI client;
• you have requirements for logs, audit, monitoring, and version control.

When might MCP not be necessary?

MCP can be overkill if the task can be reliably solved with a simple, stable integration that won't be used by an AI application or by more than one client. The extra protocol doesn't add value on its own.

MCP probably isn't the first step when:

• there is no clearly defined AI scenario;
• the system lacks a reliable API or well-structured data;
• the process is one-off and doesn't justify maintenance;
• an existing off-the-shelf connector fully covers the need;
• the organization hasn't yet defined rights, responsibilities, and audit rules;
• the expectation is that MCP will automatically fix data-quality or process problems.

In some cases, the first correct investment is improving the API interfaces, authentication, and data quality. MCP can be added afterward as an AI-oriented layer.

Is MCP secure?

MCP provides mechanisms for secure integration, but it doesn't automatically make a system secure. The risk depends on what data and actions the server has access to, how the user is authenticated, how permissions are restricted, and how operations are monitored.

For secure remote MCP servers, the current specification defines an OAuth 2.1-based authorization model. It requires tokens to be scoped specifically to the relevant MCP server and prohibits forwarding a received token directly to another service as a universal means of access.

For business deployment we recommend at least the following controls:

• least-privilege access for every tool;
• separating read-only operations from change actions;
• explicit confirmation for financial, irreversible, or sensitive actions;
• verifying the user and their role on every operation;
• short-lived, properly protected tokens;
• HTTPS for remote connections;
• input and output validation;
• protection against prompt injection and untrusted content;
• rate limiting and request restrictions;
• a log of the tools called, their results, and any refusals;
• monitoring, alerting, and an access-revocation plan;
• separate development, test, and production environments.

Security should be part of the MCP server's architecture, not a check done right before it's published.

Does MCP work with ChatGPT and other AI applications?

Yes, MCP is supported by various AI applications and tools, but the specific features and the way of connecting depend on the respective platform and plan. As of August 26, 2026, the official MCP site lists ChatGPT, Claude, Visual Studio Code, and Cursor among the supported clients.

OpenAI documents the use of remote MCP servers and connectors as tools through which models can access external services. Calls can be authorized automatically or can require explicit approval from the developer. 

MCP is conceived as a model-agnostic standard, but that doesn't mean every feature works identically in every client. Before implementation, you should check the supported protocol version, the transport, the authorization, the limitations, and the approval process for actions.

In what languages can an MCP server be built?

An MCP server can be developed in various programming languages, as long as the implementation follows the protocol. As of August 26, 2026, the official documentation lists SDKs for TypeScript, Python, C#, Go, Rust, Java, Ruby, Swift, PHP, and Kotlin, divided by level of support and maturity.

The choice of language shouldn't be based solely on SDK availability. Also important are:

• the technology stack of the existing system;
• the maturity of the relevant SDK;
• the deployment approach;
• the available authentication and authorization libraries;
• monitoring and maintenance;
• the team's experience.

If the business system is built in PHP, the MCP server doesn't necessarily have to be in a different language. It's possible to use the PHP SDK or a separate service, but the decision should be made after assessing maturity, architecture, and operational requirements.

How much does building an MCP server cost?

The cost of building an MCP server depends mainly on the number and quality of the integrated systems, the complexity of the permissions, and the risk of the permitted actions. Exposing a single read-only tool can be a relatively limited task, while a production solution for several business systems requires architecture, security, tests, monitoring, and maintenance.

The main factors are:

• the availability and quality of existing API interfaces;
• the number of tools, resources, and connected systems;
• local or remote deployment;
• user roles and OAuth integration;
• data sensitivity;
• approvals required before actions;
• logging and audit requirements;
• test scenarios and evaluation of the AI's behavior;
• expected load, reliability, and monitoring;
• the need for ongoing development as the protocol changes.

A reliable estimate therefore shouldn't be given based only on the number of tools. The business scenarios, systems, permissions, and acceptance criteria need to be defined first.

How does an MCP project unfold?

A well-planned MCP project starts with a limited read-only scenario and moves to actions only once access, quality, and monitoring have been proven. This reduces risk and lets the value be verified before wider deployment.

At Sirius Software we would structure the work into the following stages:

1. Process analysis - we determine the users, tasks, systems, and expected outcome.
2. Readiness assessment - we review the API interfaces, data, roles, authentication, and constraints.
3. Architecture and threat model - we define trust boundaries, permissions, approvals, and logs.
4. Defining the tools - we design small, clear, verifiable tools instead of one tool with overly broad access.
5. Building the MCP server - we connect the permitted operations to the existing systems.
6. Tests and evaluations - we check correctness, failure handling, edge cases, security, and behavior under unclear instructions.
7. Limited rollout - we start with a defined group of users and read-only scenarios.
8. Monitoring and expansion - we add actions only once there is enough data, control, and business benefit.

How do you know if MCP is right for your company?

MCP is a good fit if you can clearly name which user will use the AI assistant, which system it needs to reach, and what measurable task it needs to perform. If these three elements are missing, a process analysis is needed first.

Use the following short check:

• Which specific employee or customer will use the solution?
• What question or action repeats often enough?
• Which system holds the necessary data?
• Is there a reliable API or other controlled means of access?
• What data can only be read?
• Which actions require confirmation from a human?
• How will it be verified that the result is correct?
• How will who did what, and when, be tracked?
• What measurable outcome do you expect - less manual work, faster lookups, shorter service times, or fewer errors?

If the answers are specific, a technical assessment and a limited proof of concept can follow. If they're generic, MCP is probably still a technology without a clear enough business application.

Frequently asked questions about MCP

Is MCP an AI model?

No. MCP is a protocol for connecting AI applications to external data and tools. It doesn't generate text and doesn't replace the language model.

Is an MCP server a database?

No. An MCP server can provide controlled access to a database, but it is itself an integration component. In many cases it's safer to use a limited application service or API, rather than allowing direct, arbitrary queries against the database.

Does MCP replace REST APIs?

No. MCP often uses REST, GraphQL, or another existing API. It adds a standard AI-oriented layer for discovering and using the permitted operations.

Can one MCP server work with several AI applications?

Yes, if the applications support the relevant version and the necessary MCP capabilities. Still, you should check the differences in transport, authorization, and the approval process for actions.

Can MCP access company data?

Yes, but only the data that the implementation and permissions explicitly allow. MCP shouldn't bypass existing roles, restrictions, and information-protection rules.

Should every business have an MCP server?

No. MCP makes sense when there's a clear AI scenario and a real need to connect to systems or data. A small, one-off integration can be simpler and cheaper without MCP.

MCP integration consultation

If you're considering an AI assistant that needs to work with your CRM, ERP, CMS, documents, or custom platform, the first step is to check whether MCP is the right approach and what access is actually needed.

At Sirius Software we can help with:

• an assessment of applicability and the business scenario;
• architecture for the MCP client and server integration;
• building a custom MCP server;
• connecting to existing APIs, CRM, ERP, and internal systems;
• a model for roles, authorization, approvals, and audit;
• proof of concept and phased production rollout;
• monitoring, support, and ongoing development.

Send an inquiry for an MCP consultation

In the initial conversation, it's enough to tell us which systems you use, who needs to work with the AI assistant, and what specific task you want to automate. On that basis, we can propose an approach, a scope, and next steps.

About the author

Georgi Papucharov is the founder of Sirius Software - a Bulgarian software company that, since 2011, has been building custom systems, AI integrations, CRM and ERP solutions, e-commerce, and complex web platforms. Sirius Software is certified to ISO/IEC 27001:2022.