What is MCP? Model Context Protocol explained

Short answer: MCP, the Model Context Protocol, is an open standard for connecting AI tools like Claude to the systems where your data lives. An MCP server is the small program that sits in front of one of those systems, such as your CRM or your document store, and tells the AI what it can read and do there.

Below: what that means in plain words, how it shows up in Claude, what it looks like for an Australian business, the security questions to ask, and when a custom server is worth building. We read the sources listed at the bottom on 31 October 2026.

What is MCP?

Anthropic released MCP as an open-source standard on 25 November 2024. The problem it targets is simple. An AI model can be very capable and still know nothing about your business, because your data sits inside separate systems and each one needed its own custom integration. MCP replaces that with a single, shared way of connecting.

The official MCP site compares it to a USB-C port: one standard plug instead of a drawer of different cables. Claude, ChatGPT, Visual Studio Code and Cursor all support it.

What is an MCP server?

There are three parts. The host is the AI application you use, such as Claude Desktop or Claude Code. The client is the piece inside the host that holds the connection. The server is the program that provides the context. When people say “an MCP server”, they mean that last piece.

A server can offer three kinds of things:

• Tools. Actions the AI can run, like searching contacts, creating a task or sending an API call.
• Resources. Data the AI can read for context, like a document, a record or a database schema.
• Prompts. Reusable templates that structure a job, such as a set of instructions for writing up a sales call.

Servers can run on your own computer (local) or on a company’s platform and be reached over the internet (remote).

What are connectors in Claude?

Connectors are how Claude uses MCP. Anthropic describes them as letting Claude access your apps and services, retrieve your data and take actions in them. There are two kinds:

• Directory connectors. Pre-built and listed in Claude’s Connectors Directory, which shows what each one can read and write.
• Custom connectors. You add the web address of a remote MCP server yourself. These are available on every plan, including Free (limited to one). Anthropic has not verified them, and its cloud connects to the server, so it must be reachable from the internet.

One detail matters for permissions. Claude inherits each person’s permissions from the connected service, so it cannot reach a record or file that person could not open themselves. The exception is a connector that uses a shared credential, like an API key. That gives everyone who uses it the same access.

On a Team plan, only Owners can add connectors to the organisation, and each member then signs in individually. Owners can also set tool permissions across the organisation to always allow, needs approval or blocked. Plan costs are in our guide to Claude pricing in Australia.

What it looks like for an Australian business

These are the kinds of jobs a connected Claude does well in a mid-market business:

• CRM. Ask Claude to find every open deal in a stage that has gone quiet, then draft the follow-up. With HubSpot, that means reading contacts, companies and deals, and optionally updating records.
• Documents. Ask a question across contracts, proposals or policies kept in Google Drive or a similar store.
• Finance. Ask for overdue invoices or a summary of a month’s bills from your accounting tool, read-only, without anyone exporting a spreadsheet.

Whether a given vendor has a directory connector or an MCP server changes over time. Check the Connectors Directory and the vendor’s own site before you plan around it. We wrote up how we handled the CRM side in how we set up our own HubSpot MCP connection and where we put the limits.

Security and permission questions to ask

A connector lets Claude touch real data. Anthropic’s own help article says connected servers can read, create, modify or delete data and act on your behalf, within the permissions you grant. Ask these before you switch one on.

• Read or write? Start read-only. Claude’s tools menu lets you turn off individual tools, and Anthropic recommends disabling write-capable tools when you use Research, which can call connector tools without asking each time.
• Who approves actions? Decide which tools need approval and which are blocked, and set that at the organisation level where you can. Anthropic’s engineering team reports that users approved about 93% of permission prompts, and that the more approvals people see, the less attention they pay to each. Limits on what a tool can do protect you more than prompts do.
• What can the credential reach? The MCP security guidance recommends least privilege: start with low-risk read access and widen only when needed, rather than granting broad scopes up front. Ask the same of any service account you create.
• Can the content attack Claude? This is prompt injection: text inside an email, web page or record that tells the AI to do something its user never asked. Anthropic states that output from a tool can carry an attack even when the tool is trusted, and warns that malicious servers can embed hidden instructions. Narrow permissions limit the damage if one gets through.
• Who built and hosts the server? Anthropic advises connecting only to servers built and hosted by parties you trust, and reviewing the permissions requested at sign-in. Third-party services also process your data under their own terms, possibly outside Australia.

Off-the-shelf connector or custom MCP server?

Use an existing connector when the vendor already offers one and it covers the jobs you have. It costs the least to set up, the vendor maintains it, and a directory listing shows what it reads and writes. Your work is deciding who gets it and which tools stay on.

Consider a custom MCP server when one of these is true:

• The system you need has no connector, such as an industry platform or an in-house database.
• The off-the-shelf version exposes more than you want. A custom server can offer three narrow tools and nothing else.
• The answer depends on your rules, like how you define a qualified lead, which a generic connector cannot know.

What a custom MCP server involves

The MCP project publishes official SDKs in TypeScript, Python, C#, Go, Rust, Ruby, Java and other languages, so the protocol part is well supported. The work that takes time is the part around it:

• Scope. List the few jobs the server should do, and which are read and which write.
• Tools. Write each tool with a clear name, a description Claude can follow and defined inputs.
• Sign-in. Use OAuth where the service supports it, so each person connects as themselves.
• Hosting. A remote server needs somewhere reliable to run that Anthropic’s cloud can reach, with an allowlist if it sits on a private network.
• Testing and monitoring. Try it on real tasks and log what it does.

A small read-only server over one system is a modest project. A write-capable server across several systems is real engineering and deserves a security review. We’re Certified in the Claude Partner Network, and our AI engineering service covers building these. If you are still weighing who should do the work, our guide to choosing who builds Claude into your HubSpot is a good place to start, and our Claude for business page shows how we work with Australian teams.

Frequently asked questions

What is MCP? MCP, the Model Context Protocol, is an open-source standard that lets AI applications like Claude connect to external systems such as files, databases and business tools. Anthropic introduced it in November 2024.

What is an MCP server? An MCP server is a program that gives an AI application access to a system’s data and actions, offered as tools, resources and prompts. It can run on your computer or remotely on a company’s platform.

What is a Claude MCP connector? A connector is how Claude uses an MCP server to reach an app or service. Directory connectors are pre-built, and custom connectors point Claude at a remote MCP server you add yourself.

Is MCP safe for business data? It can be, if you limit what each connector can do. Start read-only, require approval for write actions, use least-privilege credentials and connect only to servers you trust, since content a tool returns can carry hidden instructions.

When do I need a custom MCP server? You need one when no ready-made connector covers your system, when an existing one exposes too much, or when your own business rules must shape what Claude can do.

Sources

• What is the Model Context Protocol, modelcontextprotocol.io, checked 31 October 2026, for the definition and which AI tools support it.
• Architecture overview, modelcontextprotocol.io, checked 31 October 2026, for hosts, clients, servers, tools, resources, prompts and local versus remote servers.
• Security guidance for MCP, modelcontextprotocol.io, checked 31 October 2026, for least privilege and scope guidance.
• SDKs, modelcontextprotocol.io, checked 31 October 2026, for the official SDK languages.
• Introducing the Model Context Protocol, Anthropic, checked 31 October 2026, for the release date and the problem it solves.
• Use connectors to extend Claude’s capabilities, Claude Help Center, checked 31 October 2026, for directory and custom connectors, inherited permissions and organisation tool settings.
• Getting started with custom connectors using remote MCP, Claude Help Center, checked 31 October 2026, for plans, who can add connectors, security warnings and tool approvals.
• How we contain Claude across products, Anthropic, checked 31 October 2026, for attacks carried in tool output, least privilege and approval fatigue.

---