MCP explained for CEOs: how AI connects to your company's tools

What is the Model Context Protocol (MCP)?

MCP is an open protocol that standardises how an AI application talks to external data sources and tools, so a model can read your data and take actions in your systems through 1 common interface. Anthropic published it as an open standard on 25 November 2024, with Block, Apollo, Replit and Sourcegraph among the first adopters.

Before USB, each device came with its own cable and driver. After USB, 1 port worked for everything. MCP does the same for AI: instead of building a bespoke bridge between each model and each business tool, the tool exposes an MCP "server" once, and any compatible AI application, the "client", can use it.

Under the hood, an MCP server offers 3 things, according to the official specification: resources (data the model can read, such as a customer record), tools (actions the model can execute, such as creating an invoice) and prompts (templated workflows).

• Host: the AI application your people use, for example Claude, ChatGPT, Copilot or an internal agent.
• Client: the connector inside that application that speaks MCP.
• Server: the piece that sits in front of your CRM, ERP, database or mailbox and exposes what the model may see and do.

Why does MCP matter for a business, not just for developers?

MCP matters because it turns integrations from projects into permissions: connecting an agent to a new system becomes a configuration decision measured in days, not a development effort measured in weeks.

In my companies, before MCP, every time we wanted an agent to check a shipment in the ERP or update a deal in the CRM, someone wrote and maintained a custom connector. With 10 tools and 3 AI applications that is 30 integrations. With MCP it is 10 servers, and the same 10 servers work with every AI application we adopt next year.

The second reason is reuse across the market. Cloudflare reported on 1 May 2025 that Asana, Atlassian, Block, Intercom, Linear, PayPal, Sentry, Stripe and Webflow had launched remote MCP servers on its platform, with build times of days instead of weeks. When your suppliers ship their own MCP servers, your team stops building integrations and starts choosing which ones to switch on.

Who has adopted MCP and who governs it?

MCP is backed by every major AI and cloud vendor and, since 9 December 2025, it is governed by the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, the same neutral body that stewards Kubernetes and Node.js.

OpenAI announced support in March 2025. Microsoft made MCP generally available in Copilot Studio in May 2025 and announced native support in Windows 11. When Anthropic donated the protocol to the AAIF, the Linux Foundation listed AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI as platinum members, with Salesforce, SAP, Oracle, IBM, Snowflake and Twilio among the gold members.

The usage numbers followed. By the 2026-07-28 specification release, the maintainers reported around 500 million downloads per month across the main SDKs, and the TypeScript and Python libraries had each passed 1 billion total downloads. For a CEO, the practical meaning is that MCP is not a bet on 1 vendor. It is the default.

What does MCP change in a company's integration roadmap?

MCP changes the roadmap in 3 ways: you buy fewer point integrations, you ask every software vendor for an MCP server in the procurement checklist, and you invest instead in identity and permissions.

The first change is budget. A large part of what companies pay integration platforms and consultancies for is glue code between systems. MCP removes the part that was model-specific. Ask your CTO which integrations on the roadmap exist only to feed an AI application. Those are the ones MCP collapses.

The second change is procurement. Every SaaS contract you renew from now on should include a question: do you offer an MCP server, is it hosted by you, and what permissions does it support?

The third change is where the engineering effort goes. The 2026-07-28 specification hardened authorisation and added enterprise-managed authorisation, so an administrator approves a connector once and employees inherit access through the company's identity provider. That is identity work, and it is where I now put my best people.

• Ask each vendor for a hosted MCP server and its permission model before renewal.
• Route every MCP connection through your identity provider, never through personal tokens.
• Keep 1 internal catalogue of approved servers, the way you keep an approved software list.

What are the security risks of MCP that a CEO should understand?

The main MCP risk is not the protocol itself, it is an agent holding more permissions than the task needs while reading text that an attacker controls. Every serious incident so far follows that pattern.

2 examples from 2025 make it concrete. In May, Invariant Labs showed that a malicious GitHub issue could instruct an agent connected to the GitHub MCP server to read private repositories and publish their contents in a public pull request. In June, Asana took its MCP server offline for 13 days and notified approximately 1,000 organisations after a tenant-isolation bug could expose 1 customer's tasks and files to another, according to BleepingComputer.

Neither was an exotic hack. The GitHub case is "prompt injection": the agent reads text from an untrusted source and treats it as an instruction. The Asana case was a plain software bug in a new product. The MCP specification says tool descriptions should be treated as untrusted and hosts must obtain user consent before invoking tools, and its security best practices forbid passing tokens through to other systems. The standard is sound. The implementations and the permissions are where you get hurt.

What 6 questions should a CEO ask before approving an MCP connector?

Before an MCP connector touches production, a CEO should ask 6 questions about permissions, data flow, approval, logging, hosting and incident response. If the team cannot answer all 6 in 1 page, the connector is not ready.

I ask these in my companies for every new server, whether it is built in-house or supplied by a vendor.

• Least privilege: what exactly can the agent read and write, and is it read-only wherever writing is not required?
• Untrusted input: where does the agent read text that customers, suppliers or the public can write, and how is it isolated from instructions?
• Human approval: which actions (payments, deletions, external emails) require a person to confirm, enforced by the system, not by a prompt?
• Identity: does access flow through our identity provider with per-user consent, or through 1 shared token that lives forever?
• Logging: can we reconstruct which data the agent saw and who approved each action?
• Kill switch and hosting: who runs the server, in which region, and how fast can we disconnect it?

How should a company start with MCP in the next 90 days?

Start with 1 read-only MCP server in front of a system your team already queries every day, prove the value in 30 days, then add write actions with human approval in the following 60.

The read-only start matters. A server that lets an agent look up a customer, a shipment or an invoice cannot damage anything and already saves hours. In my companies the first server was the data warehouse, and within weeks the sales team stopped asking analysts for numbers.

Choose vendors that already ship hosted MCP servers, connect them through your identity provider and keep the 6 questions above as a standing checklist. MCP will make every intelligent tool you buy from now on plug into the systems you already own, and that is a large enough change to deserve the CEO's attention.