In this guide
Where does MCP come from?
The Model Context Protocol was introduced by Anthropic, the company behind Claude, on 25 November 2024, as an open standard for connecting AI applications to the systems where data lives (Anthropic's announcement). On 9 December 2025 Anthropic donated it to the Agentic AI Foundation, a fund within the Linux Foundation founded together with Block and OpenAI (donation announcement, Linux Foundation press release).
For anyone choosing business software, there is only one point: MCP is not one vendor's protocol. It is a standard used by several AIs and several pieces of software, and that makes an investment made today useful tomorrow too.
How does an MCP server work?
There are three roles (MCP specification):
- Host: the AI application you use, for example Claude or GPT, on the web, on the desktop or on the phone.
- Client: the connector inside the host, one for each connected service.
- Server: the service that exposes data and actions, for example your business software.
The server offers three kinds of things:
| Element | What it is | Example in business software |
|---|---|---|
| Tools | Actions the AI can ask to run | Finding a client, creating a task, updating a project's progress |
| Resources | Context to read | A project overview, a knowledge base page |
| Prompts | Ready-made request templates | "Prepare the client's weekly summary" |
Messages travel as JSON-RPC 2.0. A local server talks to the host on the same computer; a remote server, like that of cloud business software, talks over HTTP and asks the user to sign in with OAuth, so the AI never sees the password. The standard evolves through dated versions: the current version, at the time of writing, is 2026-07-28.
What is the difference between an API and an MCP server?
An API is designed for a programmer who writes code. An MCP server is designed for an AI that has to work out on its own what it can do.
| Classic API | MCP server | |
|---|---|---|
| Who uses it | A developer, who writes the integration | An AI, which reads the list of tools and chooses |
| How you find out what it does | Documentation to read | Every tool describes itself, with name, parameters and purpose |
| How much work it takes to connect | One integration for each pair of software products | One connector, valid for every AI that speaks MCP |
| Who decides what to do | Code written in advance | The AI, within the limits the server enforces |
The last row is the one that matters. If the AI chooses what to do, the limits must live in the server, not in the AI's good intentions.
What changes for a business?
AI works on the real data, not on a copy
Today people who use AI at work often export a list, paste it into the chat and copy the result back. With an MCP server the AI reads the data where it lives and writes where it is needed. Fewer steps, fewer errors, no copies of the data floating around.
You talk to the business software as you would to a colleague
"What is due this week?", "Create a task for tomorrow to call the client back", "Which opportunities have been stuck for a month?". By voice too, from the phone, if the AI app allows it.
Agents become possible
An AI agent that works on its own needs a place to receive work and hand it back. Business software with an MCP server can assign a task to an agent as it would to a person.
But the risks change too
An AI that can write to the business software can also make mistakes, or be fooled by a text it has read. The MCP specification itself calls for explicit user consent before a tool is invoked, and for tools to be treated with caution. The rest is up to the server.
What are the risks and how are they governed?
| Risk | Countermeasure in the server |
|---|---|
| The AI sees more than it should | It uses the permissions of the connected person, not an administrator's |
| A text it reads (an email, a ticket) contains hostile instructions | Third-party text is declared as data, not instructions; permissions are checked on the server side, whatever the AI has read |
| An irreversible action goes off by mistake | Sensitive actions are prepared and approved by a person, outside the chat |
| The AI repeats the same write | Identical writes close together are recognised and not duplicated |
| A runaway loop makes hundreds of calls | Call limits per person and per agent |
| Nobody knows who did what | Every call goes into the log, with channel and client |
| Exposed secrets | IBANs, keys and tokens never pass through the tools |
How does it work in YVY?
YVY has its own MCP server. Every tool calls the same logic the interface uses, with the same checks: the AI has no side door.
- Your chatbot connects with your YVY account and works with your permissions: it reads, creates and edits.
- Sensitive actions (issuing an invoice, recording a payment, writing to the client, closing an opportunity, removing something, changing permissions) are only prepared by the chatbot. You approve them in YVY with Approve and run, or reject them.
- The assistant inside YVY, under the name you give it, uses the same tools with the same rules.
- AI agents are users with their own identity and a human owner. They read and create, edit only what the administrator enables, and never touch sensitive actions.
- Every action goes into the log, with who, what, when and from which channel.
The step-by-step connection is in the guide Connecting Claude to your business software.
What should you ask a vendor who says "we have an MCP server"?
- Does the AI use the person's permissions or those of a technical user?
- Does every tool go through the same checks as the interface?
- Which actions need a person's approval, and where are they approved?
- How do you handle text written by third parties, such as emails and tickets?
- Are there call limits per person and per agent?
- Does the log say who did what and from which channel?
- Can an agent have its own identity, separate from a person's?
- How many of the software's functions can the AI reach, and which stay out by choice?
If the answers are vague, the MCP server is window dressing. If they are precise, it is part of the architecture.
Frequently asked questions
What is MCP in simple terms?
It is an open standard that lets an AI use a piece of software's data and actions. Like a universal socket: one connector, and every compatible AI can work with that software.
Is MCP only for Claude?
No. Anthropic introduced it, but today it is an open standard run under the Linux Foundation, and several AI applications have adopted it.
Do you need a programmer to connect an MCP server?
For a remote server, usually not: you add it as a connector in the AI app, with the server address, and sign in with your own account.
Is an MCP server secure?
It depends on how it is built. Security lives in the server: the person's permissions, human approval for sensitive actions, third-party text treated as data, limits and a log.
What is the difference between an MCP server and an AI agent?
The MCP server is the door; the agent is the one who uses it. An agent works on its own and uses the MCP server to read and write in the business software.