MCP Services
MCP services are small services that give an AI assistant access to data and tools according to a unified standard, for instance to a calendar or a database. The underlying standard is called Model Context Protocol and was published by Anthropic in 2024.
An AI assistant like ChatGPT can, by itself, only generate text. It knows nothing about your calendar, your files, or a company’s current stock levels. For it to learn about these things, it needs a connection to the outside world. MCP services are exactly such connecting pieces: small programs that provide data or tools and offer them to an AI program. What’s special about this is the uniformity. All these services speak the same language, laid down in a set of rules called Model Context Protocol, or MCP for short. The company Anthropic published these rules in late 2024 and made them openly accessible.
Why a common connector was needed
Before MCP, every connection had to be built individually. If a provider wanted to connect its assistant to five different programs, it needed five custom-built solutions. If three assistants and ten programs came together, that was already thirty. In software development, this problem is called the M-times-N problem, because the number of necessary connections results from multiplying two quantities.
A shared standard turns this into an M-plus-N problem. Each program builds one MCP service, each assistant learns MCP once. After that, everything fits together. The analogy most often used for this is USB-C: one type of connector for laptop, phone, and headphones, instead of a separate cable for every device.
Economically, this is a major lever. Anyone selling software can connect it to AI assistants with manageable effort. That’s why, in 2025, OpenAI, Google, and Microsoft, among others, announced that they would support MCP in their products. An open standard usually gains traction when the major providers back it together.
Server, client, and the three building blocks
MCP knows two roles. The MCP server is the service that offers something, for example access to a database. The MCP client sits inside the application in which the AI runs, for example in a chat program or a code editor. Client and server exchange messages in a fixed format. Usually this runs locally on the same machine, but it can also happen over the internet.
A server can offer three kinds of things. Resources are data for reading, such as the contents of a file. Tools are actions that bring about an effect, such as sending an email or changing a record. Prompts are prepared text templates for recurring tasks. When connecting, the server reports everything it can do. This process is called discovery.
The sequence during operation is then brief. The language model decides that it needs a particular tool. The client calls it on the server and gets a result back. This result flows into the text with which the model continues working. Importantly: the model itself never talks directly to the database. It only formulates the request; the actual execution is handled by the server.
MCP in products and the open risks
Today, MCP is most commonly encountered by programmers. Editors like Cursor or Claude Code can be connected via MCP services to Git repositories, ticketing systems, or test databases. There are now thousands of publicly available servers, many of them maintained by companies like GitHub, Stripe, or Slack themselves. In the news, the term usually comes up when a provider announces that its product is now MCP-capable.
A related term is function calling. Here, a developer describes to the model directly in the program code which functions it may call. MCP is the level above that: the tools reside in a standalone service and can be swapped out without changing the code. The two are not mutually exclusive; MCP uses function calling in the background.
Security is the aspect discussed most critically. An MCP server with write access can cause real damage if the model follows a manipulated instruction. Such hidden commands embedded in seemingly harmless text are called prompt injection. That’s why most applications ask for confirmation before taking an action, and one should only trust servers whose origin is known.