Key Takeaways
- MCP (Model Context Protocol) is an open standard, introduced by Anthropic in late 2024, for connecting AI applications to tools and data.
- An MCP server exposes a system's capabilities (tools, resources, prompts) so any compatible AI client can use them without a custom integration.
- For business software, an MCP server means AI agents can look up and act on real records, not just chat about them.
- Good MCP servers use OAuth, run as the authorizing user, respect existing permissions, and log what agents do.
The Short Definition
An MCP server is a piece of software that exposes a system's capabilities to AI assistants using the Model Context Protocol (MCP), an open standard for connecting AI applications to external tools and data. If your CRM, accounting system, or business hub has an MCP server, any AI client that speaks MCP can use it as a tool: searching records, reading details, and taking actions, within whatever permissions it has been granted.
MCP was introduced by Anthropic in November 2024 and published as an open specification. It has since been adopted across a wide range of AI applications and developer tools, which is what makes it useful: build one MCP server, and many different AI clients can use it.
Why a Standard Was Needed
Before MCP, connecting an AI assistant to a business system meant building a custom integration for that specific pairing. Connecting five AI tools to ten business systems could mean up to fifty separate integrations, each with its own authentication, data format, and maintenance burden.
MCP turns that many-to-many problem into a many-to-one problem. Each system implements the protocol once as a server; each AI application implements it once as a client. Any client can then talk to any server, the same way any web browser can load any website.
How MCP Works
MCP defines a few roles and a few kinds of capability:
- Host: the AI application the person is using, such as a chat assistant, an IDE, or an agent platform.
- Client: the component inside the host that maintains a connection to a server.
- Server: the program that exposes a system's capabilities, such as your business software's MCP server.
Servers can offer three main kinds of capability:
- Tools: actions the AI can call, like “search contacts,” “create a task,” or “list overdue invoices.” Each tool has a name, a description, and a defined input schema.
- Resources: data the AI can read for context, such as a document or a record.
- Prompts: reusable templates a server offers for common tasks.
Servers can run locally on a person's machine or remotely over HTTP. Remote servers, which are the natural fit for business software, are expected to use OAuth 2.1 for authorization, so a person signs in and explicitly approves what the AI client may do, rather than pasting a password or a permanent key into it.
Why Your Business Software Needs One
AI That Works on Real Data
Without an MCP server, an AI assistant can only work with what you paste into it. With one, it can answer “which customers have invoices more than 30 days overdue?” by actually querying your system, then draft follow-ups or create tasks, all without copying data by hand.
Choice of AI Tools
Because MCP is a standard, you aren't limited to whatever assistant your software vendor bundles. Your team can use the AI clients they prefer, and each one can reach the same system through the same server.
Agents That Span Systems
AI agents increasingly run multi-step jobs: reading an email, checking an order, updating a record, and replying. MCP lets them do that across systems without a custom integration for every step.
Future-Proofing
The AI landscape moves quickly. An MCP server is a stable interface that new AI tools can use as they appear, without rebuilding integrations each time.
What Good MCP Security Looks Like
Giving AI agents access to business data raises fair questions. A well-built MCP server should answer them:
- Proper authorization. Remote access should use OAuth 2.1 with protections like PKCE and token rotation, or narrowly scoped API keys, not shared passwords.
- Act as the user. The agent should have exactly the permissions of the person who authorized it. If they can't see payroll, neither can their agent.
- Database-level enforcement. Permissions should be enforced where the data lives, not only in the user interface, so a tool call can't reach records it shouldn't.
- Confirmation for irreversible actions. Deleting, sending, or paying should require a human's explicit go-ahead.
- Audit trail. Every action an agent takes should be logged and reviewable.
- Revocability. Administrators should be able to cut off a client or key immediately.
Questions to Ask Your Software Vendor
- Do you offer an MCP server, and is it remote or local only?
- How does authorization work, and does the agent inherit the user's permissions?
- Which actions are exposed as tools, and which require confirmation?
- Where can we see a log of what agents have done?
- Can our own internal assistant use external MCP servers as well?
How IFX Hub Approaches This
Every IFX Hub includes an MCP server, so approved AI agents (such as Claude) can use your hub as a tool. Access uses scoped API keys or OAuth 2.1 with dynamic client registration, PKCE, and refresh-token rotation, and every call runs as the person who authorized it, under the same row-level security as the rest of the hub. See the Security, Platform & MCP page for details.
The hub's own Ask AI assistant works the other way too: workspaces can attach external MCP servers, and their tools appear alongside the hub's built-in ones. The assistant pauses for confirmation before irreversible actions, and every run is kept in a reviewable history.
See It Against Your Own Business
A discovery call maps your tools and workflows onto one hub.
