MCP, the Model Context Protocol, is an open standard for connecting AI assistants to the tools and data a business already uses: email, calendars, file stores, CRM, databases, ticketing systems. Before MCP, every AI application needed a custom integration for every system. With MCP, a system is wrapped once as an MCP server, and any compatible AI application can use it. Anthropic introduced the protocol in November 2024. In December 2025 it was donated to the Agentic AI Foundation under the Linux Foundation, which Anthropic, Block and OpenAI co-founded with support from Google, Microsoft, Amazon Web Services, Cloudflare and Bloomberg. It is now supported by products including Claude, ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code.
For a business, MCP is what turns an AI that can talk into an AI that can look things up and do things. That is also why it needs to be governed like any other system that touches company data.
How does MCP work?
| Part | What it is | Example |
|---|---|---|
| Host | The AI application the person uses | A chat assistant, a coding tool, an internal agent |
| Client | The connector inside the host that speaks MCP | One client per connected server |
| Server | A small program that exposes one system to the AI | An MCP server for your file store, CRM or database |
A server can offer three kinds of capability.
- Tools. Actions the model can call, such as search orders, create a ticket or send a draft.
- Resources. Data the model can read, such as files, records or query results.
- Prompts. Reusable instructions for common tasks.
Messages use the JSON-RPC format. Local servers run as a process on the same machine; remote servers are reached over HTTP, with OAuth-based authorisation. The specification has continued to develop under the foundation, with recent revisions aimed at long-running operations, scaling and stronger identity checks.
Source: Linux Foundation and Anthropic announcements (Dec 2025); trade coverage of the Agentic AI Foundation (2026). Compiled 11 Nov 2026.
MCP vs API vs RAG: what is the difference?
| API | RAG | MCP | |
|---|---|---|---|
| What it is | An interface a program calls | A method: retrieve documents, then answer from them | A standard way for AI to discover and use tools and data |
| Designed for | Developers writing code | Answering questions from documents | AI models choosing actions at run time |
| Can take actions? | Yes | No, read-only | Yes, through tools |
| Relationship | MCP servers usually wrap existing APIs | A retrieval system can be exposed as an MCP tool | Sits between the model and both |
MCP does not replace your APIs or your vector database. It gives the model a consistent way to reach them.
What can a business do with MCP?
- Sales and quoting. An assistant reads an enquiry, checks stock and pricing, and drafts a quotation for a person to approve. We describe one in building an AI sales assistant.
- IT and operations. Look up a device, open a ticket, summarise an incident.
- Finance. Pull figures from the accounting system into a report, with the source cited.
- Knowledge work. Search files, email and chat from one question.
- Agents. Multi-step tasks that chain several tools. See AI agents vs traditional automation.
MCP makes it easy to give an AI access to a system. It does not decide whether the AI should have that access. That decision, and the permissions that enforce it, remain yours.
What are the security risks?
- Prompt injection through tool results. A web page, email or document can contain text that tells the model to do something. If the model can also call tools, an injected instruction can become an action. See why your AI assistant may be your biggest security risk.
- Over-broad permissions. A server that runs with an administrator's credentials gives the AI an administrator's reach.
- Untrusted servers. MCP servers are software. A malicious or careless one can leak data or misdescribe what its tools do.
- Risky combinations. Read access to private data, exposure to untrusted content and the ability to send data out are each manageable. Together in one agent, they are how data gets stolen.
- Weak audit trails. If nobody logs which tool was called with what, nobody can investigate afterwards.
A safe rollout checklist
- Start read-only. Let the assistant look things up before it can change anything.
- Use least privilege. Give each server its own narrowly scoped account; act as the signed-in user where possible so existing permissions apply.
- Require human approval for actions that matter. Sending, paying, deleting and changing settings. See would you trust an AI agent with the company credit card?
- Allow-list servers. Only install servers from sources you trust, review what they expose, and pin versions.
- Log every tool call and review the logs.
- Segment the network. Put the AI system and its servers behind a firewall with rules for exactly what they may reach.
- Write it into policy. Our overview of Singapore's AI governance expectations covers what to document.
Does MCP work with locally hosted models?
Yes. MCP is independent of the model. A model running on your own hardware can use MCP servers through a compatible host application, provided the model is good at tool calling. Smaller models are less reliable at choosing and formatting tool calls, so test with your own tasks. The combination of a local model and local MCP servers keeps both the reasoning and the data inside your network; see running a private company assistant on GB10. MCP servers themselves are lightweight and run on an ordinary PC, a NAS or a small virtual machine. The model is what needs the GPU.
Buying in Singapore
To run a tool-capable model privately, the NVIDIA DGX Spark 4TB (S$9,450), ASUS Ascent GX10 128GB/1TB (S$10,350) or HP ZGX Nano G1n 4TB (S$11,499). To segment the AI system from the rest of the network, the Fortinet FortiGate 70G (S$1,668) or FortiGate 90G (S$3,796.80). For the files the assistant searches, with backup, the Synology DS1825+ (S$2,148) and Synology ActiveProtect DP340 (S$6,526.80) (listed 11 Nov 2026; prices change; ask for a current quotation). To start, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
What is MCP? MCP, the Model Context Protocol, is an open standard that lets AI applications connect to external tools and data sources through MCP servers, so one integration works across many AI products.
Who controls MCP? Anthropic created MCP in November 2024 and donated it in December 2025 to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI.
Is MCP the same as an API? No. An API is an interface that programs call. MCP is a standard way for AI models to discover and use tools and data, and MCP servers usually wrap existing APIs.
Is MCP secure? MCP supports authorisation, but safety depends on deployment. The main risks are prompt injection through tool results, over-broad permissions and untrusted servers, so use least privilege, human approval and logging.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
