An analyst wants their assistant to answer questions about sales figures. They find an MCP server for the data warehouse, paste a connection string into a config file, and within ten minutes the assistant can query the database.
No ticket was raised. No procurement decision was made. A connection now exists between an AI service and the system holding revenue data.
What MCP is
The Model Context Protocol is an open standard, introduced by Anthropic in November 2024, describing how an AI assistant talks to systems outside itself. The specification is public.
The problem it solves is real. Before MCP, every assistant-and-system pair needed its own integration: one for this assistant with that CRM, another for a different assistant with the same CRM. With a shared standard you build the integration once and any conforming assistant can use it.
That is the move USB made for peripherals, and the consequence is the same: the number of connections climbs because the barrier is gone.
What an MCP server does
An MCP server is a small program that speaks in two directions.
On the system side it connects to whatever you want to expose: a mailbox, a calendar, a database, an API, or simply files on a disk.
On the assistant side it advertises the available tools. Not as documentation for humans, but as a machine-readable description: this tool is called find_customer, it expects a name, it returns a customer record. The assistant reads that list and can then invoke the tools.
An important detail: the assistant decides when to call which tool. You ask for sales figures, and the model determines which calls that requires. That is exactly what makes an agent an agent.
Where it gets interesting
Not in the protocol. That is a specification, and a good one. It sits in what grows around it.
It is somebody else's code. An MCP server is a program you install that gains access on your behalf. That is a supply chain, with the same questions as any dependency. In July 2025, CVE-2025-6514 was published, a command injection flaw in mcp-remote, a widely used proxy with hundreds of thousands of downloads. Not unusual for young software, and a good reason to know what you are running. OWASP maintains an MCP security cheat sheet covering this ground.
Permissions exceed the task. Connecting frequently requests full access where read-only would have done. Easier for the builder, and wider than necessary.
Tokens do not expire. A granted token typically stays valid until somebody revokes it, including after the user changes their password. Short-lived scoped tokens are the recommendation; long-lived ones are the practice, because they cause less friction.
Nobody assessed it. The largest of the four. The connection was made by someone trying to work faster, which is how shadow AI always arrives.
Why this is the next wave
The first wave of shadow AI was a browser tab: somebody opened a chatbot and pasted something in. Unwelcome, and bounded by what that person pasted.
An MCP connection is a door. What is shared is not text but access, and that access persists after the employee goes home. What travels through it afterwards depends on what the assistant decides it needs.
On top of which, an assistant with integrations also reads external content, making it susceptible to instructions hidden in that content. See what is prompt injection.
What to put in place
- Know which exist. On managed machines you can see which MCP servers are installed. Without management this becomes asking, with an incomplete answer.
- Assess provenance. From the system vendor itself, or from an unfamiliar repository? The same distinction you apply to any dependency.
- Narrow permissions at connection time. Read where reading suffices. This is the moment it is possible, because nobody revisits it afterwards.
- Expire tokens. And make sure there is somewhere they can be revoked.
- Treat it as a vendor. The same questions as in approving an AI tool, because that is what it is.
The reason to look at this now rather than next year: connections are cheap to create and expensive to unwind. A tab you close. Granted access has to be revoked by someone, and first they have to know it exists.
