What Is MCP (Model Context Protocol)? A Plain Explanation for Companies, Including Security and Permissions (2026)

A question managers ask me more and more is: "Can we connect Claude or ChatGPT to our Drive, our CRM, our database?" Most of the time the answer is yes. The standard behind that connection is called MCP. It comes up in meetings, but few people can explain it, and those who can tend to disappear into jargon. In this article I explain MCP for a manager without a technical background: what it does, how it connects to company tools, what risks it carries, how to manage permissions and when you do not need it at all.

What is MCP?

MCP (Model Context Protocol) is an open protocol designed so that AI assistants can connect to outside tools and data in a standard way. Introduced by Anthropic, it lets an assistant reach a file in Google Drive, a customer record in a CRM or a table in a database without anyone writing a new integration from scratch for each tool. A common comparison is different devices working with the same charging connector: once the standard exists, every tool speaks through the same door. The summary a manager needs is this: MCP gives an assistant the ability to work across your company's information and tools, and at the same time it is the permission gate that decides what the assistant can touch.

Assistants such as Claude and ChatGPT support MCP connections to different degrees. Which plan, and which type of connection, changes over time, so check the provider's current documentation.

What does MCP do?

MCP removes the go between steps such as pasting files, taking screenshots or copying reports, and lets the assistant work directly with current data. With a plain chat box you carry the information in yourself. With MCP connected, the assistant goes and gets it. These are two different ways of working. The three most useful examples I see in training all start with a question and pull the answer from a tool. The point to remember is that the assistant can do these things only within the permissions it is given. MCP is less about adding a new capability than about using your existing access through an assistant.

• Drive and document archives: "From the proposals we prepared last quarter, pull out the objections that came up most."
• CRM: "Summarize this customer's last three conversations and list what is still open."
• Database: Asking "Which product group had the highest return rate last month?" without waiting for an analyst.

How does MCP work?

MCP has two sides: a client and a server. The client is the AI application you talk to. The server is a small connector program that opens the door to one tool and tells the assistant what that tool can do. When the assistant receives a question, it decides which server to ask for what, and the server brings back the answer within the tool's own permissions. A server can run locally on your own computer or remotely over the internet. Without going into technical detail, the parts look like this at a manager's level:

The last row matters most to managers, because the safety of a connection usually depends less on the protocol than on which permissions the server was given.

What is the difference between MCP, an API, automation and an AI agent?

An API is the door through which two pieces of software talk. MCP adds a common language on top of those doors that assistants can understand. Automation is a flow drawn in advance: when this happens, do that. An agent is a system that works toward a goal step by step, and it needs tools to do that, with MCP being one way to reach them. They are not competitors but layers that complement each other. Which one you pick depends on how fixed the work is. For fixed, repeating work, automation fits better. When the assistant has to decide what to do each time, MCP fits better.

If you want a ready made option inside Google Docs, Sheets and Slides, my guide to Claude for Google Workspace covers a separate path that takes less effort for most teams. On the developer side, tools such as Claude Code can also work by connecting to MCP servers.

What are the security risks of MCP?

The biggest risk with MCP is not a technical flaw but authority. The assistant uses the permissions of the account it is connected to. If that account is broadly privileged, the assistant works with broad privileges, and one misunderstood command can cause an unwanted deletion or share. The second risk is a server from an untrusted source, since the server sits between the assistant and your data. The third is instructions hidden inside the content the assistant reads, known as prompt injection. A single sentence planted in a customer email, for example, can try to steer the assistant into doing something else.

• Excess authority: An account connected for reading that can also write and delete.
• Untrusted server: Connectors of unclear origin, with no known maintainer.
• Prompt injection: Hidden instructions in a document, email or web page steering the assistant.
• Weak authentication: In the MCP specification, authorization is optional, so it is technically possible to run a server without authentication. Security researchers have reported finding MCP servers exposed to the internet without authentication.
• No logs: Being unable to see which data the assistant accessed and when.

These risks also connect to data leaving the company. The traffic light table in my article on KVKK and AI applies here as well. And employees installing unapproved connectors is the newest form of shadow AI.

How do you manage permissions in MCP?

The core rule of permission management is least privilege: give the assistant the smallest permission it needs to do its job and keep the rest closed. In practice that means connecting the assistant through a separate, restricted service account rather than a person's fully privileged account. Start with read only access. Any action where the assistant can change data, such as creating or deleting a record, sending an email or sharing a file, should pass through a person's approval. Do not add servers at random either. Keep an approved list. The table below is the short checklist I use in consulting work.

This list needs one owner. A permission with no owner becomes a door everyone uses and nobody checks.

When do you not need MCP?

MCP is not necessary for every company or every task. If uploading a file to an assistant once is enough, setting up a connection adds needless weight. If the tool already has a ready AI feature inside it, try that first. If your work is always the same steps, classic automation is both more predictable and easier to audit. If the data is highly sensitive and no one is available to manage permissions, postponing the connection is the right call. A technology being new is not a reason to use it right away.

• When uploading a file is enough for a one time or rare task.
• When the tool you use has a ready, manageable AI feature of its own.
• When the workflow is fixed and the same steps run each time, since automation is enough there.
• When the data is personal or confidential and there is no clear permission owner.
• When the team has not yet settled basic AI use. Literacy first, connections second.

How do you start with MCP in your company?

My advice is to start with one tool and one problem:

1. Pick one use case. For example, the sales team summarizing CRM records. Choose something small enough to measure.
2. Classify the data. If the area you connect holds personal or special category data, clean it first or leave it out of scope.
3. Create a restricted service account. Grant read only access and use an approved server.
4. Run a pilot with five people. Watch the logs, see what the assistant accessed and collect the commands it misread.
5. Review permissions and results. If the benefit is clear and the risk is manageable, move to a second tool, and add write access only with human approval.

If you would like to work out together which tasks in your team benefit from a connected assistant and which permissions are safe, we can build that around your own structure through my consulting work. For a proposal tailored to your team on using connected tools correctly and safely, see the corporate AI training page.