- MCP is an open standard, introduced by Anthropic in November 2024, for connecting AI models to real tools and data. The docs call it a USB-C port for AI. [1]
- It replaces bespoke, per-vendor integrations with one interface: each system exposes an MCP server, each AI app speaks MCP once. [2]
- Adoption is broad. OpenAI joined in March 2025 [5], and in December 2025 Anthropic made it vendor-neutral under the Linux Foundation. [3]
- It opens a new security surface. Researchers documented prompt injection and poisoned tools that exfiltrate data across connected tools. [5]
- For marketing ops the question shifts from which AI vendor to which tools and data you expose, and how tightly you scope them. [3]
Your AI assistant can write a campaign brief. It cannot pull last week's ROAS, check which segment is churning, or stage a budget change, because it has no hands. The Model Context Protocol (MCP) is how you give it hands. MCP is an open standard for connecting AI models to the tools and data where your marketing actually lives, and in the space of a year it has gone from an Anthropic side project to the default way agents reach the rest of the stack.
Anthropic introduced it in November 2024 as an open standard for connecting AI assistants to the systems where data lives. [1] The docs reach for a deliberately boring analogy: a USB-C port for AI applications. [2] Before USB-C, every device needed its own cable. MCP is the one shape meant to fit the analytics warehouse, the CRM, the ad platform, and the CMS alike.
The reason it caught on is arithmetic.
Wire five AI apps to five systems by hand and you are maintaining 25 bespoke integrations, each one custom, each one breaking when an API changes. Every new assistant re-implements the same CRM, analytics, and ad-platform connectors from scratch. The cost grows with the product of both sides, so the stack ossifies fast and nobody wants to add the sixth tool.
Each system exposes one MCP server. Each AI app speaks MCP once. That is five plus five connections, not five times five. Swap Claude for ChatGPT, or add a new agent, and the servers it needs already exist and keep working. The integration cost grows by addition, not multiplication, which is the whole point.
Under the hood MCP is a client-server protocol, and the exchange follows a fixed order. The AI application is the host. Inside it, an MCP client opens a connection to each MCP server it needs, over standard input-output (stdio) for a local process or HTTP for a remote one. [2]
Connect
The host starts an MCP client for each server it wants to reach: an analytics server, a CRM server, an ad-platform server. Local servers run over stdio, remote ones over HTTP. [2]
Negotiate
Client and server exchange what each supports, then the server advertises its capabilities: the tools, the data resources, and any prompt templates it offers. [6]
Discover
The client lists the available tools and hands their names and descriptions to the model. The model now knows it can, say, read campaign performance or update a budget.
Capabilities listingCall
The model issues a tool call with structured arguments. The server runs the real action against the live system, under its own credentials.
Return as context
The server sends structured content back. The model reads live numbers, not stale training data, and proposes the next step or waits for a human to confirm the write. [2]
What a server advertises is a list of tools, each one a small, typed contract. A good marketing tool is narrow and read-only by default, with a description tight enough that the model knows exactly when to reach for it.
{
"name": "get_campaign_performance",
"description": "Read-only. Returns ROAS, CPA, and spend for one campaign.",
"inputSchema": {
"type": "object",
"properties": {
"campaign_id": { "type": "string" },
"start_date": { "type": "string", "format": "date" },
"end_date": { "type": "string", "format": "date" }
},
"required": ["campaign_id", "start_date", "end_date"]
}
}
The description is not decoration. The model uses it to decide which tool to call, so a vague name and a loose scope produce both bad decisions and unsafe ones. Keep write actions in separate, clearly labeled tools.
The land grab is mostly over. OpenAI adopted MCP in March 2025 [5], and by 2026 it is described as the de facto protocol for connecting AI to tools, with support across Google, Microsoft, the major cloud platforms, and the agent frameworks marketers build on. [3] In December 2025 Anthropic handed the standard to the Agentic AI Foundation under the Linux Foundation, which now governs it as vendor-neutral. [3]
Scale is harder to pin down honestly. One community registry lists more than 2,000 open-source MCP servers, and the Python and TypeScript software development kits (SDKs) are reported at roughly 97 million monthly downloads. [8][3] Neither figure traces to primary telemetry, so read them as a signal of momentum rather than an audited count. The direction is clear enough: a US Department of Defense security note already describes MCP in use across multiple industries, from finance to software [7], and you should expect MarTech vendors to ship MCP endpoints as table stakes, the same way they once shipped a REST API.
Here is the part your security model is not ready for. Every MCP server is a new privileged surface, separate from the API perimeter you already guard. The Coalition for Secure AI puts it flatly: MCP introduces fundamentally new security considerations. [6]
Researchers documented the concrete failure modes early. By April 2025 there were reports of prompt injection and poisoned tools that let one connected tool exfiltrate data through another. [5] The marketing version writes itself: a reporting tool with broad read access, plus a messaging tool, can be chained by an injected instruction to ship a sensitive audience off-platform. Remote servers lean on OAuth 2.1 with PKCE and scoped tokens [3][4], but a token is only as tight as the scope you grant it, and too many tools also degrade the model's reasoning, so a loose manage_campaign tool is both a security hole and a quality problem. [6]
Scope each tool to least privilege and split read from write. Give different agents different tool sets, so a copywriting assistant cannot move money. Log tool invocations, not just API calls, because that is where real actions happen. Harden tool descriptions and inputs against prompt injection as a security task, not a UX one.
That discipline is the same one already emerging on teams wiring agents into ad operations, where a mis-scoped action does not just return a wrong answer, it spends a budget. It is also why keeping a human in the loop on every write stays the sane default while the tooling matures.
MCP does for AI integration roughly what REST did for web services: a shared vocabulary that makes systems interoperable by default. [8] For marketing operations that lands as a real change of ownership. The work moves from picking a vendor to designing servers, naming tools, and scoping permissions, which is closer to owning an API than owning a chatbot. Get the wiring right and your agents run on live performance data and current audiences. Get it wrong and you have handed a language model a set of keys with no idea which doors they open.
Sources
- Anthropic · Introducing the Model Context Protocolthe November 2024 announcement of MCP as an open standard
- Model Context Protocol · What is MCP?the USB-C analogy, client and server roles, transports
- WorkOS · Everything your team needs to know about MCP in 2026Linux Foundation donation, OAuth 2.1 with PKCE, the ~97M SDK downloads figure (secondary, no primary telemetry)
- Model Context Protocol · The 2026-07-28 MCP Specification Release Candidatethe 2026-07-28 specification release candidate; stateless core and authorization aligned with OAuth and OpenID Connect
- Wikipedia · Model Context ProtocolOpenAI adoption in March 2025, and the April 2025 prompt-injection and poisoned-tool research
- Coalition for Secure AI · Model Context Protocol (MCP) Securitynew security considerations, capability negotiation, tool-design risks
- U.S. Department of Defense · CSI: Model Context Protocol Securityadoption across multiple industries and session-management risk
- DevstarsJ · Model Context Protocol: the complete guidethe REST analogy and the 2,000-plus community server count (secondary, no primary registry data)
Frequently asked questions
What is the Model Context Protocol in plain terms?
MCP is an open standard, introduced by Anthropic in November 2024, for connecting AI models to the tools and data where your work lives. The official docs call it a USB-C port for AI applications: one shape that fits your analytics warehouse, CRM, ad platform, and CMS alike, instead of a custom cable for each. An AI app runs an MCP client, each system runs an MCP server, and the model can then list and call the tools that server exposes.
Why does MCP matter for a marketing team specifically?
It changes an LLM from something that drafts copy into an agent that can pull live campaign performance, query a segment, or stage a budget change. Instead of building a bespoke integration for every combination of AI tool and data source, you expose each system once as an MCP server and reuse it across every agent. The practical shift is that the question stops being which AI vendor you pick and becomes which tools and data you expose, and how tightly.
Is MCP a security risk?
It creates a new privileged surface separate from your API perimeter. Security researchers have documented prompt injection and poisoned tools that let one connected tool exfiltrate data through another, and the Coalition for Secure AI states plainly that MCP introduces fundamentally new security considerations. Remote servers use OAuth 2.1 with PKCE and scoped tokens, but a tool is only as safe as its scope. Treat each server as least-privilege, split read from write, and log tool calls, not just API calls.
How widely is MCP actually adopted?
OpenAI adopted MCP in March 2025, and by 2026 it is described as the de facto protocol, with support across Google, Microsoft, the major clouds, and the main agent frameworks. In December 2025 Anthropic handed it to the Agentic AI Foundation under the Linux Foundation, making it vendor-neutral. Registry and download counts circulate (2,000-plus servers, roughly 97 million monthly SDK downloads) but do not trace to primary telemetry, so read them as momentum, not audited figures.
How is MCP different from just giving an AI access to an API?
The difference is arithmetic. Wire five AI apps to five systems by hand and you maintain 25 bespoke integrations, each one breaking when an API changes. With MCP each system exposes one server and each AI app speaks the protocol once, so connections grow by addition rather than multiplication. The docs frame it as a USB-C port for AI, and a common comparison is to what REST did for web services: a shared vocabulary that makes systems interoperable by default.
What makes a good MCP tool definition?
A good tool is a small, typed contract: narrow, read-only by default, with a description tight enough that the model knows exactly when to reach for it. The model uses that description to decide which tool to call, so a vague name and a loose scope produce both bad decisions and unsafe ones. Keep write actions in separate, clearly labeled tools rather than bundling them into one broad action.
Do marketers need engineers to adopt MCP, or can they set it up alone?
Adopting MCP looks less like owning a chatbot and more like owning an API. The work moves to designing servers, naming tools, and scoping permissions, which are engineering tasks, not copywriting ones. The practical shift for a marketing team is that the question stops being which AI vendor you pick and becomes which tools and data you expose, and how tightly you scope them.
What is the most common mistake teams make with MCP?
Granting tools more scope than they need. A loose manage_campaign tool is both a security hole and a quality problem, because too many broad tools also degrade the model's reasoning. The fix is to scope each tool to least privilege, split read from write, give different agents different tool sets, and log tool invocations, not just API calls.
What transports does MCP use to connect a client and a server?
Two. A local server runs over standard input-output (stdio), where the AI application launches the server as a subprocess on the same machine. A remote server runs over HTTP, reached across the network. The AI application is the host. It starts an MCP client for each server it wants to reach, and the two negotiate what each supports before the server advertises its tools, data resources, and prompt templates. The transport is a detail. The perimeter it opens is not, because a remote server is a privileged surface separate from your API perimeter.
What changed when Anthropic handed MCP to the Linux Foundation?
In December 2025 Anthropic donated the standard to the Agentic AI Foundation under the Linux Foundation, which now governs it as vendor-neutral. Practically, that is why you can treat MCP as infrastructure rather than one vendor's format: OpenAI had already adopted it in March 2025, and by 2026 it is described as the de facto protocol with support across Google, Microsoft, the major clouds, and the main agent frameworks. Vendor-neutral governance is what lets you swap the model behind your agents without re-plumbing every connection.
Should I let an MCP agent perform write actions?
Only through separate, clearly labeled, tightly scoped tools, and with a human on the confirm step while the tooling matures. A good tool is read-only by default, so keep any action that spends budget or changes a live system out of the broad reporting tools and behind its own narrow contract. The reason is concrete: researchers documented prompt injection and poisoned tools that chain a broad read tool and a messaging tool to exfiltrate data, and a mis-scoped write in ad operations does not just return a wrong answer, it spends money.
Mikołaj Salecki
Writes about media, tech, and AI business for people who actually run digital. Former agency lead. Skeptic of frameworks that read better than they perform.
Get the next issue by email.
One letter, once a week. Sharp coverage of media, tech, and AI business. No filler.
