The Model Context Protocol (MCP) is an open standard that lets AI apps such as Claude and ChatGPT connect to outside tools and data through one shared interface. Anthropic introduced it on November 25, 2024, and since December 2025 it has been governed by the Agentic AI Foundation, a fund under the Linux Foundation. For a marketer, MCP is the reason an assistant can read your ad account, check your analytics property or look up a CRM record instead of guessing. It can't make an assistant right about what it reads, though, so people still review the answers.
- MCP is a shared plug standard between AI apps and the systems they need, such as analytics, ads, CRM and project tools.
- An AI app (the host) runs one client per server, and each server exposes tools, resources and prompts.
- It isn't the same as an API: MCP sits on top of APIs and describes them in a form a model can discover and call.
- Claude and ChatGPT both support remote MCP servers, and both ask before write actions.
- The risk is real: custom servers are not verified by the vendors, so check scopes, approvals and the source before you connect.
- MCP introduced by Anthropic
- Nov 2024
- core server primitives
- 3
- transports: stdio and Streamable HTTP
- 2
- latest spec revision, 2026-07-28
- Jul 2026
What is the Model Context Protocol (MCP)?#
MCP is an open-source standard for connecting AI applications to external systems, according to the official documentation. Using it, an app like Claude or ChatGPT can reach data sources such as local files and databases, tools such as search engines and calculators, and workflows such as specialized prompts. The documentation compares it to a USB-C port: one standard connector instead of a different cable for every device.
Anthropic open-sourced the protocol on November 25, 2024. It was created at Anthropic by David Soria Parra and Justin Spahr-Summers. The launch bundled the specification and SDKs, local server support in the Claude Desktop apps and a repository of ready-made servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer.
On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. The Linux Foundation now hosts the project, so it is maintained through the foundation's open process, and no single AI vendor controls the specification anymore. That matters for a buyer.
The problem MCP solves is a multiplication problem. Without a standard, every AI app needs a custom connector for every system, so five apps and ten systems means fifty integrations. With MCP, each system ships one server and each app ships one client. If you want the background on the function that owns these systems, read our guide to what marketing operations is.
How does MCP work?#
An MCP host, which is the AI application you use, creates one MCP client for each MCP server it connects to. The server is a program that provides context: it can run on your own machine or at a remote address. The client asks the server what it offers, the host passes that menu to the language model, and the model decides when to call something.
The architecture overview describes two layers. The data layer is a JSON-RPC 2.0 protocol for discovery, tools, resources, prompts and notifications. The transport layer carries those messages, and there are two: stdio for servers running locally on the same machine, and Streamable HTTP for remote servers, which supports standard authentication and recommends OAuth.
- Step 1You askExample Is our webinar form still sending leads to the CRM?
- Step 2Host picks a toolBehind the scenes The model sees the tool list the client fetched with tools/list.
- Step 3Client calls the serverBehind the scenes A tools/call request goes out with the arguments the model chose.
- Step 4Server talks to the systemWhere it breaks An expired token or a renamed field returns an error, not an answer.
- Step 5Result comes backYou see The assistant summarizes the result and asks before it changes anything.
Servers can expose three kinds of capability, called primitives:
| Primitive | What it is | Marketing example |
|---|---|---|
| Tools | Functions the model can call to act or query | Run a campaign performance query, create a CRM task |
| Resources | Data that gives the model context | A tracking plan document, a table schema |
| Prompts | Reusable templates for an interaction | A weekly campaign review template |
Clients can also expose elicitation, which lets a server ask you for more input or a confirmation. Discovery is dynamic: a client calls tools/list to see what exists, so a server can add a tool without every user updating anything.
MCP vs API, RAG and function calling#
An API is the interface of one system, while MCP is a shared protocol that AI apps use to discover and call many systems. Most MCP servers call an API underneath. What MCP adds is a model-readable description of what each tool does and which inputs it takes, so a model can pick the right one without a developer hard-coding the choice.
| Concept | What it does | How it differs from MCP |
|---|---|---|
| API | Exposes one system's functions to software | Written for developers and fixed code. MCP wraps APIs in tool descriptions a model can choose from. |
| RAG (retrieval-augmented generation) | Retrieves text and adds it to the prompt | Reads only. MCP can also perform actions through tools. |
| Function calling | Lets a model call functions defined in one app | Specific to that app's code. MCP makes the same tool usable across many apps. |
| Plug-ins | A vendor-specific way to extend one assistant | Needed vendor-specific connectors. MCP is vendor-neutral. |
You can use both, and many setups do. The practical rule: use RAG when the assistant only needs to read a body of text, and use MCP when it needs live data or the ability to act. Each has a limit. RAG can't change anything in your systems, and an MCP tool call only works as far as the permissions you grant it.
Which AI apps support MCP?#
Claude and ChatGPT both support MCP. The official documentation lists AI assistants such as Claude and ChatGPT and development tools such as Visual Studio Code and Cursor. Support came in stages, as the table below shows.
| Date | What happened |
|---|---|
| November 25, 2024 | Anthropic open-sources MCP |
| March 2025 | OpenAI announces it will adopt MCP, starting with its Agents SDK |
| December 9, 2025 | Anthropic donates MCP to the Agentic AI Foundation |
| January 2026 | MCP Apps, an official extension for interactive interfaces inside hosts such as Claude and ChatGPT |
| July 28, 2026 | The 2026-07-28 revision of the specification is finalized |
The adoption dates for OpenAI and for MCP Apps come from secondary reporting summarized on Wikipedia, so treat the exact days as approximate. The point for a buyer is simpler: the two assistants most marketing teams already use can talk to the same servers.
What can marketers do with MCP?#
Marketers use MCP to let an assistant read from and, with approval, act on the systems campaigns run on. The official documentation describes agents that access a Google Calendar and Notion, and enterprise chatbots that query several databases through chat. In a marketing stack the same idea looks like the table below.
| Workflow | Example server | Typical access | Approval point |
|---|---|---|---|
| Ad performance questions | Google's Google Ads MCP server | Reads: lists accessible accounts and runs Google Ads Query Language searches for metrics, budgets and status | Reporting queries, nothing to approve |
| Analytics checks | Google's experimental Google Analytics MCP server | Reads: account summaries and real-time reports through the Admin and Data APIs | Reporting queries, nothing to approve |
| CRM lookups and updates | HubSpot's remote MCP server | Reads and writes CRM records, depending on what you authorize | Approve each write |
| Campaign status and incidents | The Marketing Ops Manager | Reads checks of landing pages, tracking, forms and CRM handoffs | Fixes need a human approver |
Setup effort differs. Google's Ads server runs locally and needs a developer token, a Google Cloud project and a credentials file, so expect an engineer or an ops owner to set it up once. HubSpot's developer documentation describes a hosted remote server that powers its connectors for Claude, Microsoft Copilot, Gemini and ChatGPT, which is closer to a click-through setup.
Three habits make these workflows hold up, and they are listed next.
- Start read-only. Ask questions before you let an assistant change a record.
- Give the assistant one narrow job, such as "list campaigns where spend continued after the landing page returned an error," rather than open access to everything. That's easier to review and easier to trust.
- Keep a person on every write. An assistant that fixes the wrong tracking tag at speed is worse than a slow one.
If you are choosing the systems themselves first, our roundup of marketing operations software compares the tools that sit in this stack.
How do you connect an MCP server to Claude or ChatGPT?#
In Claude you add a custom connector with the server's URL; in ChatGPT you add a custom MCP server in the plugins area. Both then send you through the service's own sign-in. Claude's help center says custom connectors are available on the Free plan (limited to one), Pro, Max, Team and Enterprise.
Get the server URL from the vendor
Use the vendor's own documentation, not a link from a forum post. You need the remote MCP server address and to know whether it signs in with OAuth or an API key.
Add it in Claude
On Pro and Max, go to Customize, then Connectors, choose Add, then Add custom connector. Enter a name and the URL, review the detected authentication settings and pick how people sign in. On Team and Enterprise, an owner adds the connector under organization settings and members then connect individually.
Or add it in ChatGPT
Use Add custom MCP server in the ChatGPT plugins area, enter the URL and authentication details, then create it as a plugin. OpenAI recommends OAuth. Check which ChatGPT plans can add custom servers, because that depends on your workspace.
Turn it on and trim the tool list
In Claude, switch the connector on per conversation from the plus menu and use the tools menu to disable tools you don't want the assistant to use, especially anything that writes.
Test with a read-only question
Ask something you already know the answer to, and confirm the answer matches the source system before you rely on it.
One detail surprises people: Claude's connections originate from Anthropic's cloud, not from your laptop. A server on a private network or behind a VPN needs Anthropic's IP addresses allowlisted before it can connect.
Is MCP safe? Risks and a checklist before you connect#
Yes, if you connect vetted servers with narrow permissions and approvals; no, if you add unknown servers with broad write access. MCP is as safe as the server you connect and the permissions you grant. Anthropic's help center states that custom connectors are not verified by Anthropic, and that Claude can read, modify or delete data in connected services based on the permissions you give it. OpenAI's documentation says the same about custom MCP servers: they are not developed or verified by OpenAI, and prompt injection is a key risk.
The specification's own security best practices list the main failure modes for implementers: confused deputy attacks on proxy servers, token passthrough (forbidden), server-side request forgery, local servers that run commands on your machine, and over-broad OAuth scopes. Real flaws have shipped too. In July 2025, JFrog disclosed CVE-2025-6514 in the mcp-remote tool, rated 9.6 on the CVSS scale, where a malicious server could run commands on a user's machine; it was fixed in version 0.1.16.
- The server comes from the system's vendor or a source your security team has reviewed
- You know whether it runs locally on your machine or remotely at a URL
- You know every tool it exposes, and you disabled the ones you don't need
- It uses OAuth with narrow scopes, not one broad key shared by the whole team
- Write tools ask for approval every time, and you didn't choose Allow always
- You tested it with a read-only question first
- You know how to revoke access: disconnect the connector and revoke it in the source system
- Someone owns the connector and will recheck the tool list after server updates
Server developers can change tool behavior without notice, so the last item isn't a formality. A tool list that was safe in March can look different in October.
What changed in the 2026-07-28 MCP revision?#
The 2026-07-28 revision, finalized on July 28, 2026, makes MCP stateless at the protocol level. Each request now carries the protocol version and the client's capabilities in its own _meta field, so a server can handle a request without remembering earlier ones. A new server/discover request lets a client ask a server what versions and capabilities it supports. This answers the common question of whether MCP is outdated: no, unless your server still targets an older revision. It is a young standard that is being actively reworked, not an abandoned one.
| Change | What it means in plain terms |
|---|---|
| Stateless requests | Servers are easier to run behind load balancers and at scale |
server/discover | Clients can check what a server supports before using it |
| Sampling, roots, logging deprecated | Features stay in the spec but new servers should not use them |
| Dynamic client registration deprecated | Replaced by Client ID Metadata Documents for sign-in |
| Tasks moved to an extension | Long-running operations are optional, not core |
| MCP Apps extension | Servers can show interactive interfaces inside the assistant |
Deprecated features remain in the specification, and the earliest any of them can be removed is the first revision released on or after July 28, 2027. The revision is not fully backward compatible, though. A server on the new revision may not work with an older client, and the reverse. If you use official servers from vendors, they handle the upgrade. If your team built its own server, plan engineering time for it.
Where MCP fits in a marketing ops stack#
MCP doesn't replace any tool in your stack. It is the layer that lets an assistant reach them, and that creates a new gap: an assistant can read every system, but nobody is watching the connections between them. A landing page that loads, a form that submits and a CRM that syncs can still add up to leads that never arrive, because a tracking event stopped firing after a tag manager publish.
The Marketing Ops Manager monitors that gap. It checks landing pages, tracking, forms, CRM connections and sales handoffs on a schedule, opens an incident with evidence when a step fails, and works through Claude, ChatGPT or any MCP client. It is read-only by default and every write needs human approval. Signup is currently invite-only.
FAQ#
Does ChatGPT use MCP?
ChatGPT does use MCP. OpenAI announced in March 2025 that it would adopt MCP, and its documentation now describes connecting remote MCP servers to ChatGPT. It requires manual confirmation before write actions run.
What is the difference between an API and MCP?
The difference between an API and MCP is scope. An API is the interface of one system, while MCP is a shared protocol that lets an AI app discover and call many systems through descriptions a model can read. Most MCP servers call an API underneath.
What is the difference between MCP and RAG?
The difference between MCP and RAG is that RAG retrieves text and adds it to the prompt, so it reads only. MCP can also run tools that act on a system, such as updating a record. Many setups use both.
Is the Model Context Protocol free to use?
The protocol is open source and free. Individual servers and the systems behind them can carry their own costs, and your AI plan decides how many custom connectors you can add.
Is MCP outdated?
MCP is not outdated. The specification was revised as recently as July 28, 2026, with stateless requests and a discovery request. The revision is not fully backward compatible, so older servers and clients may need updates.
Do I need to code to use MCP?
You do not need to code to use MCP. Adding a remote server to Claude or ChatGPT takes a URL and a sign-in. Building your own server, or setting up a local one such as Google's, does take technical help.