The Model Context Protocol (MCP) is an open standard, introduced by Anthropic in 2024, that defines how AI assistants connect to external tools, data sources, and services. It gives the AI ecosystem something APIs have long had: a common interface, so an integration built once works with any assistant that speaks the protocol.
The problem it solves
A language model on its own can only generate text. To do anything useful with your systems — query a database, search a wiki, file a ticket — it needs integrations, and before MCP each one was custom: every assistant needed its own connector to every tool, the classic N-times-M integration explosion. Each vendor’s plugin format was proprietary, so work done for one assistant was wasted for the next.
MCP collapses that to N-plus-M. Tool builders implement one MCP server; assistant builders implement one MCP client; any client can then talk to any server.
How it works
MCP follows a client–server design, with messages exchanged as JSON-RPC. An MCP server is a small program that fronts some capability — a database, a file system, a SaaS product — and advertises what it offers in three flavors: tools (actions the model can invoke, like running a query), resources (content the client can read into context, like a file or schema), and prompts (reusable templates). An MCP client lives inside the AI application, discovers what a connected server offers, and brokers the model’s calls to it. Servers can run locally alongside the assistant or remotely over HTTP.
The protocol standardizes the plumbing — discovery, invocation, results — not the quality of what flows through it. A model connected to a database via MCP can still write a bad query; it just no longer needs a bespoke connector to write it.
What it means for analytics
Data work is a natural fit, and MCP servers exist for many databases, warehouses, and data tools. Connected to one, an assistant can inspect schemas and run queries as part of a conversation — the connective tissue that text-to-SQL and agentic analytics workflows are built on. The same caveats apply as everywhere else in that stack: the model’s answers are only as good as the schema and definitions it can see.
Security is your problem, not the protocol’s
An MCP server exercises whatever access you give it, driven by a model that can be wrong or manipulated — a malicious document can contain instructions that steer a model with tool access (prompt injection). Sensible deployments treat servers like any credentialed service: least-privilege credentials, read-only access for analytical use, audit logs, and real scrutiny of third-party servers before connecting them. The protocol standardizes the connection; it does not vouch for what’s on either end.
Related terms
Put it to work
- LLM analytics — Overview
- LLM observability — Integrations
- Integrations — Integrations
