--- title: "What an MCP server is, and when you need one | All Stack Labs" description: "What the Model Context Protocol is, who supports it, how authorization and security work, and when your product needs an MCP server." url: "https://allstacklabs.com/blog/what-an-mcp-server-is-and-when-you-need-one/" --- # What an MCP server is, and when you need one. Your customers' AI tools can now act inside your product. An MCP server decides what they can do there. All Stack Labs, 12 October 2026 Anthropic released the Model Context Protocol in November 2024 as an open standard for connecting AI assistants to the systems where data lives. A year later it had been adopted across the industry and handed to the Agentic AI Foundation, a fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. By then its official SDKs were being downloaded more than 97 million times a month. If your customers use Claude, ChatGPT, Gemini, Copilot or Cursor, MCP is how those tools can work inside your product on their behalf. An MCP server is the piece you build to let them in. ## What it is An MCP server sits in front of your product and tells an agent what it can do there. It offers three kinds of things: - Tools. Actions the model can take, like creating an invoice or searching orders. - Resources. Data the model can read, like a document or a customer record. - Prompts. Ready-made workflows a user can pick, like "summarise this account". A server can run locally, as a program on the user's machine, or remotely, over HTTP. Remote is what most products want: nothing for the customer to install, and you control the deployment. The latest revision of the spec, from July 2026, made the protocol core stateless, so a remote MCP server now runs like any other web service, behind your usual load balancers. ## Who already ships one Many of the tools your customers use every day have official servers. Stripe, GitHub, Atlassian, Linear and Notion all publish one. On the client side, MCP works in Claude, in ChatGPT, in Google's Gemini CLI, in Microsoft Copilot and VS Code, and in Cursor. ## The permissions are the product Most of the work is in the permissions. For remote servers, the spec builds on OAuth 2.1. The server publishes how clients should authorise against it, clients must use PKCE, and the server must check that every token was issued for it and must never pass a client's token on to another service. The best servers go further. Stripe's server asks a person to confirm actions like refunds and outbound payments, and from 31 October 2026 it stops accepting full-access secret keys or any restricted key that is not tagged for agents. That is the pattern to copy: narrow scopes, separate credentials for agents, and a human step for anything that moves money or deletes data. ## What can go wrong - Tool poisoning. Researchers at Invariant Labs showed instructions hidden in a tool's description, invisible to users but visible to the model. A server can also change its descriptions after a user has approved it. - Prompt injection through data. In another demonstration, a public GitHub issue led an agent to leak data from private repositories. The server code was not at fault. The agent trusted what it read. - Fake servers. In September 2025, researchers found a package posing as a Postmark MCP server that quietly copied every email it sent to an attacker. - Scopes that are too broad. The spec's own security guidance warns against offering every possible scope and handing clients all of them. OWASP has published a beta MCP Top 10 that includes scope creep, tool poisoning and prompt injection. The common thread: your server may be running next to untrusted ones, in the same conversation. Enforce permissions on your side, on every call, and never rely on the model to behave. ## When your product needs one - Your customers already work in AI tools. If they paste your data into ChatGPT or Claude today, they will want an agent to fetch it and act on it directly. - Your product has work worth delegating. Creating, updating, searching, reporting. Anything a user does in ten clicks is a candidate for one request. - Your competitors are shipping theirs. When an agent picks a tool to finish a task, it can only pick products it can reach. - You have an API, but it was built for developers. Agents need tools shaped around tasks, with descriptions they can follow. You probably do not need one yet if your product has no API, or if nothing in it is safe to delegate without a person checking each step. ## How we build them Start with the tasks, not the endpoints: what should an agent be able to do for your users, and what should it never do. Design a small set of typed tools around those tasks, write descriptions a model can follow, and put every permission check on the server. Then test it the way agents will use it, across the clients your customers have, and publish it under a domain you control so nobody can pass off a copy as yours. ## Start with the permissions AI tools are becoming one of the ways your customers use software. An MCP server decides what those tools can do in yours, so design its permissions first and build the tools around them. ## Sources 1. [Anthropic, Introducing the Model Context Protocol (2024)](https://www.anthropic.com/news/model-context-protocol) 2. [Anthropic, Donating the Model Context Protocol and establishing the Agentic AI Foundation (2025)](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation) 3. [Model Context Protocol specification](https://modelcontextprotocol.io/specification/latest) 4. [MCP Blog, the 2026-07-28 specification release (2026)](https://blog.modelcontextprotocol.io/posts/2026-07-28/) 5. [MCP specification, Authorization (2026)](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization) 6. [MCP documentation, Security best practices (2026)](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) 7. [Stripe, Model Context Protocol documentation](https://docs.stripe.com/mcp) 8. [GitHub, Remote GitHub MCP server is now generally available (2025)](https://github.blog/changelog/2025-09-04-remote-github-mcp-server-is-now-generally-available/) 9. [Atlassian, Rovo MCP Server is now GA (2026)](https://www.atlassian.com/blog/rovo/atlassian-rovo-mcp-ga) 10. [Linear, MCP server (2025)](https://linear.app/changelog/2025-05-01-mcp) 11. [Notion, Notion MCP](https://developers.notion.com/docs/mcp) 12. [Google, Introducing Gemini CLI (2025)](https://blog.google/technology/developers/introducing-gemini-cli-open-source-ai-agent/) 13. [GitHub, MCP support in VS Code is generally available (2025)](https://github.blog/changelog/2025-07-14-model-context-protocol-mcp-support-in-vs-code-is-generally-available/) 14. [Invariant Labs, MCP security notification: tool poisoning attacks (2025)](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) 15. [Invariant Labs, GitHub MCP exploited: accessing private repositories via MCP (2025)](https://invariantlabs.ai/blog/mcp-github-vulnerability) 16. [The Hacker News, First malicious MCP server found (2025)](https://thehackernews.com/2025/09/first-malicious-mcp-server-found.html) 17. [OWASP, MCP Top 10](https://owasp.org/www-project-mcp-top-10/) Related [AI infrastructure](https://allstacklabs.com/services/ai-infrastructure/) [Book a strategy call](https://allstacklabs.com/contact/) ## Make your product ready for agents. List what an agent should be able to do in your product. We'll design the tools and the permissions. [Book a strategy call](https://allstacklabs.com/contact/) [hello@allstacklabs.com](mailto:hello@allstacklabs.com) --- All Stack Labs LLC. hello@allstacklabs.com. (508) 505-4961. Book a strategy call: https://allstacklabs.com/contact/