AI and Automation

MCP explained for business owners: how AI agents connect to your systems

11 min readBy Davinder Kumar Meen

The Model Context Protocol (MCP) is an open standard that lets an AI application (ChatGPT, Claude, Copilot, a coding tool, or an agent you commission) connect to your systems through one agreed plug instead of a custom integration for every pairing. Its own documentation calls it "a USB-C port for AI applications". Anthropic published it in November 2024; in December 2025 it moved to the Linux Foundation's new Agentic AI Foundation, with AWS, Google, Microsoft and OpenAI among the founding members; and as of October 2026 the major assistants, coding tools and agent frameworks all speak it. For an owner the practical point is this: an MCP server is a small, controllable gateway in front of a system you already run, and the safety of any AI agent project depends on what that gateway is allowed to do.

Key takeaways

  • MCP standardises three things a server can offer an AI application: tools (functions it can call), resources (data it can read) and prompts (templates). Which model is used, and how it reasons, are outside the protocol.
  • The protocol makes nothing safe by itself. The specification says "MCP itself cannot enforce these security principles at the protocol level" and requires that "Hosts must obtain explicit user consent before invoking any tool".
  • Shopify already exposes store policies through an MCP endpoint and has moved catalogue and cart tools to the Universal Commerce Protocol's MCP endpoint. We could not find a first-party Adobe Commerce server in Adobe's documentation as of October 2026, so a Magento store needs one built or bought.
  • The buying questions are about permissions, not models: which tools, read or write, under which account, what is logged, and who approves.

What MCP is, in plain terms

Before MCP, every assistant that wanted to read your order system, CRM or document library needed its own integration, and every system needed one per assistant. The protocol replaces that grid with one interface. The specification describes MCP as "an open protocol that enables seamless integration between LLM applications and external data sources and tools" and says it "takes some inspiration from the Language Server Protocol", which let one code editor support every programming language without a bespoke plugin for each.

Three participants are involved, in the specification's words:

  • MCP host: "the AI application that coordinates and manages one or multiple MCP clients" (Claude, ChatGPT, VS Code, your own agent).
  • MCP client: "a component that maintains a connection to an MCP server", one per server.
  • MCP server: "a program that provides context to MCP clients". This is the piece you or your vendor builds in front of your system.

Servers run in one of two ways. A local server uses the "stdio" transport on the same machine as the application; a remote server uses "Streamable HTTP", "supports standard HTTP authentication methods including bearer tokens, API keys, and custom headers", and the protocol "recommends using OAuth to obtain authentication tokens". Messages are JSON-RPC 2.0. The current specification is dated 28 July 2026 and it changes: that version made the protocol stateless and deprecated an earlier feature ("sampling"), so anything you commission should name the version it targets.

MCP is not a model, not a product and not an agent. It is the socket, and it is free to implement.

What an MCP server exposes

The specification defines three "primitives" a server can offer. The right-hand column is the question an owner should ask about each.

Primitive Specification definition Example for an online store What to ask
Tools "Executable functions that AI applications can invoke to perform actions (e.g., file operations, API calls, database queries)" get_order_status, get_shipment_tracking, later create_return_label Which tools exist, which write, what each is allowed to touch
Resources "Data sources that provide contextual information to AI applications (e.g., file contents, database records, API responses)" The current shipping and returns policy; the product attribute schema What data is readable, by whom, and whether it contains personal data
Prompts "Reusable templates that help structure interactions with language models (e.g., system prompts, few-shot examples)" "Draft a delay apology for order X using policy Y" Who maintains the templates and reviews their wording

A server can also ask the user for input mid-task; the specification calls this "elicitation", "useful when server authors want to get more information from the user, or ask for confirmation of an action". That is the mechanism behind a well-built "are you sure you want to refund this order?" step.

Why it matters when agents touch real systems

Three reasons, in order of importance for a business.

Permissions live in one place. A system's own API usually exposes everything an administrator can do. An MCP server in front of it exposes only the tools you define, under a service account you scope. That is where "an agent with a human in the loop", the model we describe on our AI agents page, is actually enforced.

You are not locked to one assistant. The same server works with every host that implements the protocol. As of October 2026 that includes Claude and ChatGPT (both named on the protocol's own site), VS Code and Cursor, OpenAI's Agents SDK (with a require_approval setting per tool), Google's Agent Development Kit (its McpToolset connects to a server and "discovers its tools"), and Windows, where Microsoft's on-device registry keeps servers "contained in a separate environment by default" with IT-admin control through Intune and audit logging. Change assistant next year and the integration stays.

The standard has a home. On 9 December 2025 the Linux Foundation formed the Agentic AI Foundation with three founding projects: MCP from Anthropic, goose from Block and AGENTS.md from OpenAI. Platinum members include Amazon Web Services, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI. For a business that remembers the enterprise service bus era (see our guide to ESB, APIs and events), this standard is vendor-neutral from the start.

A worked example: order status from a Magento store

This is a design, not a report of a build. It is how we would connect a support assistant to an Adobe Commerce (Magento) store so a support agent can ask "where is order 4821?" and get an answer grounded in the real order.

  1. Pick one question and one system. Order status and shipment tracking from Magento's sales records. Nothing else in scope.
  2. Create a read-only service account in Magento with access to orders and shipments only. The server uses this account; it never sees an administrator token.
  3. Build a small remote MCP server (Streamable HTTP, behind OAuth) exposing two tools, get_order_status(order_number) and get_shipment_tracking(order_number), and one resource, the current shipping and returns policy. Each tool validates its input, calls the Magento REST API and returns a compact JSON result.
  4. Connect the host. The support team's assistant lists the server's tools; on first use the host shows the user what the tool does and asks for approval, as the specification requires.
  5. Watch one conversation end to end. The agent asks, the model selects get_order_status, the host confirms, the server calls Magento, the model writes a reply from the result and the policy resource. If the order number is ambiguous, the server uses elicitation to ask rather than guess.
  6. Log every call: user, tool, arguments, result size, latency. Alert on any call outside the two tools.
  7. Only after weeks of read-only use, consider one write tool (create_return_label) with elicitation confirmation, a daily cap and a kill switch. That is the pilot shape we use for AI agents and workflow automation.

The same pattern applies to a CRM, a help desk or an ERP. The assistant is interchangeable; the server is the asset.

What already exists on common platforms

  • Shopify. The Storefront MCP endpoint is https://{shop}/api/mcp. As of October 2026 Shopify's documentation says the catalogue and cart tools have moved to the Universal Commerce Protocol endpoint at https://{shop}/api/ucp/mcp (search_catalog, lookup_catalog, get_product; create_cart, get_cart, update_cart, cancel_cart), while search_shop_policies_and_faqs remains on /api/mcp. This is the plumbing behind the flows in our agentic commerce guide.
  • Adobe Commerce. We found no first-party MCP server in Adobe's documentation as of October 2026; community and marketplace servers exist. Treat them as evaluation tools and commission a scoped server for production, as above.
  • The official MCP Registry. A public catalogue of servers, in preview, that verifies namespaces through GitHub or DNS. It "delegates security scanning" to package registries and marketplaces; being listed is not an audit.

Security basics for owners

The specification's own security section is the starting point. Its principles: "Users must explicitly consent to and understand all data access and operations"; "Hosts must obtain explicit user consent before invoking any tool"; and tool descriptions "should be considered untrusted, unless obtained from a trusted server". The accompanying best-practices document names the attacks a server builder must design against. The ones to ask about:

  • Least privilege. The document warns against "wildcard or omnibus scopes" and recommends a "minimal initial scope set" with step-up authorisation for privileged operations. Read-only first.
  • Token audience. A server "MUST NOT accept any tokens that were not explicitly issued for the MCP server"; passing a user's token straight through to your backend is an explicit anti-pattern.
  • Confused deputy and state handles. Servers that proxy to third-party APIs must get per-client consent, and a server "MUST NOT treat possession of a state handle as authentication".
  • Local servers. A locally installed server runs with the application's privileges; hosts must "show the exact command that will be executed" before running one. Anthropic's Claude Code documentation adds that it "does not security-audit or manage any MCP server".
  • Prompt injection through data. Order notes, support tickets and web pages that a tool returns are untrusted text; the OWASP Top 10 for LLM Applications lists prompt injection and "excessive agency" as top risks, and both are mitigated at the server (what it can do) rather than in the model.

What to ask a vendor (including us)

  • Which protocol version does the server target, and who updates it when the specification changes?
  • Which tools are exposed, which of them write, and under what account?
  • How is the server authenticated, and does it validate token audience?
  • What is logged per call, where, and for how long? Does personal data pass through?
  • Does the host ask for approval before each write, and can we switch off a tool, or the server, in under a minute?

FAQ

Is MCP something we buy?

No. It is an open, freely implementable protocol now governed by the Linux Foundation's Agentic AI Foundation. What you buy or build is an MCP server for your systems, and possibly an assistant or agent that acts as the host. The protocol itself has no licence fee.

Do we need MCP to use AI agents?

Not strictly; an agent can call your APIs through custom code. MCP matters when more than one assistant or tool will connect to the same system, when you want permissions enforced in one place, or when you want to avoid rebuilding the integration if you change assistant. For most businesses that is the case within a year.

Is it safe to connect our ERP or store to an AI assistant?

It can be, if the server exposes only narrow, read-only tools under a scoped account, the host asks for approval before actions, every call is logged, and the vendor follows the protocol's security best practices (least privilege, token audience checks, no token passthrough). The protocol does not make this happen; the server's design does.

Which AI products support MCP?

As of October 2026: Claude and ChatGPT, VS Code and Cursor, OpenAI's Agents SDK, Google's Agent Development Kit, Microsoft's Windows on-device registry and Agent Framework, and Shopify's storefront endpoints. The protocol's site keeps the current list.

Will MCP still be around in two years?

No standard is guaranteed, but the signals are strong: a neutral foundation with AWS, Anthropic, Google, Microsoft and OpenAI among its platinum members, support in every major assistant, and a public registry. The specification changes between versions, so budget for maintenance as for any API.

Impinge Solutions builds scoped MCP servers and agent pilots on top of Shopify, Magento, Laravel, Node and AWS systems as part of its AI agents service. Pick one workflow for a pilot.

Sources

Are you ready to partner with us?

Our good-natured team is waiting to hear your business requirements.

Book a free project call

Stay informed with our newsletter