MCP — Model Context Protocol Explained
Before MCP, connecting an AI model to a tool — a database, a calendar, a CRM, an ERP — required custom integration code. You would write a function, wrap it for your AI framework, and maintain it whenever either side changed. If you switched AI providers, you rebuilt the integration.
MCP changes this. It is an open standard that defines how AI models connect to tools. Build the tool once as an MCP server. Any AI client that supports MCP can use it — without custom code.
Anthropic released MCP in November 2024. By March 2026, it had 97 million monthly SDK downloads, support from every major AI vendor (OpenAI, Microsoft, Google, AWS), and thousands of available servers covering almost every enterprise tool. It is the fastest-adopted infrastructure standard in recent AI history.
🔗 This post builds on
AI Agents — What They Are and How They Work — MCP is the infrastructure layer that makes agent tool use standardised and scalable. If you have not read the agents post, start there.
The problem MCP solves — the M×N problem
Before MCP, every combination of AI model and tool required its own integration. Two AI models and five tools meant ten separate integrations. Five models and twenty tools meant a hundred integrations, each with custom code, custom authentication and custom maintenance.
MCP solves this with a standard interface. An MCP server exposes a tool. An MCP client (the AI model or agent) discovers and calls that tool using the standard protocol. Five models and twenty tools now means twenty-five implementations — not a hundred.
| Without MCP | With MCP |
|---|---|
| Custom integration code for each AI model + tool combination | One MCP server per tool — works with any AI client that supports MCP |
| Switch AI provider = rebuild all tool integrations | Switch AI provider = no change to tools — the MCP server stays the same |
| Each team maintains their own integration patterns | One open standard — shared ecosystem of tools and servers |
| Tool discovery is manual and undocumented | MCP servers self-describe their tools — clients discover them dynamically |
How MCP works — the architecture
Three roles
| Role | What it is | Example |
|---|---|---|
| MCP Host | The application the user interacts with — runs MCP clients internally | Claude desktop app, an IDE with AI features, a custom enterprise app |
| MCP Client | The component inside the host that communicates with MCP servers | The part of Claude that calls tools when needed |
| MCP Server | A lightweight process that exposes tools, resources or prompts via the MCP standard | A server exposing Google Calendar, SAP S/4HANA APIs, a database, or a file system |
What an MCP server exposes
An MCP server can expose three types of capabilities:
| Capability | What it is | Example |
|---|---|---|
| Tools | Actions the AI can invoke — functions that take inputs and return results | search_calendar(date_range), create_task(title, due_date), query_database(sql) |
| Resources | Data sources the AI can read — files, database records, API responses | A user’s emails, a document in a file system, a product catalogue |
| Prompts | Pre-defined prompt templates the AI can use | A structured prompt for summarising a specific document type |
The communication protocol
MCP uses JSON-RPC 2.0 over standard transports (stdio for local servers, HTTP/SSE for remote servers). The client sends requests; the server returns responses. The format is standardised — any compliant client and server can communicate without custom code.
💡 The USB-C analogy
MCP is often described as USB-C for AI tools. Before USB-C, every device had a different connector. After it, one cable worked for everything. MCP does the same for AI tool connectivity — one standard interface, any compatible device.
MCP in 2026 — the state of the ecosystem
| Metric | Status as of March 2026 |
|---|---|
| Monthly SDK downloads | 97 million (Python and TypeScript combined) |
| Public MCP servers | 5,800+ registered — developer tools (1,200+), business applications (950+), data and analytics (600+) |
| AI provider support | Anthropic (creator), OpenAI (April 2025), Microsoft Copilot Studio (July 2025), AWS Bedrock (November 2025), Google — all major providers |
| Governance | Donated to the Agentic AI Foundation (Linux Foundation) in December 2025 — vendor-neutral open standard |
| Enterprise deployments | Production deployments at Fortune 500 companies including Bloomberg, Amazon, Block and hundreds more |
| SAP | SAP is listed as a technology partner in the MCP ecosystem — SAP BTP MCP integration in active development |
📌 Vendor-neutral governance since December 2025
MCP was donated to the Agentic AI Foundation — a directed fund under the Linux Foundation — in December 2025. This means no single vendor controls the standard. It is the same governance model as Linux, Kubernetes and other successful open infrastructure standards. This is a significant signal for enterprise adoption.
Security in MCP — what to know
MCP introduces a new attack surface. An AI agent calling external tools via MCP can be manipulated if a tool returns malicious content — a prompt injection attack where the tool result contains instructions for the AI.
| Security consideration | What it means |
|---|---|
| Tool result trust | Never blindly execute instructions found in MCP tool results — treat them as data, not commands |
| Authentication | MCP servers require authentication — OAuth 2.0 (PKCE for browser clients) is the recommended approach in 2026 |
| Scope and permissions | MCP servers should expose only the minimum tools needed — least privilege applies to tool access too |
| Audit logging | All MCP tool calls should be logged — who called what, when and with what parameters |
| Server verification | In enterprise deployments, only approved MCP servers should be accessible — a whitelist approach |
MCP and SAP — the connection
SAP is part of the MCP technology partner ecosystem. The practical implications are already emerging:
| SAP scenario | MCP application |
|---|---|
| Joule and AI agents in SAP | SAP’s AI tools can call MCP servers to access external tools and data sources — extending beyond SAP’s own systems |
| SAP BTP as an MCP server | BTP APIs and OData services exposed via MCP — any MCP-compatible AI client can call SAP data and operations using the standard protocol |
| Integration Suite + MCP | CPI integration flows can act as MCP servers — exposing integration capabilities to AI orchestration layers |
| Custom SAP AI agents | Developers building agents on SAP AI Core can use MCP to connect to any of the 5,800+ available tool servers without custom integration code |
| Cross-system AI workflows | An agent connecting to SAP via MCP alongside Salesforce, ServiceNow and calendar servers in one workflow — without custom connectors for each |
MCP and A2A — two protocols, two different problems
While MCP handles how agents connect to tools, A2A (Agent-to-Agent protocol, introduced by Google in early 2025) handles how agents communicate with each other. MCP answers: how does my agent call a calendar API or query a database? A2A answers: how does an orchestrator agent delegate a task to a specialist agent on another system?
The two are complementary. A production enterprise AI workflow might use MCP for tool access (an agent calling SAP BTP APIs, searching documents, querying databases) and A2A for agent coordination (an orchestrator breaking a complex task into sub-tasks delegated to specialist agents). As of 2026, MCP has broader adoption and tooling — A2A is gaining momentum, particularly in multi-agent architectures at larger enterprises. Both are worth understanding if you are building or evaluating enterprise AI systems.
MCP vs direct API calls — when to use each
| Situation | Better approach |
|---|---|
| Building an AI agent that needs to call multiple different tools | MCP — one standard, reusable across AI providers |
| A single deterministic API call in a known integration | Direct REST API — simpler, no MCP overhead needed |
| You want to reuse tool integrations across multiple AI clients | MCP server — build once, use with Claude, GPT, Gemini, etc. |
| Real-time integration in a production pipeline with strict SLAs | Direct API may be more appropriate — MCP adds protocol overhead |
| An enterprise tool needs to be AI-accessible for the first time | Build an MCP server — it becomes available to the entire AI ecosystem immediately |
At a glance — MCP essentials
| Concept | One-line summary |
|---|---|
| MCP | Model Context Protocol — open standard for connecting AI models to external tools and data |
| Launched | November 2024 by Anthropic — donated to Linux Foundation (AAIF) in December 2025 |
| Adoption | 97M monthly SDK downloads by March 2026 — all major AI providers support it |
| MCP Host | The application the user interacts with — Claude desktop, an IDE, a custom enterprise app |
| MCP Client | The AI component that calls MCP servers to use tools |
| MCP Server | A process exposing tools, resources or prompts via the MCP standard |
| JSON-RPC 2.0 | The underlying communication protocol — lightweight, standardised |
| The M×N problem | One MCP server per tool works with any AI client — eliminates custom integration per model-tool pair |
| Security | OAuth 2.0 for auth, treat tool results as untrusted data, whitelist approved servers |
| SAP relevance | SAP BTP APIs, OData services and AI Core agents can participate in the MCP ecosystem |
What to take away
MCP arrived quickly and was adopted even faster — partly because it solves a real, felt problem that every team building AI tools was dealing with. The fragmentation of AI tool integration was genuinely painful. One standard changes the calculation.
For anyone working in enterprise AI in 2026 — whether building agents, deploying AI platforms, or integrating AI capabilities into SAP landscapes — MCP is the infrastructure layer worth understanding now. The ecosystem is large, the standard is governed neutrally, and the adoption curve suggests it is the direction this space is settling on.
For SAP architects and consultants specifically: the implication is that AI agents will access SAP systems through MCP the same way they access any other enterprise tool — through a standardised server that exposes SAP BTP APIs, OData services and business operations. The SAP knowledge you have built — understanding the data models, the business processes, the integration points — becomes the guide for what those MCP servers should expose and what guardrails they should have. The technology is new. The domain expertise that makes it useful is not.
🔗 Related posts on this site
AI Agents — What They Are and How They Work — agents use MCP to connect to tools — these two posts are the sequence. REST API Design Principles — MCP servers expose REST-like interfaces — the API design principles apply. API Security Essentials — OAuth, least privilege and input validation apply directly to MCP server security. SAP BTP — The Platform Explained — the SAP platform that will participate in the MCP ecosystem via BTP APIs and AI Core.
Published on rakeshnarayan.com — Articles
URL: https://rakeshnarayan.com/articles/mcp-model-context-protocol/
