Frequently asked questions about MCP and MCP servers

An MCP server is a program that exposes tools and data sources to AI assistants such as Claude, ChatGPT or Copilot via the Model Context Protocol. The server defines what the AI can do (for example: look up invoices, create an issue), while the AI decides when to use those tools. Read the full explanation at What is MCP?

MCP was introduced in November 2024 by Anthropic (the company behind Claude). In December 2025 the protocol was transferred to the Agentic AI Foundation under the Linux Foundation, co-founded by Anthropic, Block and OpenAI. It is therefore an open standard, not a single vendor's product.

No. All major AI clients now support MCP: Claude (Desktop, Code, claude.ai), ChatGPT (the Apps SDK is built on MCP), Google Gemini, Microsoft Copilot (Studio), Cursor, VS Code and Perplexity. An MCP server you build or choose today works with all of these clients.

An API is an integration you have to program for each application separately; MCP is a universal connector that is built once and then works in every AI client. MCP also describes tools in a way that lets an AI model understand on its own when and how to use them — which solves the N×M integration problem.

MCP is as secure as the servers you allow and the permissions you grant them. The main risks are prompt injection, tool poisoning and overly broad access rights. With curated sources, read-only access and human approval, these risks are well manageable. See Security & watchouts.

The protocol and virtually all servers are free and open source. You do pay for (1) the AI subscription of your client (e.g. Claude or ChatGPT), (2) possibly the underlying service (a Stripe or HubSpot account) and (3) infrastructure if you self-host. For most businesses there are no additional licence costs.

You add local servers via your AI client's configuration (for example claude_desktop_config.json or claude mcp add in Claude Code); remote servers are connected with a URL and signed in via OAuth. Installation documentation is linked per server in our server directory.

Use an existing (official) server if one exists for your software — that is faster and safer. Build your own if you want to expose internal systems or if no trustworthy server exists, which is still often the case for local business software (such as Dutch accounting tools). See Build your own MCP server.

Official means the vendor of the service builds and maintains the server itself (such as GitHub, Stripe or HubSpot). Community servers are built by third parties: often perfectly fine, but you have to assess the quality, maintenance and security yourself. In our directory this is labelled per server.

You can, but only with a GDPR legal basis, data minimisation and a data processing agreement with your AI vendor. Special categories of personal data (such as health data at insurers) come with extra requirements, and a DPIA quickly becomes mandatory. See MCP and EU regulation.

DORA requires financial institutions to inventory and monitor their ICT third parties — including MCP connections and model vendors. The AI Act takes further effect in August 2026; credit scoring and insurance pricing count as high-risk applications, with extra scrutiny from supervisors such as the Dutch AFM and DNB.

Start small and read-only: pick one low-risk use case (for example consulting documents or a calendar), use an official server, and keep human approval on all write actions. Only expand once governance (access rights, logging, GDPR check) is in place. Our tips & tricks provide a concrete step-by-step plan.

A local server runs on your own computer (via stdio) and is suited to personal use; a remote server runs at the vendor (via Streamable HTTP with OAuth sign-in) and is suited to teams. The clear trend in 2026 is towards official remote servers with OAuth.

Both: many servers include write tools (creating a payment, modifying a file, managing infrastructure). That is exactly why we advise starting read-only and keeping write actions behind human approval — most clients support this by default.

Start with your software vendor's official documentation and the official MCP registry (registry.modelcontextprotocol.io). International directories such as PulseMCP and Glama are useful but contain tens of thousands of uncurated entries. Our directory by sector only contains verified servers; see also trusted sources.

The 2026-07-28 release is the biggest revision to date: a stateless core (simpler for servers at scale), an extension framework with MCP Apps and Tasks, stricter OAuth requirements and a formal 12-month deprecation policy. Existing servers keep working; SDK v2 versions are available.

Tool poisoning is an attack where malicious instructions are hidden in an MCP tool's description, causing the AI model to do things the user does not see or want — for example exfiltrating data. It is the number one reason to only install verified servers and to review updates critically.

As soon as employees connect AI assistants to business systems: yes. At minimum an allowlist of approved servers, agreements on access rights and logging, and a GDPR assessment per connection. Without a policy you get shadow IT with AI access to company data — see security and regulation.