Most firms already pay for email, a ledger, a CRM, and a file store. The assistant sits beside those tools and cannot see them. Anthropic open-sourced the Model Context Protocol on 25 November 2024 so teams can connect an AI assistant to systems where data already lives, instead of waiting for a custom pipe per app. The useful question is not how to build a connector. It is which paid tools deserve a plug, and which actions must still wait for a person.
McKinsey’s State of AI 2026 survey is the why. Eighty per cent of respondents say AI improved their own productivity. Only 37 per cent attribute any EBIT impact to AI use, unchanged from a year earlier. Personal chat with a paste of last week’s numbers is the 80 per cent. A connection into the tools you already pay for is how that work stops dying in a side window.
What a connection actually is
The Model Context Protocol specification dated 28 July 2026 names three roles. A host is the assistant app the person is using. A client is the connector inside that app. A server is the service that offers context and tools, such as a file store or a ticket queue. JSON-RPC carries the messages. The point of a standard is that you do not write a new dialect for Slack, then another for GitHub, then another for Postgres.
Anthropic’s launch note listed pre-built servers for Google Drive, Slack, GitHub, Git, Postgres, and Puppeteer. Those names are examples of systems firms already pay for, not a shopping list. Block and Apollo were named as early adopters. Zed, Replit, Codeium, and Sourcegraph were named on the developer-tools side. Treat that as a sign the protocol left the lab, not as a reason to wire every app on day one.
The dispatch desk in the hero is the working picture. The radio, the clipboard, and the screen are already in the room. The clerk does not need a fourth device. They need the three they already own to answer the same question. Connecting an AI assistant is that problem, restated for software.
Why a standard beats another custom pipe
Anthropic’s announcement put the cost in plain language. Every new data source used to need its own implementation. Models stayed trapped behind silos. A protocol replaces that pile of one-offs with one way to share context and expose tools. The specification is explicit that this is closer to how the Language Server Protocol standardised language support across editors than to a product feature inside one vendor’s chat window.
That matters for a small team because you already pay for the source of truth. The CRM is the pipeline. The ledger is the books. The drive is the contract file. A second copy pasted into a chat is a stale copy. Connecting an AI assistant to those tools is a way to stop the stale copy, not a way to buy a new stack. Digital transformation for SMEs is the same rule in a broader frame. Document the work you already do, then let software do the boring middle.
Gartner’s C-suite AI survey, published 1 September 2026 from 1,303 respondents at firms with at least $50 million in revenue, finds that only 22 per cent of organisations have successfully scaled AI across multiple business units. Scaling is not the same as plugging one inbox. It is a reminder that a connection is a control decision, not a trophy. One paid tool, one allowed action, one named reviewer is a complete first job.
What to connect first, and what to leave alone
Start with a read. A folder of closed contracts. A ticket queue you already triage. A product catalogue that staff already search by hand. The specification splits what a server can offer into resources (data), prompts (templated workflows), and tools (functions the model may execute). Resources are the conservative first step. Tools are where unsupervised action lives.
Do not start with send, pay, or post. The specification’s security section is not optional colour. Users must consent to data access and to operations. Hosts must obtain consent before invoking a tool. Tool descriptions are untrusted unless they come from a trusted server. NIST’s generative AI profile flags human-AI configuration, including over-reliance, as a live risk. A connected assistant that posts to the ledger because the prompt sounded confident is a quieter error than a blank chat. Keep the human on anything that leaves the firm. That is the same control as moving agentic AI from pilot to production, applied to a five-person office.
McKinsey also records that about 20 per cent of respondents say AI-related operating costs, including token costs, constrained their AI use. A connection that lets the model rummage a whole drive on every question is how that bill arrives. Name the folder. Name the ticket status. Name the stop. Scaling AI agents beyond pilots is the later problem. This page is the earlier one. Should the assistant be allowed to see the tool at all?
Consent, scope, and a named stop
Write the permission in one sentence before anyone turns the connector on. “The assistant may read closed invoices from last quarter. It may not send mail. It may not create a payment.” That sentence is the product. The protocol can carry it. It cannot invent it.
Scope is a folder, a mailbox, a project, or a status, not “the company drive”. If the server can see staff files that the person using the assistant cannot, you have a privilege hole. Match the assistant’s view to the person’s view. If a junior clerk should not open the shareholder folder, the assistant sitting on that clerk’s desk should not open it either.
A named stop is a person, not a policy PDF. When the model proposes an action, someone has to say yes. If nobody owns the yes, the loop runs. Anthropic’s launch architecture is two-way on purpose. Data can come out. Actions can go in. The second direction is why this is not a search box.
What to do this month
List the tools you already pay for. Mark each as read-only context, a templated prompt, or an action that changes a live record. Pick one read-only source that staff already paste into chat by hand. Connect that, and only that. Measure hours returned and errors caught for two weeks. If the paste-from-drive habit dies, the connection earned its keep. If staff still paste, the connector is in the wrong place.
Leave send, pay, and post for a later month. A workflow with a human gate is still the right shape for anything that leaves the firm. The protocol is a plug. It is not a licence to unsupervised action.
Connecting an AI assistant to tools you already pay for is a standard plug into work you already own. Anthropic published the protocol so firms would stop writing a custom pipe per app. McKinsey’s gap between personal productivity and EBIT is why the plug is worth considering. Consent, a narrow folder, and a named stop are why it is safe enough to try.
Key takeaways
- Anthropic open-sourced MCP on 25 November 2024 so assistants can talk to systems where data already lives.
- McKinsey’s 2026 survey has 80 per cent reporting personal productivity gains and 37 per cent reporting any EBIT impact. A side chat explains the first number.
- The specification names a host, a client, and a server. You choose what the server is allowed to expose.
- Start with a read of one paid tool. Do not start with send, pay, or post.
- Consent, a narrow folder, and a named person who can stop the action are the control. The protocol cannot invent them.
FAQ
What does it mean to connect an AI assistant to existing tools?
It means the assistant can read, and later act on, systems you already pay for through a standard protocol, instead of a custom pipe per app. Start with a read. Keep a person on anything that leaves the firm.
Do I need to replace Slack, the CRM, or the ledger?
No. The point of a standard is to plug into tools you already pay for. A second copy pasted into chat is the thing you are trying to stop.
Is MCP a product I buy?
No. It is an open protocol. Hosts, clients, and servers speak it. Vendors ship support. You still choose which server to expose and which actions to allow.
What should I connect first?
One read-only source staff already paste into chat by hand. A folder of closed files, a ticket status, a catalogue. Measure whether the paste habit dies.
Can the assistant send email or post a journal once connected?
Not as a first step. The specification requires consent before a tool runs. Draft and flag. A named person sends and posts.
Sources
- Anthropic, “Introducing the Model Context Protocol”, 25 November 2024. anthropic.com/news/model-context-protocol
- Model Context Protocol, “Specification”, 28 July 2026. modelcontextprotocol.io/specification/2026-07-28
- McKinsey, “The state of AI in 2026: On the road to ROI”, 25 August 2026. mckinsey.com/…/the-state-of-ai
- Gartner, “Gartner Survey Finds Only 22% of Organizations Have Successfully Scaled AI Across Multiple Business Units”, 1 September 2026. gartner.com/…/successfully-scaled-ai-across-multiple-business-units
- NIST, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile” (NIST AI 600-1), 26 July 2024. nist.gov/publications/…generative-artificial-intelligence
This article is general information, not investment advice. See section 4 of our Terms & Conditions.
This is the kind of decision we advise on. If you are weighing it for your own business, see how we work or start a conversation.
