“Can I just ask the assistant what's waiting for me?”
Monday, 8:40. Layla, Sandline's operations manager, has a coffee in one hand and a question in the other. She doesn't want to open three screens. She wants to type one question and get one answer.
Karim, who runs Sandline's systems, has two questions of his own. What would the assistant connect to? And whose access would it use?
MCP answers Karim's first question. Not his second. Let's see why.
What is MCP?
MCP stands for Model Context Protocol. It's a standard way for AI apps to talk to other software. An assistant can ask a system what it's able to do, then ask it to do it. That's how the official introduction puts it, more or less.
Think of USB-C. Before it, every device had its own cable. Now one plug fits most things. MCP does the same for AI: build a connection once, and any assistant that speaks MCP can use it.
Here's the catch. A USB-C cable lets you plug in a hard drive. It doesn't decide which files you're allowed to open.
Who does what in MCP?
There are three parts, each with one job, as the architecture spec lays out:
- The host is the AI app you use. Layla's assistant.
- The client lives inside the host. It keeps one line open to each server.
- The server offers the actual abilities, like “list purchase orders”.
Behind the server sits the real system: the one that holds Sandline's purchase orders and approvals. That's where the truth lives.
These are roles, not machines you need to buy. Ask your team one thing: who owns each part? If the answer is “the AI handles it”, keep asking.
What can an MCP server offer?
Three kinds of things:
| What it is | In plain words | At Sandline |
|---|---|---|
| Tools | Actions the assistant can ask for | “List my pending POs” |
| Resources | Documents and data it can read | The purchasing policy |
| Prompts | Ready-made requests you can pick | “Summarise my approvals this week” |
Tools matter most. The assistant can see the list of tools and call one when it needs it. The tools spec says a person should always be able to say no to a tool call.
Keep the first tool small. Layla asked for a list, so give her a list. Not a “do anything with purchase orders” button.
What happens when Layla asks?
Here's one request, start to finish:
- Layla → AI hostWhich POs are waiting on me?
- AI host/client → MCP serverWhat tools do you have?
- MCP server ⇢ AI host/clientlist_my_pending_pos
- AI host/client → MCP serverRun list_my_pending_pos
- MCP server → Business systemPending POs for this verified user
- Business system ⇢ MCP serverTwo POs, with current status
- MCP server ⇢ AI host/clientHere they are, with links
- AI host/client ⇢ LaylaTwo POs need your review
- Nothing is approved here. Reading is not approving.
Two details make this safe. First, “my” comes from who Layla really is, checked by the system. It doesn't come from the assistant typing “user=Layla”. Second, the tool only reads. It can't approve anything.
And if the check fails, the assistant should say so. “I couldn't check” and “nothing is waiting” are very different Mondays.
Does MCP handle security?
Partly. For connections over the web, MCP includes a sign-in standard built on OAuth, the same family of standards behind buttons like “Sign in with Google”. It's in the authorization spec. It's optional, and servers running on your own machine take their credentials from that machine instead.
That answers “may this app connect?” It doesn't answer “may Layla approve this order?” The spec itself is honest about this: the protocol can't enforce those rules on its own, so the people building it have to.
So Karim keeps two questions apart. Can this app connect? And can this person do this, to this record?
Sandline · example
What's at the end of the pipe, in Beezr
Sandline runs its operations on Beezr. Omar approves a purchase order for 400 safety helmets. It's above Sandline's 25,000 AED limit, so the workflow sends it to Layla too.
Beezr keeps the approval history: who decided, and when. Permission profiles decide who sees which fields, down to the field.
That's what Layla is really asking about. MCP would only be the pipe. This is what sits at the end of it.
When is MCP worth it?
Do you need MCP?
- If several AI apps need to use your business tools → MCP is worth a look — check the server and its security first.
- If one known system just sends data to another → a direct integration is simpler — don't add a layer you don't need.
- If nobody can say who may approve what → sort that out first — no connection fixes it.
Myth / Reality
Myth: if an assistant can see an order, it can approve it. Reading and approving are different actions. Give them different permissions.
Our take
Our take. MCP is a plug, not a plan. It's genuinely useful: build a connection once, use it everywhere. But start with the record, the rules and the person responsible. Then pick the plug.
Key takeaways
- If you're technical: know your host, client and server, and show how a real identity reaches every call.
- If you're not: ask to see one request that works and one that gets refused.
- Reading, suggesting and approving are three different permissions. Treat them that way.
Build the governed process an AI integration should sit on
Whatever connects an AI to your business, the rules have to live where the records live. In Beezr, that's the part you build first.
- Create the Purchase Orders module — supplier, amount and the person responsible.
- Set permission profiles — for each role, decide which fields it can edit, only read, or not see.
- Build the approval workflow — send orders above Sandline's limit for a second approval, with full approval history.
- Add an AI step where text needs reading — load the records into the workflow, ask for a summary, then let a Decision or an approval act on it.
- Give each outside system its own key — Beezr's API keys can read records and start webhook workflows, and each key can be paused on its own.
Questions readers ask
What is an MCP server?
It's software that offers abilities through MCP, like “list purchase orders”. A client inside an AI app asks for them. What the server can actually do depends on how it was built.
What are some MCP server examples?
GitHub publishes its own MCP server, and the MCP project keeps reference servers, such as one for files. They're great for learning. Review any server before you trust it with real work.
What are MCP tools?
Named actions a server offers, each with a description of the inputs it needs. A tool can look things up or change things, so check what each one does before allowing it.
MCP vs RAG: what's the difference?
RAG means fetching information to help an AI write a better answer, as described in the original RAG paper. MCP is about connecting to tools and data. You could offer a RAG-style search through MCP, but MCP doesn't build the search for you.
MCP vs A2A: what's the difference?
A2A is about AI agents talking to each other. MCP is about an AI app reaching tools and data. Some systems use both. Neither is a step every business has to take.
Which version of MCP does this guide use?
The 2026-07-28 revision. Its release notes describe a simpler setup than older versions, so check the version before copying an older tutorial.
Does MCP replace APIs?
No. An MCP server can call an existing API behind the scenes, and the API keeps doing its job. Follow one request down both routes in MCP vs API.
Sandline Supplies is a fictional example company.
Sources
- What is the Model Context Protocol? · Model Context Protocol · accessed 2026-10-17
- Architecture · Model Context Protocol · 2026-07-28
- Tools · Model Context Protocol · 2026-07-28
- Authorization · Model Context Protocol · 2026-07-28
- Specification · Model Context Protocol · 2026-07-28
- The 2026-07-28 Specification · MCP lead maintainers · 2026-07-28
- GitHub's official MCP server · GitHub · accessed 2026-10-17
- Reference servers · Model Context Protocol · accessed 2026-10-17
- Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks · Lewis et al., arXiv / NeurIPS · 2020-05-22
- What is A2A? · A2A Protocol · accessed 2026-10-17