What is an MCP (and whose key is it using)?

“Can we connect Claude to the CRM?” is one of the first questions I get from leaders who have rolled Claude out. Usually someone has already found a connector and wants a yes. So, definitions first, the way we started with agents.

What an MCP is

MCP stands for Model Context Protocol. It is an open standard, published by Anthropic in November 2024, for connecting AI tools to other systems: your files, your CRM, your accounting package, your shared drive. In December 2025 Anthropic gave it to the Agentic AI Foundation, a fund under the Linux Foundation, so it no longer belongs to one vendor.

The usual analogy is a USB-C port. Each system is wired up once, as an MCP server, and any AI tool that speaks MCP can plug into it. In Claude, most people meet MCP as connectors. A connector is an MCP server someone has packaged and, on a Team or Enterprise plan, an owner has switched on for the business.

A connector gives Claude tools: search this, read that, create or update this. That is all it is. An MCP is a plug, not a brain. The thinking still happens in Claude. What the plug decides is what Claude can reach, and what it can change.

Whose key it uses

Every connector is a door into one of your systems, and every door opens with a key. The question that matters isn’t “can Claude connect to it?” It’s “whose key does it use, and who said yes?”

For most connectors, switching one on for the business gives nobody access by itself. Each person connects with their own login, so Claude sees what that person can already see, and nothing more. The exception is a connector built on one shared credential, such as an API key. Then everyone who uses it reaches the system with that key’s access, whatever their own would have been. Anthropic’s help centre says so in plain words. It is the line I would want every leader to read before approving one.

We learnt this one in Slack first, when Claude Tag reached our systems on access an admin had attached to the channel, not the access of the person asking.

The number: 14 tools, two keys

We have built an MCP server of our own. Until this site moved off WordPress in September, we maintained it from Claude through an MCP server we wrote for the job. It had 14 tools: list pages, draft a post, update a page, publish, upload an image and so on.

The tools weren’t what kept it safe. The keys were. The server ran as one of two WordPress accounts. From a desktop it used an editor account that could publish. From a phone or a cloud session it used a contributor account, which WordPress itself would not let publish or upload, whatever Claude asked for. Same server, same 14 tools, two very different doors. When the site moved, we switched the server off, and retired the keys with it.

That is the habit worth copying. Decide what Claude may do in a system by choosing the account it runs as, not by trusting the tools to behave.

What to ask before you say yes

Get three answers, in writing, before any connector goes on:

• What is in the system? Connecting Claude to a shared drive gives Claude everything in the drive.
• Whose key? Each person’s own login, or one shared account? If shared, what can that account reach?
• Who said yes? One named person, and a note of why.

Our own AI policy puts it from the other side. The data rules for a system apply to any AI tool connected to it, and every connection runs on an individual company account, so access ends when the account does.

One thing to try this week

Open your Claude admin settings and list the connectors that are switched on. Next to each one, write whose key it uses. If you can’t tell for any of them, that is your first question for whoever switched it on. The answer belongs under “named tools, named accounts” on your one-page rules.