MCP is not a model and not a subscription. It is one open plug that lets any AI app reach any tool without a custom integration for each pairing. That is why it keeps appearing in changelogs for products from different companies.
Before it, 20 apps wired to 20 data sources meant 400 one-off connectors. Over MCP the same coverage is 40. The headline calls that 10x more powerful. The arithmetic says 10 times fewer integrations.
By the end you will be able to say what MCP actually collapses, why the multiple depends on scale, what a hosted call spends, and which single read-only server to connect before you hand an agent your email or your repo.
🔌 Connect your first MCP server in four steps
Pick a host you already use
Open Claude, Cursor or VS Code and find the connectors or MCP settings section.
Choose one read-only server
Pick a repo, docs or Slack server from the host's directory, not an email or money tool.
Use a throwaway account
Authenticate with an account that has no access to client files or payment methods.
Watch what it fetches
Run a few prompts and read the tool list the server publishes with tools/list.
Approve writes manually
Only after you trust the read pattern, grant one narrow write and approve each call.
MCP is one plug for every AI tool
MCP is an open protocol that lets an AI app call tools and read data sitting on another machine, and it belongs to no single vendor.
That is why the same three letters turn up in the release notes of unrelated products. It is not a model, a subscription or a private feature.
Three parts do the work. The host is the app you already have open, such as Claude, ChatGPT features, Cursor or VS Code.
A client runs inside that host and handles the conversation with the outside world. The server is the piece someone else wrote, and it holds the tools and files the client is allowed to reach.
Anthropic built it, through David Soria Parra and Justin Spahr-Summers, and released it publicly on 25 November 2024. The specification belongs to nobody, and a server carries no vendor lock.
Open is the reason it matters here. A server written for one host also answers in every other host, so you build the connection once. Your team does not rebuild it for each product it happens to open.
| Point | MCP | Plain function calling |
|---|---|---|
| Where tool definitions live | Published by the server and fetched at runtime with tools/list | Hard-coded in the application's source code |
| Who can reuse them | Every MCP host that connects to that server | Only the one app they were written into |
| What it is | An open client-server protocol | A model API feature |
| Change a schema | Server updates; host picks it up on the next connection | Edit code and redeploy that app |
| Runs on top of | The host converts each MCP tool into the provider's function-calling format | Nothing; it is the provider-side mechanism |
| Best for | One source that must reach several hosts | One app wired to one or two fixed services |
| Validates input and output | JSON Schema on tool inputs and outputs | Whatever the app implements |
| Execution call | tools/call | Provider's own call format |
It replaces M×N connectors with M+N
The argument for MCP is a count of the connections you no longer have to build. Twenty apps each talking to twenty data sources by hand is 400 separate integrations, at 20 times 20.
Run the same coverage through MCP and you need 40: twenty servers writing the connections once, plus twenty clients reading them. That gap of 400 down to 40 is exactly where the 10x figure comes from.
The gap shrinks with the problem. Three apps and three sources is 9 integrations built by hand and 6 through MCP, which is 1.5 times fewer rather than ten. The multiplier tracks how tangled your setup already is, not anything built into the protocol.
Nothing gets saved until a server for your source exists. If nobody has published one, you write it, and you have done close to the work you set out to skip. The difference is that you follow a spec instead of inventing one.
What you actually collect is the shared pool. Claude's connectors directory now lists more than 950 servers, and Anthropic reports 400 million monthly downloads of its developer kit, four times the figure a year earlier.
A database is a store of records an app queries, and once one has a server, every host on the list can reach it.
⚠️ COMMON MISTAKE
Count servers before you count savings
The saving only lands when a server for your source already exists. If nobody has written one, you write it yourself and have done roughly the work you were avoiding, just with a spec to follow. Check the host's directory before you plan the build.
Tools act, resources read, prompts set the rules
A server hands over three kinds of thing. Tools do something: open a pull request, query a table, send a message.
Resources only show: the contents of a file, the layout of a table, documentation for a service you call.
A third kind, called a prompt, is a ready-written instruction, much like a ChatGPT prompt formula, that tells the model how to work with the tools beside it.
JSON Schema is a written contract for the shape of the data going in and coming out.
With one in place, a malformed call stops with an error instead of quietly writing to the wrong row.
That is the difference between a failed request and a corrupted table.
Watch the tutorial you copy from. The July 2026 version of the spec made the core stateless and retired sampling, the feature that let a server ask the host's model to finish text. New builds are told to call model providers directly.
An API is the door one program knocks on to use another, and the retired feature reached through the host rather than straight to the provider.
The same release added a 12-month deprecation policy, so changes hold through at least mid-2027. The server publishes its tool list at connect time, the client calls what it needs, and swapping servers needs no code change.
MCP jargon, decoded
Function calling is a feature; MCP is a protocol
The difference is where the tool list lives: inside one app's source file, or on a server anyone can fetch. With function calling, whatever you wrote ships only with that app. Change a field and you redeploy.
MCP publishes that list at connection time instead. The same server answers Claude, Cursor and VS Code, and none of those hosts needs to know the others exist. Swapping the server swaps the tool list on the next connect.
So MCP is not a rival. Every host's MCP client rewrites each published tool into the format providers already accept for function calling, and lets you keep the feature you have. One app with three fixed tools stays simpler written by hand.
Setup is quick; the metering is not obvious
The install bill is zero minutes, because the code is already sitting on your machine.
Claude, ChatGPT, Gemini, Cursor, VS Code, JetBrains and Zed all carry an MCP client, so the first connection is a menu selection rather than an SDK pulled in and wired up.
The money is where it surprises people. Zapier's MCP charges two tasks from your Zapier plan on every call that succeeds, and nothing for one that fails. It runs on all Zapier plans as of September 2026, and it still wears an MCP Beta badge.
No dollar figure belongs here, because plan limits move with every revision. Before you budget per call, read the host's pricing page and the server provider's page together. A blog post will be stale inside a quarter.
The payoff arrives the same afternoon. Point at one repo, a Slack workspace or a Postgres database from a directory of more than 950 servers in Claude's connectors directory, or 100-plus in Blaxel's hub, and you are connected with no integration code.
Is it safe to connect your accounts?
The exposure is something a large language model cannot guard against on its own. That's the kind of system behind ChatGPT and Claude, built to predict text rather than to judge intent.
It reads everything as text, so a planted line in a fetched email looks like any other line.
That planted line becomes a command, and the agent runs it with whatever access you granted. The injection travels inside the data, not in anything you typed. Your own prompt was never the weak point.
The numbers are stark. The MCPTox benchmark measured tool-poisoning attacks succeeding up to 72.8% of the time against production agents. Model-level refusal caught fewer than 3% of attempts.
Separately, a CSA-commissioned survey of 418 IT and security professionals found 82% of enterprises running agents they did not know about.
Treat a connector like software you are installing, not a switch you flip. Keep passwords, client files and medical or financial records out of any server's reach rather than trusting a prompt to guard them.
Start read-only and approve each write by hand. Elicitation helps here, because a server can ask for a missing detail or a confirmation instead of failing. The agent then stops and asks rather than guessing across the gap.
Safe first connection versus risky first connection
Start this way
- Pick a server whose tool list is small enough to read end to end
- Read the tool descriptions and input schemas before the first call
- Compare each server to the riskiest tool you already trust
- Point the client at a sandbox or test workspace, not live records
- Log every tools/call so a bad fetch is visible afterward
Skip this for now
- Installing a server because its name matched a search result
- A server with no schema on its inputs, so nothing validates
- Bundled servers that ship extra tools you never asked for
- A server whose host has auto-approve on for every call
- Permission scopes wider than the one task you are testing
Frequently Asked Questions
Do I need to know how to code to use MCP?
Not to use a prebuilt server. You click a connector in Claude, Cursor or VS Code and authenticate. Writing your own server, or debugging a broken one, is where coding knowledge helps.
Is MCP free?
The protocol is open and free to implement. Hosted servers and hosts may charge: Zapier's MCP spends two tasks per successful call from your Zapier plan. Check each provider's pricing page for current limits.
Does MCP replace function calling?
No. MCP sits above it. The host's MCP client converts each MCP tool into the provider's function-calling format. You still use function calling under the hood.
Which hosts support MCP out of the box?
Claude, ChatGPT, Gemini, Cursor, VS Code, JetBrains and Zed ship with MCP support by default. The list changes, so check your host's settings menu for a connectors section.
How many MCP servers exist?
Anthropic reported more than 950 servers in Claude's connectors directory. Blaxel's MCP Hub offers 100-plus integrations covering GitHub, Slack, PostgreSQL and Gmail. Both numbers grow, so check the live directory.
Is MCP safe for work accounts?
Treat a connector as software you are installing. Start with read-only access on a throwaway account, watch what it fetches, and only grant write access to email, money or client files after that. The MCPTox benchmark found tool-poisoning attacks succeed against production agents far more often than model refusal catches them.
One read-only plug, then watch what it fetches
The first move is small: connect a single read-only server to a throwaway account inside a host you already use. Watch a few runs and read exactly what the server fetches before you grant anything else.
The stopping rule is simple. Write access to email, money or client files waits until you have seen the read pattern and trust it. MCP collapses integrations. It does not collapse the access you hand over.
For the live server list and current pricing, go to your host's own connector page and the server provider's page. Those numbers move; the security posture does not.