The wall arrives about a fortnight in, and it is always the same wall. You have Claude Code doing genuinely useful things by then. Cleaning up a messy export. Pulling figures out of a stack of PDF invoices into a spreadsheet without typing any of them. Then you ask it something ordinary, like which of last month’s invoices are still unpaid, and it stops. It cannot see Xero. It can only see what is sitting on your laptop.
I have watched a lot of owners hit that boundary, not long after walking through their first real task, and quietly conclude the tool is less capable than they were promised. It is not. There is a second half to Claude Code that almost nobody explains to a non technical audience, because the standard that unlocks it has an unhelpfully academic name: the Model Context Protocol, MCP for short.
So this is the plain version. What MCP actually is, what it changes about the jobs Claude Code can do, which of your business systems you can connect today, the exact commands, and the honest security picture. That last part matters more than anything else here, and it is the part the developer guides skip almost entirely.
So what is MCP, in plain English?
MCP is an open standard for connecting an AI application to other systems. A small program called a server sits in front of one system, say Stripe, and hands Claude a menu of what it can ask that system for and what it is allowed to change. Claude cannot order off the menu.
Anthropic published the standard on 25 November 2024, describing it as a way to connect AI assistants to the places where data actually lives. The problem it solved was arithmetic. Before it existed, every AI tool needed a bespoke integration written for every business tool, so ten AI apps and ten business systems meant a hundred separate pieces of plumbing that nobody was ever going to build. Write one MCP server for Stripe and every AI application that speaks the protocol can use it.
The menu framing is worth holding onto, because it explains both the power and the risk. A server for your accounting system might offer twelve things: list invoices, fetch a contact, create a draft bill, void a credit note, and so on. Whoever wrote that server decided what is on the menu. You decide, at the moment you connect it, how much of that menu Claude is allowed to order from.
What does it change about what Claude Code can do?
It moves Claude Code from working on files to working on your business. That is the whole shift, and it is bigger than it sounds.
Without MCP, Claude Code is bounded by the folder you started it in. Powerful inside that folder, blind outside it. Every job that touches a live system turns into you exporting a CSV, dropping it somewhere Claude can reach, and then manually putting the answer back where it belongs. Which is fine once. It is miserable as a monthly routine.
With a server connected, the export step disappears. Reconciling Stripe payouts against your accounting records stops being an afternoon of spreadsheet gymnastics and becomes a question you ask in a sentence. Claude reads both sides itself and tells you what does not match.
Some other jobs that only become possible on the other side of that line:
- Pulling the last quarter’s failed payments out of Stripe with the customer names attached, so you can actually chase them.
- Reading your standard operating procedures out of Notion so the work it does for you follows your process rather than a generic one.
- Walking your live booking form the way a customer would, using the Playwright server, to find out why enquiries are dropping at step three.
- Answering questions about your own database in plain English, without anyone writing a query.
None of that requires you to write code. It requires you to connect the right server and then brief the job properly, the same as any other automation.
Which of your business tools can you actually connect?
More than you would expect, and the list got seriously commercial during 2025. When MCP launched, the pre built servers were Google Drive, Slack, GitHub, Git, Postgres and Puppeteer, which is a list assembled for engineers. By the time the protocol changed hands in December 2025 there were around ten thousand active servers and roughly 97 million monthly downloads of the software development kits behind them.
Here are the ones that matter if you run a business rather than a codebase. I have marked which are run by the vendor itself, because that distinction turns out to be the most important line in the table.
Plenty of other servers exist for Slack, Airtable, Google Drive, Linear and Figma. Check each vendor’s own documentation before you trust one, because a lot of aggregator sites label community projects as official when they are nothing of the sort.
How do you actually add one?
One command, then a browser sign in. For a hosted server that is genuinely the whole job, and it takes about a minute.
Start with the server that cannot hurt you. Anthropic runs one for its own documentation that needs no account at all, so you can watch the mechanism work before you point it at anything of yours:
claude mcp add --transport http claude-code-docs https://code.claude.com/docs/mcpThen check it landed:
claude mcp listYou will get a status line back. A tick means connected. ! Needs authentication means the server wants you to sign in, which is what you will see the first time you add anything real, because the server answered with a 401. That is the normal path, not a failure.
To sign in, start a session and type /mcp. Pick the server, choose Authenticate, and your browser opens on the provider’s own login page. You approve the permissions there, in their interface, and the token comes back to Claude Code. Your password never touches Claude. It is the same flow as connecting any app to your Google account.
A local server, meaning one that runs as a program on your own machine rather than in someone’s cloud, uses a slightly different shape with a double dash separating the name from the command:
claude mcp add playwright -- npx -y @playwright/mcp@latestThe third thing to know is scope, and it is the setting people get wrong. By default a server is added for you, in that one project only. Add --scope user and it follows you into every project on your machine. Add --scope project and it is written into a .mcp.json file in the folder, which means anyone who opens that project gets it too, after Claude Code asks them to approve it first.
One piece of housekeeping. The older sse transport still appears in a lot of tutorials and in a few vendors’ own setup instructions. It is deprecated. Use http wherever the provider offers it.
Is it safe to plug an AI into your accounting system?
Not by default, and the honest answer is that this is the question you should be asking before any of the above. Anthropic’s own security documentation is unusually blunt about it: the company reviews connectors against its listing criteria before adding them to its directory, but it does not security audit or manage any MCP server. Its advice is to write your own or use ones from providers you already trust.
Two incidents from 2025 show what the real risk looks like, and neither is theoretical.
Asana launched an MCP server at the start of May 2025. On 4 June it found a bug in its tenant isolation logic that could expose one organisation’s projects, tasks, comments and files to a different organisation entirely. Asana switched the feature off from 5 to 17 June while it fixed the flaw. Around a thousand customers were affected. That was a competent company running its own server, and it still happened.
The second one is more instructive because it explains the shape of the attack. In July 2025, researchers demonstrated an exfiltration route through the Supabase MCP server. An attacker writes hidden instructions into an ordinary customer support ticket. A developer later asks their AI assistant to go through the tickets. The assistant reads the ticket, follows the buried instruction as though it came from its owner, queries a table of access tokens it was never meant to touch, and writes the contents back into the ticket where the attacker can collect them. Nobody was hacked in the traditional sense. The system did exactly what it was told, by the wrong person.
Simon Willison’s name for the underlying condition has stuck, because it is the clearest way to think about this: the lethal trifecta.
Read that against your own setup and the practical rules write themselves. A read only connection to Stripe is a completely different proposition to a read and write connection to Stripe, because read only removes the third leg and the exfiltration route closes. Most business systems will issue you a restricted API key. Use it.
Be sceptical of community servers installed with npx -y, too. That flag suppresses the confirmation prompt and runs somebody else’s code on your machine with your permissions. Anthropic’s own developer tool, MCP Inspector, carried a critical remote code execution flaw scoring 9.4 until version 0.14.1 landed on 13 June 2025. If it can happen in Anthropic’s tooling, assume it can happen in a package with forty stars.
What Claude Code does give you is a permission model that starts closed. It asks before it acts, and it prompts you the first time it meets a server it has not seen. Credentials sit in your system keychain rather than in a file on disk. Anthropic still adds the caveat that no system is completely immune. Believe them.
If you want a sober read on which of your processes are worth connecting before you connect anything, my free AI Opportunity Scorecard takes about two minutes and gives you the hours and money estimate first.
What does it cost to run?
Nothing extra, on the face of it. MCP is an open standard and the servers are free and open source, so there is no line item for connecting Stripe or Notion. What you pay for is the Claude subscription underneath, and I have worked through whether that subscription pays for itself elsewhere. Anthropic prices Pro at $17 a month on the annual plan or $20 billed monthly, in US dollars, so a UK buyer should add their card’s exchange rate and VAT on top of the sticker.
The real cost is context, and it is not measured in money.
Every server you connect describes its tools to Claude so it knows what is on the menu. Those descriptions take up room in the same working memory Claude needs for your actual job, and connect enough servers with enough tools and you are burning a serious chunk of the window before you have typed anything. Claude Code now defers most of this by default, loading only the names until a tool is actually used, which took a lot of the sting out of it. There is a ceiling on results too: a single tool’s output is capped at 25,000 tokens by default, with a warning at 10,000.
Two commands keep this under control. /context shows you what is consuming the window right now. /mcp lets you switch off a server you are not using in this session. Connect what the job needs and nothing else.
Is MCP tied to Anthropic?
Not any more, and this is the strongest reason to take it seriously rather than treating it as one vendor’s format. On 9 December 2025 MCP was donated to the Agentic AI Foundation, a directed fund under the Linux Foundation, co founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. The project keeps autonomy over its own technical direction while the foundation handles governance.
Practically, that means ChatGPT, Gemini, Cursor, Microsoft Copilot and Visual Studio Code all read the same servers Claude Code reads. So the connection you set up this week is not a bet on Anthropic staying ahead. If you switch tools next year, the plumbing comes with you.
The specification itself carries a date rather than a version number, currently 2026-07-28, marking the last time a backwards incompatible change was made. Worth knowing only because it tells you the thing is still moving.
Where I would actually start
If you take one instruction from this, make it the boring one: connect the documentation server first, watch claude mcp list turn green, and get comfortable with what the mechanism feels like before anything of yours is on the other end of it. Then add one hosted server from a company you already pay, with the narrowest permissions it will let you set, and give it a fortnight of read only questions. Reconciliation is usually the job that pays for itself first, because it is pure copying and nobody enjoys it.
The part I would not improvise is write access. Reading your Stripe account is a low stakes experiment. Letting an assistant issue refunds, or edit records in the system your accountant relies on, is a different decision, and it deserves the same care you would give a new member of staff on their first week. I have no interest in scaring anyone off this. I do want you connecting the safe half yourself and thinking properly about the other half.
That is roughly how I work with owners generally, and it is why I built the service the way I did: the aim is that you can run this without me afterwards. If you would rather map it out together first, book an AI Opportunity Audit and we will find the process worth connecting, wire one up live, and you will leave with a roadmap you can carry on yourself.
How much time and money is your business losing by not using AI?
Answer 9 quick questions and I'll send you a personalised estimate of the hours and money slipping away every month on work AI could handle, plus exactly where to start.
Start NowTakes 2 minutes · free estimate by email · no commitment
Sample result
~38 hrs/mo
of work AI could take off your plate
That's roughly
£950/mo
Your number is calculated from your own answers.