Short answer. The Model Context Protocol (MCP) is an open standard, released by Anthropic in November 2024, that defines one common way for AI agents to connect to external tools, data, and systems. It uses JSON-RPC 2.0 messages between an AI host, a client, and one or more servers. MCP replaces the N times M integration problem, where every AI application had to be wired separately to every tool, with a single protocol that a bank builds against once and reuses across every model.
Before MCP, connecting a language model to a core banking system, a document store, and a ticketing tool meant three custom integrations per model. Swap the model and the work started again. MCP turns that grid into one interface. A tool exposes itself as an MCP server, any MCP-capable model connects as a client, and the same connector works across Anthropic, OpenAI, and Google runtimes that adopted the standard through 2025.
The protocol is often described as a USB-C port for AI. The comparison is accurate on one point that matters for regulated firms: the port is standard, but what flows through it still needs control. A few concrete uses that CEE financial teams are already testing:
An MCP server that reaches a production banking system is not a developer convenience. It is an ICT service under DORA, the EU regulation that has applied to financial entities since 17 January 2025. If that server is operated by a third party, it belongs in the firm’s register of information and falls under DORA’s third-party risk rules: due diligence before contracting, monitoring during the relationship, and an exit path if the provider fails. A protocol that makes integration one step easier also makes uncontrolled connections one step easier, and supervisors will ask which systems each agent can reach.
The EU AI Act adds a second layer. When an MCP-connected agent operates inside a high-risk use case, such as creditworthiness assessment, the deployer still owes human oversight under Article 14 and record-keeping under Article 12. MCP moves data and triggers actions, so every server it exposes widens the surface that governance has to cover. The standard solves the plumbing. Accountability for what the plumbing carries stays with the bank.
MCP is an open standard from Anthropic, released in November 2024, that gives AI agents one common way to connect to tools and data over JSON-RPC 2.0.
MCP uses a client-server design with three roles. The host is the AI application that contains the model, for example a desktop assistant or an internal agent. The host runs one client per connection. Each client talks to a server, which fronts a specific tool, database, or API. Messages travel as JSON-RPC 2.0, a lightweight request-and-response format that also supports server-initiated notifications.
Servers offer three building blocks: resources (read-only data the model can load), tools (actions the model can call), and prompts (reusable templates). Clients expose two: roots (which files or locations the server may see) and sampling (a way for a server to ask the host’s model to generate text). Two transports carry the traffic: stdio for a local server running as a subprocess, and HTTP with server-sent events for a remote server. Later revisions added OAuth 2.1 so remote servers can enforce scoped, per-user authorization.
The protocol standardizes connection, not trust. Security research through 2025 and 2026 identified tool poisoning as the most impactful client-side weakness: an attacker hides instructions inside a tool’s name or description, and the model reads that metadata as if it were a legitimate command. Related risks include prompt injection through returned data, cross-system privilege escalation when one agent holds broad access, and data exfiltration when a server quietly forwards information it was never meant to send.
The reason these matter is structural. MCP places security in the host, not in the protocol itself. The host owns user consent, credential scope, and the per-tool allow list. A firm that connects servers without those controls has widened its attack surface with each one. That is why researchers recommend scoped authentication, provenance tracking across the workflow, sandboxing, and inline policy checks rather than trusting any server by default.
A REST API is built for a developer who reads documentation and writes code against a fixed contract. MCP is built for a model that discovers tools at runtime and decides which to call. The server describes its tools in natural language, the model interprets those descriptions, and the call happens without a human in the loop for each step. That runtime discovery is the advantage and the risk in the same feature. It is why the metadata a server publishes is now a security boundary, not just documentation, and why an allow-list of approved servers matters more than it would for a static API.
Treat every MCP server as a governed asset from the first pilot. Four controls carry most of the weight. First, scope authorization per user and per tool with OAuth 2.1, so an agent inherits only the access the person behind it already holds. Second, run an approved private registry or gateway, so agents connect only to vetted servers and never to arbitrary public ones. Third, log provenance end to end, so every action an agent took through a server is reconstructable for an auditor. Fourth, keep a human approval step on any action that moves money, changes a customer record, or issues a decision. These four turn MCP from an open door into a controlled interface that a supervisor can accept.
Ableneo shipped 34 production AI projects in 2025, and 94% of them used large language models, so the question of how a model reaches real systems is one the team answers every week. MCP is useful precisely because it is boring infrastructure: a standard connector, governed like any other ICT service. Ableneo’s work across FS&I, with clients including ČSOB, Erste, and UNIQA, treats the connection layer as part of the control plane, not an afterthought bolted on after a pilot. More on how this fits AI transformation sits in the Ableneo AI Transformation FAQ.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.