Model Context Protocol in Production: Architecture, Security and Governance

The Model Context Protocol is an open standard for connecting AI applications to external tools, data sources and systems. In December 2025 Anthropic donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded with Block and OpenAI and supported by Google, Microsoft, AWS, Cloudflare and Bloomberg.

At the time, Anthropic reported more than 97 million monthly SDK downloads and around 10,000 active servers. Vendor-neutral governance makes it a safer foundation for long-lived business integrations.

Treat each MCP server as a microservice with its own owner, deployment and monitoring. Expose narrow tools such as 'create_invoice_draft' or 'lookup_order' rather than generic database access.

Put an authorisation layer in front of tools so the model can only act with the permissions of the user it is serving. Separate read tools from write tools, and require human confirmation for anything that moves money or deletes data.

Prompt injection is the main threat: text in a document or web page can try to instruct the model to call tools it should not. Defend with least-privilege tools, allow-lists, output validation and never trusting tool output as instructions.

Log every tool call with the user, inputs, outputs and the model's stated reason. Those logs are how you debug, audit and prove compliance.

Expect business software to ship MCP servers the way it ships REST APIs today. The competitive advantage will come from well-designed, well-governed tools, not from the protocol itself.