What Is MCP? How ChatGPT and Claude Connect to Your Apps, and What Can Go Wrong

MCP (Model Context Protocol) is an open standard that lets an AI assistant like ChatGPT, Claude or Gemini read from and act inside your other apps. You don't install MCP: you click Connect in the assistant, sign in to the app, and the app decides what the assistant may read or change. Of the 373 tools in our directory, 91 mention MCP support, and most of them use it to open their own data to your assistant rather than to reach out to other apps.

What MCP does, in one picture

Three parts are involved, and the official MCP documentation names them like this:

• The host is the AI app you talk to: ChatGPT, Claude, Gemini, or an editor like VS Code.
• The server is the piece the other app provides. It lists what the assistant can do there: read files, search records, create a task.
• The client is the connection between the two. The host opens one per server, so five connected apps means five clients.

A server can offer three kinds of things: tools (actions, like "create a Jira issue"), resources (data, like a meeting transcript) and prompts (ready-made instructions). For you, the useful split is simpler: some tools only read, others write, send or delete. That difference decides how careful you need to be, which we come back to below.

Anthropic released MCP in November 2024 with ready-made servers for Google Drive, Slack and GitHub. OpenAI adopted it in March 2025, and Google committed to it a month later. In December 2025 Anthropic handed the standard to the Agentic AI Foundation, a fund under the Linux Foundation co-founded with OpenAI and Block, so no single AI company owns it now.

MCP vs API: what's the difference

An API is one app's own way in, with its own rules, and someone has to write code against each one. MCP is a shared plug that sits on top of those APIs, so an app builds one server and every MCP-compatible assistant can use it. Anthropic's launch post put it plainly: "Instead of maintaining separate connectors for each data source, developers can now build against a standard protocol."

MCP doesn't replace APIs. DeepL's official server needs a DeepL API key, because it calls DeepL's API on your behalf, and Stripe's server can sign in with an API key too. Whether an app's API is included in a plan you already pay for is a separate question about pricing, not about MCP.

Four things it lets you do today

These come from the vendors' own documentation, not hypotheticals:

1. Turn a chat into a Notion page. Anthropic's connector directory pitches turning Claude discussions into organized Notion roadmaps. Notion's MCP server works with Claude, ChatGPT and Gemini.
2. Ask about your whole inbox and calendar at once. Zapier's own example prompt: "Check what changed across Slack, Gmail, and my calendar today. Summarize what needs a reply." Zapier MCP gives an assistant access to actions in more than 9,000 apps.
3. Search work tickets in plain English. Atlassian's Rovo MCP server, generally available since February 2026, lets ChatGPT or Claude find the latest incident postmortem or create a Jira epic linked to a Confluence page.
4. Query every meeting you've recorded. Fireflies.ai, Fathom, Granola and Otter.ai all publish MCP servers, so "what did the client say about pricing in October?" becomes a question to your assistant instead of an hour of scrolling.

Where to switch it on, and which plan you need

This is where the vendors differ most, and where older explainers are now wrong.

Claude. Claude's help center lists custom connectors on every plan, including Free, which is limited to one custom connector. You add one under Customize > Connectors > Add custom connector, paste the server address and sign in. On Team and Enterprise, an owner adds it for the organization first. The built-in directory already includes Notion, Canva, Stripe and Figma, so most people never need a custom address.

ChatGPT. OpenAI's developer documentation now puts custom MCP servers under Plugins on the web (chatgpt.com/plugins, then "Add custom MCP server"). Those docs don't mention the "developer mode" toggle that older guides describe. OpenAI's help center limits custom servers that can write, not just read, to Business, Enterprise and Edu workspaces; on Business, only admins or owners can add them. Ready-made apps such as Canva, Figma and Zillow are a separate route and some of them need a paid plan.

Gemini. Google added custom MCP connectors to the Gemini app in June 2026 under Settings > Connected Apps. Google's help center restricts it to personal accounts of adults in the US, in English, set up on the web.

Microsoft Copilot. There is no button for end users. MCP reaches Microsoft 365 Copilot through agents that someone builds in Copilot Studio, usually your IT team.

Coding tools. VS Code 1.102 (July 2025) made MCP generally available in the editor, which is how GitHub Copilot reaches MCP servers there.

If you want MCP with the least setup today, Claude is the shortest path: custom connectors work on every plan, and Notion, Canva, Stripe and Figma are already in its directory.

Which tools support MCP

Across our directory, 24% of tools mention MCP (91 of 373). By our reading of those 91 listings, at least 54 describe a server that lets your assistant reach into the product, and only about a dozen work the other way round, as a host that connects to outside servers: GitHub Copilot, n8n, Make and a few coding agents.

For most readers, MCP is a feature of tools they already pay for, and the real decision is which of them to connect. A few examples from the vendors' docs:

• Buffer offers its MCP server on every plan, including Free.
• Descript and Synthesia also publish servers, worth connecting only if you already produce video in them every week.
• Jasper AI limits its MCP server to the Business plan, and Surfer SEO to its Pro and higher plans.
• DeepL publishes an official server you run on your own computer with a DeepL API key, which is a different kind of setup (see the local vs remote section).

Meeting notes: where MCP matters most

AI meeting note-takers lead every category: 15 of the 18 we list mention MCP. That makes sense, because transcripts are the data people most want to ask questions about later, and they're scattered across dozens of calls.

The catch is in the plan limits, not in the headline feature:

Prices, free-plan limits and the training column come from our directory listings; the MCP column comes from each vendor's documentation, except Granola's, which comes from our listing.

Two decision rules follow from this. For a long archive, Fathom's free plan keeps every recording and its server only reads, but check that your plan includes MCP access; for recent calls only, Granola's 30-day MCP window is enough. If your meetings are confidential, Otter.ai is the one on this list whose policy says it trains on your data, which matters more once an assistant is pulling those transcripts into other chats.

Remote connector or local server

MCP servers come in two forms, and they carry different risks:

The MCP specification's own security guide shows why local servers deserve suspicion: its example of a malicious startup command quietly copies your SSH key. A remote connector from the vendor's own domain is the safer default for anyone who doesn't read code. Claude's Research mode can't use local servers at all.

What can go wrong

The specification is frank about its limits. It says hosts "must obtain explicit user consent before invoking any tool" and that tool descriptions "should be considered untrusted", and then admits the protocol "cannot enforce these security principles at the protocol level". In practice the approval screen is the only check, and Claude's Research mode skips it for connector tools.

Real incidents show what that means:

• A fake server that copied every email. On 17 September 2025, version 1.0.16 of a look-alike package called postmark-mcp, unrelated to the email company Postmark, started adding a hidden BCC to every message it sent. The Register and The Hacker News reported it; security firm Koi estimated around 1,500 downloads a week.
• A public issue that leaked a private repository. In May 2025 Invariant Labs showed that a malicious issue in a public GitHub repository could make an agent using the GitHub MCP server leak data from the user's private repositories, after the user only asked it to look at the issues.
• Poisoned tool descriptions. The MCPTox study (August 2025) planted malicious instructions in tool descriptions across 45 real servers. Attacks succeeded up to 72.8% of the time, and the most cautious model refused fewer than 3% of them.
• Servers left open. An audit published in July 2026 found that 91.8% of the internet-facing MCP servers it examined lacked OAuth.
• Even official servers. In January 2026 The Register reported prompt-injection flaws in Anthropic's own Git MCP server, fixed in December 2025.

Six rules before you click Connect

1. Add servers from the built-in directory or the vendor's own documentation. The address should be on the vendor's domain, like mcp.linear.app or mcp.stripe.com, never a package with a similar name.
2. Prefer read-only where it's offered. Linear publishes a separate read-only endpoint and Fathom's server only reads. If you only want answers, that's all you need.
3. Don't choose "Allow always" for tools that send, post, delete or pay. Approve each payment action in Stripe or each Buffer post by hand.
4. Switch off write tools before using Claude's Research mode. Claude's help center says Research can call connector tools without asking you again.
5. Connect one app per job, and disconnect what you don't use. Every connected server adds its tool list to the assistant's memory, which leads to the cost problem below.
6. Skip local servers from code-sharing sites unless the vendor publishes them. DeepL's official server is fine; a stranger's "free DeepL MCP" isn't.

Hidden costs: tasks, plans and a crowded context

MCP itself is free, but using it isn't always:

• Zapier charges 2 tasks for every tool call. If you're on the free plan's 100 tasks a month, that's about 50 Zapier calls before you hit the limit, and a single "check my inbox and calendar" request can use several.
• Too many connectors slow everything down. Anthropic's engineering team wrote that loading every tool definition can make an agent process hundreds of thousands of tokens before it even reads your request. Their fix cut one workflow from about 150,000 tokens to about 2,000. For you, the practical version is rule 5: fewer connectors means fewer tokens spent before the assistant gets to your question, and usage limits that last longer.

Is MCP here to stay?

Developers have argued all year about whether MCP is already outdated, since a coding agent can often call an app's command-line tool directly. That debate is about how to build agents. For people who use ChatGPT or Claude, MCP is the standard that OpenAI, Anthropic, Google and Microsoft (through Copilot Studio) all support.

The standard keeps moving under the hood. The July 2026 version dropped long-lived sessions and the opening handshake, so each request now stands on its own. The official MCP Registry, launched in preview in September 2025, held more than 50,000 servers when we counted its public listing on 3 November 2026. Most of them you'll never need, and by rule 5 every extra one costs tokens: connect the apps where your work already lives and stop there.