Model Context Protocol can reduce the bespoke work needed to expose tools and data to AI applications. It does not make an agent safe, interoperable in every detail or capable of acting without governance.
That distinction is the useful story behind MCP. Standardising the connection layer can make integrations easier to discover and reuse. The difficult work moves to identity, authorisation, tool design, evaluation and operations.
What MCP is
Anthropic introduced MCP in November 2024 as an open protocol for connecting AI applications with data sources and tools. In December 2025, Anthropic announced its donation of MCP to the Linux Foundation’s Agentic AI Foundation.
An MCP server advertises resources and tools. A compatible client can discover their descriptions and call them. That is more portable than hand-coding a different integration for each assistant.
Microsoft’s Copilot Studio agent tools guidance now documents MCP alongside prompts and computer-use tools. It says MCP is useful when multiple agents need a standard, centrally managed integration, while a direct API can be simpler for rapid prototypes.
This is current product evidence. The claim that MCP will “win the AI race” is a forecast, not a fact.
Protocol support is not a security review
An MCP tool can read data, send a message or alter a business system. The fact that the connection follows a standard says nothing about whether the action is appropriate.
The MCP authorisation specification requires audience-bound tokens for protected HTTP servers and prohibits token passthrough. It also calls for secure token storage, HTTPS, PKCE and exact redirect validation.
In practice, assess:
- who operates the server;
- which tools it exposes;
- which identity calls them;
- exact scopes and upstream permissions;
- where data and logs go;
- how secrets are stored;
- how the server is updated and revoked;
- whether tool results contain untrusted instructions;
- which actions need human confirmation.
Prefer a provider-operated server where feasible and verify its current documentation. A public repository or registry listing is not proof of trustworthiness.
Design tools for least privilege
Avoid one tool called manage_customer that can read, update, refund and delete.
Use narrow operations with explicit inputs:
get_customer_order_status(order_id)
draft_refund_request(order_id, reason)
approve_refund(refund_request_id)
Keep approval separate from drafting. Validate identifiers, amounts and status transitions on the server. Do not rely on the model’s prompt to enforce business rules.
Tool descriptions influence selection, but they are not access control.
Treat external content as hostile
Microsoft warns that emails, support tickets and other untrusted sources can carry instructions that manipulate an agent. If the same agent can read those sources and invoke sensitive actions, a malicious message may influence the tool call.
The Microsoft 365 Copilot extensibility guidance recommends trusted knowledge and APIs, with careful human intervention before sensitive operations.
Architect as if a prompt-injection attempt will eventually reach the model:
- separate data from instructions;
- constrain tools server-side;
- require confirmation for consequential actions;
- prevent arbitrary tool chaining;
- log calls and outcomes without leaking secrets;
- test hostile content;
- make revocation quick.
Choose MCP only when it earns its overhead
Use MCP when several clients need the same governed tool catalogue, when centrally versioned descriptions matter or when the ecosystem already provides a trusted server.
Use a direct API or existing Power Platform connector when the integration is narrow, one client uses it or your team already has a secure, supported path. A standard is not automatically the simplest design.
Production proof
Before release, test authentication failure, insufficient scope, malformed input, timeout, duplicate call, partial upstream failure, prompt injection, approval rejection and audit retrieval.
Proving that an agent invoked a tool once does not prove reliable task completion. Record both the call and the verified business outcome.
Boundaries checked on 24 August 2026
MCP specifications and Microsoft agent capabilities continue to evolve. Check every referenced feature’s current release status, licensing, region and tenant controls before production use.
This article explains an architecture choice. It does not forecast vendor winners, guarantee interoperability or certify any server.
For practical agent and Copilot integration reviews, join the Microsoft Copilot Adopters Space.