Published: August 27, 2026. Last updated: August 27, 2026.
An MCP server is a small program that lets an AI assistant use your real tools—CRM records, calendars, tickets, files—through a shared standard called the Model Context Protocol. Think of it as a USB port for agents: one connector shape, many devices. Until recently, those connectors were awkward to run in the cloud. On July 28, 2026, the official MCP project shipped specification 2026-07-28, which makes the protocol stateless so servers can sit behind ordinary load balancers. That change is why MCP is no longer only a local developer toy.
This article is for founders and technology leads at startups and small businesses who keep hearing “connect Claude to Salesforce” and want a grounded answer: what an MCP server is, what the new spec actually changed, what can go wrong, and a practical sequence for connecting tools without handing an agent the keys to the company.
What an MCP Server Does (in Plain English)
A large language model cannot log into your CRM by itself. An MCP server exposes a short list of tools (actions), resources (readable data), and sometimes prompts. The AI client—Claude, Cursor, VS Code, or a custom agent—discovers those tools and calls them with structured arguments. Your server then talks to the real API and returns a result.
That is different from pasting a PDF into a chat window, and it is different from building a one-off plugin for a single vendor. MCP is an open protocol. The official blog for the July 2026 release reported that the TypeScript and Python SDKs had each crossed one billion total downloads, with combined Tier-1 SDK downloads approaching half a billion per month—figures published by the MCP project, not a market-research estimate.
Why This Matters Now: The 2026-07-28 Spec
Early MCP was designed around a session: a handshake, a session ID, and often a sticky connection to one server process. That works on a laptop. It breaks on Kubernetes and serverless platforms, because the next request may hit a different instance that does not know the session.
The official 2026-07-28 announcement (July 28, 2026) states that MCP removed the initialize handshake and the Mcp-Session-Id header. Each request carries protocol version and client details in a _meta field. A client that wants a catalog first can call server/discover; it is not required before every call. Google Cloud engineers described the same design in an August 5, 2026 Google Developers Blog post: sessions pinned clients to one pod; the new core lets round-robin load balancing and Cloud Run-style scale-to-zero work without Redis session stores.
Other confirmed pieces of the same release, from that announcement:
- HTTP headers
Mcp-MethodandMcp-Nameso gateways can route and rate-limit without parsing JSON bodies. - Cache hints (
ttlMs,cacheScope) on list responses so clients do not re-fetch tool catalogs constantly. - Multi Round-Trip Requests (MRTR) so a server can ask for confirmation (for example, “delete these records?”) without holding an open stream.
- Tasks as an official extension for long-running jobs, with poll-based
tasks/get. - A twelve-month minimum deprecation window for features marked deprecated (including Roots, Sampling, and Logging).
TypeScript, Python, Go, and C# are listed as Tier-1 SDKs that speak the new spec as of that release. If you still run older session-based servers, plan a migration; do not assume every tutorial from 2025 still applies.
Security: Enterprise-Managed Authorization Is Not Optional Theater
Connecting an agent to production data without identity policy is how “helpful automation” becomes a data leak. The official Enterprise-Managed Authorization extension lets an identity provider (for example Okta or a corporate SSO system) decide which employees and which MCP servers are allowed. Users sign in with existing company credentials. Admins revoke access in one place instead of hunting tokens on every laptop.
The spec describes Identity Assertion JWT Authorization Grants (ID-JAG): the client exchanges a corporate identity token for a grant, then exchanges that grant for an MCP access token. The MCP server validates tokens; it should not become a second password database.
Limitation you should plan for: client and identity-provider support is uneven. Official docs say to check the MCP client matrix. Third-party write-ups have reported that some IdPs shipped earlier than others. Treat IdP coverage as something to verify with your vendor, not as a guarantee that every SSO product works on day one.
What Competing Guides Miss
Most MCP articles either walk through a local “hello world” server or recap the spec for platform engineers. SMB buyers need a different cut:
- Which business systems are worth connecting first
- How to keep tool lists small so the model does not pick the wrong action
- How the new stateless spec changes hosting cost (this is related to, but not the same as, GPU price pressure covered in our NVIDIA AI cost guide)
- When a custom MCP server is better than a vendor’s built-in connector
The GATE Sequence: Connect Tools Without Losing Control
Use this order. Skipping a step is how shadow connectors appear in a sales team’s Claude desktop config.
G — Govern an allowlist
Write down which systems an agent may touch. Start with read-only tools (search a knowledge base, fetch a ticket summary). Ban write tools (refund, delete, send email) until a human confirmation path exists. MRTR exists specifically so confirmation can happen without a sticky session.
A — Authenticate through your IdP
Do not share a God-mode API key inside a prompt or a laptop config file. Prefer OAuth scoped to the MCP server, plus Enterprise-Managed Authorization if your client and IdP support it. Offboarding should disable MCP the same day it disables email.
T — Trim the tool catalog
A CRM can expose hundreds of operations. Models choose worse when the menu is huge. Official maintainers have flagged progressive tool discovery as a roadmap item for that reason. Until that is everywhere, ship a thin MCP server: five to fifteen tools named in business language (lookup_customer, draft_ticket_reply), not a raw REST mirror of every endpoint.
E — Evaluate hosting like any other API
Stateless MCP can run on Cloud Run, Fly.io, or a small container behind nginx. You still need logging, rate limits, and secrets management. Header-based Mcp-Method values make WAF rules easier—if you actually write those rules. A public MCP URL without auth is an open API, not an “AI feature.”
Build vs Buy: When a Custom MCP Server Makes Sense
| Situation | Lean toward | Why |
|---|---|---|
| Vendor already ships a maintained MCP connector (CRM, design, repo) | Vendor server + your allowlist | Less code to patch when the spec moves |
| Your workflow spans internal APIs, a legacy database, and one SaaS tool | Custom thin server | One catalog, one audit log, names your team understands |
| You need long-running syncs (imports, reports) | Tasks extension + queue | Do not hold HTTP open for a 10-minute job |
| You only need a chatbot on your website | Maybe skip MCP | A constrained API plus RAG may be simpler; see our AI agents guide |
Custom work here is ordinary SaaS engineering: auth, observability, and a stable contract. It is not “train a model.” If your team is already generating application code with agents, keep MCP servers in the same review process described in our vibe coding governance article—generated connectors still need a human merge.
A Realistic First Project for an SMB
A workable first slice: a read-only MCP server that searches your help center and open support tickets, plus one write tool that drafts a reply and never sends it. Host it statelessly. Log every tools/call. Require SSO. Measure whether agents actually reduce handle time before you add refunds or CRM writes. That sequence is boring on purpose. Boring is how you stay in business.
If you use CRM development or mobile apps as systems of record, expose only the fields the agent needs. Extra fields in a tool response become extra leakage if a prompt is compromised.
Risks and Limits
- Prompt injection via tool output: a malicious ticket comment can try to instruct the model. Treat tool results as untrusted data.
- Over-permissioned tokens: a server with a full-admin CRM key is worse than no MCP at all.
- Spec churn: 2026-07-28 is a breaking change for session-based designs. Budget migration time.
- Not a substitute for product UX: customers still need a reliable app. MCP helps staff and agents; it is not your storefront.
Frequently Asked Questions
Is MCP the same as an AI agent?
No. An agent decides what to do. An MCP server is one way the agent is allowed to act on external systems. You can have agents without MCP, and MCP without a fully autonomous agent.
Do I need to host my own MCP server?
Not if a vendor you already pay offers a well-scoped official server and you can restrict it. Host your own when the workflow crosses systems no single vendor owns, or when you need a smaller, safer tool list.
Does the new spec mean MCP is “production ready” for every company?
It means the protocol can scale like HTTP. Production readiness still depends on your auth, logging, tool design, and review process. The spec authors themselves describe this as infrastructure maturing, not as a guarantee of safe deployments.
Will this raise my cloud bill?
MCP hosting is usually cheap compared with model tokens. The bill to watch is still inference. Stateless servers can scale to zero, which can lower idle cost versus a always-on session process.
When to Get Implementation Help
If you want a thin, authenticated MCP layer in front of systems you already run—or a review of which tools should never be exposed—schedule a conversation or use the contact form. Ask for an architecture sketch and a threat pass, not a demo that works only on sample data.
Share
