What MCP is, and what it means for your business data

MCP, the Model Context Protocol, is how AI assistants like Claude and ChatGPT connect to the apps where your work lives. Instead of pasting numbers into a chat, you let the assistant ask your finance app, calendar or file storage directly.

For a small business that is convenient, and it raises fair questions. What can the assistant reach? Who approves it? What can go wrong? This guide explains MCP in plain terms, then shows how it works with Mintas, including a sample conversation.

The short version

Anthropic open-sourced MCP on November 25, 2024, describing it as “a new standard for connecting AI assistants to the systems where data lives.” The official site compares it to a USB-C port: one standard plug instead of a different cable for every device. An app builds one MCP connection, and any AI app that speaks MCP can use it.

On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation, a fund under the nonprofit Linux Foundation co-founded by Anthropic, Block and OpenAI. At that point Anthropic counted more than 10,000 active public MCP servers. The current version of the specification is dated July 28, 2026.

There are three roles:

• Host: the AI app you use, such as Claude, ChatGPT or Cursor.
• Client: the connector inside the host. Each client talks to exactly one server.
• Server: the service that offers data and actions, such as your finance app.

Under the hood, the messages are JSON-RPC, a simple format for “please do this” requests and their replies. You never have to see them.

Tools, resources and prompts

A server can offer three kinds of building blocks.

Tools do most of the work. Some only read, such as listing invoices. Others change things, such as creating a draft invoice or starting a timer. The specification calls tools “model-controlled”: the model decides when to call them, based on your question. That is why approval prompts matter, as covered below.

Local and remote servers

A local server runs on your own computer, started by the AI app. Developers use these for things like files and code. A remote server runs on the internet, and you connect by pasting a URL, such as https://api.mintas.co/mcp. Business apps almost always use remote servers, because your data already lives on their side.

How sign-in works

A remote server that holds private data has to know who you are. The MCP specification bases this on OAuth 2.1, the same standard behind “Sign in with…” buttons. In plain steps:

1. You add the server’s URL to your AI app. The server answers “sign in first” and says where its sign-in service is.
2. The AI app introduces itself to that sign-in service. It either registers on the spot or points to a public description of itself.
3. Your browser opens the service’s own sign-in and approval page. You sign in there, never inside the AI app, and you see what the app is asking for.
4. The AI app receives an access token limited to the permissions you approved. You can revoke it later.

Permissions in OAuth are called scopes, such as “read invoices” or “write transactions”. The specification asks clients to follow the principle of least privilege and request only the scopes they need. But when a server does not say which scopes a request needs, it tells clients to ask for every scope the server lists. Read the approval page before you click Allow.

The specification also requires PKCE, an extra check that stops a stolen sign-in code from being used by anyone but the app that started the sign-in.

Some AI apps cannot do OAuth sign-in yet. For those, servers usually offer an API key: a secret you create in the service and paste into the AI app.

Which apps support it

MCP’s own site lists Claude, ChatGPT, Visual Studio Code and Cursor among the AI apps that support it. When Anthropic announced the donation, it named ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code as adopters. In Claude, custom connectors to remote servers work on the Free, Pro, Max, Team and Enterprise plans, with Free limited to one custom connector.

Mintas has setup guides for 15 clients at mintas.co/mcp: Claude, ChatGPT, Cursor, Cline, Windsurf, Zed, Gemini CLI, OpenCode, Raycast, Perplexity, Manus, Microsoft Copilot, Zapier, Make and n8n.

What a connector can and cannot do

A connector can:

• Call the tools the server offers, with the access you approved.
• Read whatever those tools return. That data becomes part of your chat and goes to the AI provider.
• Take the actions its tools allow, such as drafting an invoice.

A connector cannot:

• Do anything the server does not offer as a tool. If no tool moves money, the assistant cannot move money.
• See your password. With OAuth it only holds a token.
• Go past the scopes you granted. The server checks every call.

Two cautions from the specification itself. First, MCP cannot enforce its security principles at the protocol level; it relies on the apps that implement it. Second, a tool’s description of its own behavior should be treated as untrusted unless it comes from a server you trust. The specification also says there should always be a human in the loop who can deny a tool call. Using an AI assistant with your books, safely covers approvals, read-only access and prompt injection.

How the Mintas MCP server works

The Mintas server lives at https://api.mintas.co/mcp. It offers 103 standard tools in 15 groups, plus 4 invoice tools that show a live invoice preview in AI apps that support MCP Apps, an official extension for interactive views inside the chat.

The 15 groups are transactions, invoices, customers, time tracking, reports, documents, inbox, bank accounts, categories, tags, invoice templates, invoice products, recurring invoices, team and search. Some examples:

• transactions_list, transactions_update and transactions_export_to_accounting
• reports_spending, reports_runway, reports_profit and reports_tax_summary (tax recorded as paid or collected)
• invoices_create, which makes a draft by default, and invoices_send, which emails a draft to your client
• inbox_list and inbox_confirm_match for receipts
• tracker_timer_start and invoices_create_from_tracker
• search_global for a quick lookup across everything

Every tool is labeled as read-only, write or destructive, so AI apps such as Claude can group them and let you set approval rules per group. The server also offers 7 resources, such as your categories and single invoices, and 8 prompts, including a monthly close checklist, invoice follow-up, cash flow forecast and project profitability. It tells the AI app today’s date in your time zone and how your locale formats numbers, so “this quarter” means your quarter.

Nine of the 15 clients connect with an OAuth sign-in and no API key. The Mintas approval page shows the app’s name, lets you pick the workspace, lists the permissions requested and warns you if Mintas has not verified the app. You can disconnect the app from Mintas at any time. The other clients use an API key, which starts with mnt_ and is created in Settings, Developer, with the presets All, Read only or Restricted. With a Read only key, the tools that change data are not offered to the AI app at all.

None of the tools can move money. Bank access in Mintas is read-only.

An example conversation

Here is what a session in Claude might look like. The business and the numbers are made up.

You: How much did I spend on software last quarter, and who still owes me money?

The assistant calls reports_spending for July 1 to September 30, then invoices_list filtered to unpaid and overdue invoices. Both tools only read.

Claude: You spent $1,284 on software from July through September. Two invoices are open: INV-0041 to Lakeside Bakery for $2,400, 12 days overdue, and INV-0044 to Harbor Studio for $1,150, due Friday.

You: Start a timer on the Harbor Studio website project.

The assistant calls tracker_projects_list to find the project, then tracker_timer_start. Starting a timer changes data, so if you set write tools to Needs approval, Claude asks first.

You: Draft an invoice for my September hours on that project.

The assistant calls invoices_create_from_tracker, which builds line items from your tracked hours at the project’s rate and saves a draft. In apps that support MCP Apps, the invoice preview appears in the chat.

You: Looks right. Send it.

The assistant calls invoices_send. You approve the call, and Mintas emails the invoice to the client.

At each step you can see which tool was called, and you can check the answer in Mintas: the spending report, the two invoices, the draft.

How Mintas helps

• The Mintas MCP server at https://api.mintas.co/mcp gives your AI app access to your Mintas records through 103 standard tools in 15 groups.
• Most clients connect with a sign-in and no API key. You approve the workspace and permissions on Mintas’s own page and can disconnect any time.
• API keys come in three presets, and a Read only key hides every tool that changes data.
• No tool moves money, and invoices are created as drafts by default.
• Setup guides for all 15 clients are at mintas.co/mcp, and the docs cover the API and CLI.