MCP — the Model Context Protocol — is an open standard that lets an AI assistant use the software you already pay for. You connect a server once, and from then on Claude or ChatGPT can see what that server offers and call it mid-conversation, acting with your permissions rather than a copy of your password. Anthropic published it on November 25, 2024 and it is now maintained in the open. For marketers, the practical translation is short: your ad accounts, your analytics and your CMS can answer questions in the chat window you are already in.
Last updated September 21, 2026. MCP has had five incompatible specification revisions in under two years, so every claim below is dated to a primary source. If a guide you are reading does not mention the 2026-07-28 revision, it is describing a protocol that no longer works that way.
What does MCP stand for?
MCP stands for Model Context Protocol. Anthropic's own definition is "an open standard that enables developers to build secure, two-way connections between their data sources and AI-powered tools" (Anthropic, November 25, 2024).
The word doing the work is context. A language model knows what it was trained on and what is in the current conversation. It does not know what you spent on Google Ads yesterday. MCP is the agreed way to hand it that, on demand, without anyone writing a bespoke integration for each combination of assistant and tool.
Two other senses of "MCP" show up in search results and are unrelated: a Microsoft certification that was retired years ago, and a clinical abbreviation. If you arrived here from a query about either, this is not that.
How an MCP call actually travels
Four parties, not two. Most explainers collapse this into "the model calls your tools", and that collapse is exactly why people think the model is holding their password.
analyze, a schema for its arguments, and whatever data comes back.- The host app. Claude, ChatGPT, Cursor, Gemini. It contains an MCP client, which is the piece that speaks the protocol.
- The MCP server. A separate program that publishes a list of actions. It holds the connection to the underlying system — an OAuth grant, an API key, a database handle.
- The underlying system. Google Ads, GA4, Shopify, your CMS. It has no idea MCP exists; it sees an ordinary API client.
- You. The only party who can grant or revoke the server’s access, and — on a well-built server — the only party who can approve a write.
What is an MCP server?
An MCP server is a small program that answers one question well: what can be done here, and how do I describe it to a model? Everything else follows from that. When a client connects, the server hands back a list of tools, each with a name, a plain-English description and a JSON schema for its arguments. The model reads those descriptions the way you would read a menu, picks one, and fills in the arguments.
Alongside tools, a server can publish resources (documents or records the client can read by URI) and prompts (pre-written templates a user can invoke). In practice, tools are what matter — nearly every marketing-relevant server is a list of tools and nothing else.
The 2026-07-28 revision trimmed the protocol hard in this area: Roots, Sampling and Logging are all deprecated, with a minimum twelve-month removal window. Sampling — the feature that let a server ask the client's model to generate text on its behalf — is the one worth knowing about, because a lot of 2025-era architecture diagrams still show it.
Remote MCP server vs local MCP server
A remote MCP server runs on the vendor's infrastructure and is reached with a URL and a sign-in. A local MCP server is a package you install and run on your own machine. This is the distinction that decides whether MCP is usable for you at all, and almost no explainer leads with it.
- Remote. The server runs on the vendor's infrastructure. You paste an HTTPS URL into your assistant, sign in with OAuth, and you are done — on a phone, on a locked-down work laptop, anywhere. Nothing is installed and no credential is stored on your machine.
- Local. The server is a package you install and run yourself, usually with an API key in a JSON config file. It works only on the machine it is running on, and it is only as current as the last time you updated it. Four in ten registry entries are this kind.
If you are a marketer rather than an engineer, remote is the only category that matters. A "top 50 MCP servers" article that does not separate the two is telling you about software you cannot use.
The MCP registry, and what is actually in it
There is an official directory: the MCP registry at registry.modelcontextprotocol.io, backed by Anthropic, GitHub, Microsoft and others. It is the closest thing to a canonical list, and the figures above came from paginating its API end to end rather than from anybody's summary of it.
Treat an entry there as a published manifest rather than a recommendation. The registry records that a server exists and how to reach it; it does not vouch for whether it is maintained, whether it is safe, or whether anyone uses it. That is the reading to carry into any "top 50 MCP servers" list built from it.
The five revisions, and what each one broke
MCP versions are dates, not semantic version numbers: the identifier is "the last date backwards incompatible changes were made" (Versioning). There have been five.
| Revision | What it introduced | Why it matters to you |
|---|---|---|
| 2024-11-05 | The original specification, alongside the announcement and the first SDKs. | Everything was local and stdio-based. This is the era most "what is MCP" articles describe. |
| 2025-03-26 | Streamable HTTP; the older HTTP+SSE transport deprecated. | The moment remote servers became practical — the reason you can now paste a URL instead of editing a config file. |
| 2025-06-18 | Authorization tightened; structured tool output. | OAuth behaviour that hosts could rely on, which is what let Claude and ChatGPT ship connector directories. |
| 2025-11-25 | Elicitation and task groundwork. | Servers could ask the user for something mid-run rather than failing. |
| 2026-07-28 | Stateless core: no initialize handshake, no session header, a mandatory server/discover, and long-running work moved to a Tasks extension. | Servers now scale on ordinary HTTP infrastructure. Roots, Sampling and Logging deprecated; HTTP+SSE reclassified as deprecated. |
The practical read: a server built against the 2024 spec and never touched since is not necessarily broken — clients still negotiate older versions — but it is running on features with a removal clock on them.
What MCP is not
- Not an API. Almost every MCP server wraps an API that already existed. What is new is that the server describes itself, so nobody writes client code per assistant. We pulled this apart properly in MCP vs API.
- Not Zapier. A zap fires on a trigger you configured in advance. An MCP tool is called because a model decided, mid-sentence, that it was the right thing to call. Zapier itself now ships an MCP server, which makes the distinction easy to miss — see Zapier MCP, examined.
- Not a plugin. A plugin is written for one host. An MCP server is written once and works in every host that speaks the protocol. That is the entire point of standardising it.
- Not an agent. MCP gives a model hands. It does not give it judgement, a plan, or a reason to stop. That distinction is the subject of what an AI marketing agent actually is.
What a marketer can actually do with MCP today
Setting aside the thousands of servers aimed at engineers, here is what exists for marketing work as of September 21, 2026, and the honest limitation on each.
| Server | What it gives you | The catch |
|---|---|---|
| Shopify Storefront MCP | Six tools on any store — search_catalog, lookup_catalog, get_product, search_shop_policies_and_faqs, get_cart, update_cart — at {shop}.myshopify.com/api/mcp. | It is the shopper-facing surface. It reads the catalogue, not your orders, sessions or conversion data. |
| Google Analytics MCP | Google’s own server over the GA4 Data and Admin APIs: account summaries, standard reports, funnels, realtime. | Labelled experimental, read-only, and it runs locally on your own machine. |
| WordPress MCP Adapter | Exposes WordPress Abilities (shipped in core 6.9) as MCP tools, with OAuth 2.1 and permissions scoped to the signed-in user’s role. | A separate plugin on its own release cadence. Automattic’s earlier wordpress-mcp was archived on January 19, 2026. |
| Zapier MCP | A bridge to 9,000+ apps and 30,000+ actions, picked per-server and permissioned read-only or write. | Each tool call spends two tasks from the same quota your zaps use, so cost scales with how chatty the model is. |
| Sprites MCP | Google Ads, Meta, LinkedIn, TikTok, Reddit, GA4, Search Console, Shopify and Google Business Profile behind one remote endpoint, with every write held as an approval card. | It acts on channels you have connected inside Sprites; it is not a generic API wrapper. |
The ad platforms arrived in 2026. Google, Meta, Microsoft, TikTok, Amazon, Snapchat and X now run their own MCP servers; only Meta, TikTok, Amazon and X can change anything, and each sees its own platform only. LinkedIn and Reddit have none, and neither does Search Console. So the real choice in paid media is between a platform’s own server, one channel at a time, and a hosted product that reaches all of them — the full map.
Four things that break, in the order you will hit them
- Too many tools. Connect five servers and the model is choosing between a hundred tool descriptions on every turn. Accuracy falls and latency rises. The fix is fewer, broader tools — one
analyzethat knows what it is doing beats forty thin endpoints. - Writes with no gate. The protocol has no concept of approval. A server can expose "pause campaign" and a model can call it because your sentence was ambiguous. Whether a change is staged for you to click is a property of the server, not of MCP.
- Credentials in a config file. The standard local setup puts an API key in plain JSON on your laptop, shared by every process that can read it. Remote servers with OAuth avoid this entirely, and the grant is revocable from the assistant's own settings.
- Instructions hidden in tool descriptions. The model reads server-supplied text and treats it as guidance. Anthropic's own documentation warns that "malicious MCP servers may include hidden instructions" and to "only connect to trusted servers" (Anthropic). Treat a connector like an app with account access, because that is what it is.
Connect one in about five minutes
The fastest honest test is a remote server in Claude, which supports custom connectors on every plan — Free is capped at one (Anthropic).
1. Open the connector settings
In Claude, go to Settings → Customize → Connectors. On Team and Enterprise only an Owner can add one, under Organization settings → Connectors; everyone else sees a Connect button afterwards.
2. Add the server URL
Choose "Add custom connector" and paste the server's HTTPS endpoint. A well-built remote server publishes its own OAuth client metadata, so there is no client ID or secret to fill in. Leave the advanced fields alone.
3. Sign in and read the consent screen properly
Claude opens the server's consent screen. This is the one moment you get to see what you are granting. Read the scopes; approve them; note that revoking the grant later kills the very next tool call.
4. Ask what it can do
Type "what can this connector do?" Claude will list the tools it can see. If the list is empty, the OAuth handshake completed but the token is not being accepted — disconnect and reconnect, which clears a stale grant.
ChatGPT takes the same kind of URL but through a different door: developer mode, in beta on Plus, Pro, Business, Enterprise and Edu on the web, with write-capable custom connectors restricted to the workspace plans (OpenAI Help Center). The agent directory has the exact path for thirteen clients.
Where to go next
- Want the vocabulary in one place? The MCP glossary entry and MCP server entry are the two-paragraph versions.
- About to connect something to an account that matters? Is MCP safe covers what the specification secures, what it does not, and the six questions to ask first.
- Choosing a server? The MCP servers worth connecting for marketing, and for Claude specifically, the best Claude connectors for marketers.
- Wondering whether this replaces your API integration? MCP vs API.
- Ready to point an assistant at your ad accounts? Start at the Sprites MCP hub, or go straight to Google Ads over MCP, Meta Ads over MCP or Shopify over MCP.
MCP questions marketers actually ask
What is MCP in simple terms?
MCP, the Model Context Protocol, is an open standard that lets an AI assistant use software you already pay for. You connect a server once; from then on the assistant can list the actions that server offers and call them during a conversation, using your own permissions rather than a copy of your password.
What does MCP stand for?
Model Context Protocol. Anthropic published it on November 25, 2024 and describes it as "an open standard that enables developers to build secure, two-way connections between their data sources and AI-powered tools." It is now maintained in the open, with contributions from Anthropic, OpenAI, Microsoft, GitHub and others.
What is an MCP server?
An MCP server is a small program that publishes a list of actions an AI client can call, each with a name, a description and a JSON schema for its arguments. A remote MCP server runs on the vendor’s infrastructure and you connect to it with a URL and a sign-in. A local one is a package you install and run on your own machine.
Is MCP the same as an API?
No. An API is the plumbing; MCP is a way of describing that plumbing so a model can choose what to call at runtime. Almost every MCP server is a wrapper around an API somebody had already published. The difference is that the server describes itself, so no one has to write client code for each new assistant.
Do I need to be a developer to use MCP?
Not for a remote server. In Claude you paste a URL under Settings → Connectors and sign in; in ChatGPT an admin enables developer mode and adds the same kind of URL. Local servers are the ones that need a terminal, and 12,461 of the 31,793 servers in the official registry are local-only.
Is MCP safe to connect to my ad accounts?
It depends entirely on the server, which is why Anthropic’s own documentation says to "only connect to trusted servers" and warns that "malicious MCP servers may include hidden instructions." The protocol carries no approval gate of its own. Ask who holds the credential, whether writes are gated behind something you click, and whether the grant can be revoked.
Which AI apps support MCP?
Claude on every plan (Free is limited to one custom connector), ChatGPT on Plus, Pro, Business, Enterprise and Edu through developer mode, plus Cursor, Codex, Gemini, GitHub Copilot, Grok, Windsurf, Cline, Replit and others. The list changed faster than any article about it, so check the host’s own documentation before you plan around it.
What changed in the 2026 MCP specification?
The 2026-07-28 revision made the protocol stateless: it removed the initialize handshake and the session header, added a mandatory server/discover call, replaced server-initiated requests with a retry pattern, and moved long-running work into a Tasks extension. It also deprecated Roots, Sampling and Logging, and reclassified the old HTTP+SSE transport as deprecated.