The App Store opened in 2008 with 500 apps. Companies that got in early owned distribution that later competitors had to buy. The same window is open right now — inside the AI apps your customers already use.
In November 2024, Anthropic published a spec called the Model Context Protocol — MCP. It is one standard that lets an AI app use real tools: your APIs, your data, your product's actions. Build one MCP server and Claude, ChatGPT, Cursor, VS Code and the rest can all use it.
The old way looks like this. Your customer is in Claude and needs something only your product knows. New tab, log in, find the screen, copy the number, paste it back into the chat. Call it the tab tax. MCP removes it: the assistant asks your server directly and the answer returns in the conversation.
The part your security team will ask about
The obvious way to build this is also the dangerous one: hand the AI client an API key and let it call your API directly. It works in the demo. Then someone asks what happens when the model misunderstands — or when a malicious instruction hides in a document the assistant reads and tells it to issue a refund. That question is arriving in security reviews right now, and it is where most AI integrations get stuck.
A properly built MCP server is the opposite of handing over a key. Three properties to ask for, whether you build it or buy it:
Scoped access. The server decides which actions each caller can reach. Everything else never exists to the agent.
No shared secrets. The AI client only ever holds placeholders. Real credentials are attached at the server and never leave it.
An audit trail. Every call is authenticated and logged, so you can see exactly what ran.
That is the difference between "an agent with your API key" and a feature you can take to security review.
None of this is a bet on one vendor. In December 2025, MCP was donated to the Linux Foundation, with OpenAI, Google, Microsoft and AWS backing it. Stripe, GitHub, Linear, Sentry, Notion, Figma and Slack already publish servers, and the public registry lists around ten thousand. Your customer's assistant is already reaching for whichever of them answers the question. The only thing left to decide is whether your product is one of them.
If you want to move
The shortest path from here:
- List the actions, not the endpoints. Pick the handful of things a customer would ask for — check a balance, open a ticket, track a shipment. Those become the tools.
- Decide what each caller can reach. Scope access per customer or per plan. Everything else never exists to the agent.
- Keep the keys on your side. The client holds placeholders; real credentials are attached at your server. Log every call.
- Start with one client. Claude or Cursor. One server works with all of them, so the first integration is the expensive one.
I build MCP servers for companies that want this channel without the security review becoming its own project. If that is the year ahead for your product, book a call.
