MCP server

Without a server, an assistant works from what is in the conversation. Ask it how many hours a project used and it can only guess. With a server connected to the time-tracking data, it queries the real figure. That moves an assistant from giving advice to checking facts and doing work.

A server is also where access is controlled. It decides which actions exist, which records are visible and whether the connection can write. A badly scoped server is the same as handing out a master key.

• Expose the smallest set of actions the job needs, not everything the system's API allows.
• Begin read-only. Write actions come later, behind approval.
• Use a dedicated account or token with limited rights, never an owner login.
• Install servers only from sources you trust. A server runs code and sees whatever the assistant sends it.
• Remove servers nobody uses. Each one is one more thing to keep secure.

An MCP server sits between an AI assistant and one system. On one side it speaks the Model Context Protocol. On the other it talks to the real thing: a database, a project tracker, a billing tool, a folder of documents. It tells the assistant what it can do, such as "list overdue invoices" or "create a task", and carries out the call when the assistant asks.

Servers come in two kinds. A local server runs on the user's own computer and starts when the assistant does. A remote server runs on the internet, usually run by the tool's vendor, and the user signs in to approve access. Local ones suit files and personal tools. Remote ones suit shared business systems.

• Mirroring the whole API. Expose the few actions the job needs, not everything the system allows.
• Giving the server an admin token. If the server is compromised or the assistant is misled, the token decides how much damage is done.
• Skipping the source check. A server from an unknown author runs code on your machine or sees your data.
• Leaving unused servers connected. Each one is one more thing to keep secure and up to date.
• Putting write actions and read actions together. Keep them apart, so approval can be required for writes only.