Home › Knowledge Hub › What MCP is
What is MCP? Model Context Protocol, explained simply
MCP stands for Model Context Protocol. It is an open standard, introduced by Anthropic in late 2024, that lets AI systems connect to external tools and data such as files, websites, databases and apps. It is not a cryptocurrency, a token or a wallet. If anyone is selling you an MCP coin, that alone is the scam. The genuine security questions around MCP are about what an AI agent is allowed to reach, and they matter to businesses more than to individuals.
Who this is for
Two people. The one who has seen "MCP" mentioned around crypto or AI and wants to know whether it is something to buy, avoid, or ignore. And the one running a business who is being asked to connect AI tools to their systems and wants to understand the risk in plain terms.
The short version for the first person: there is nothing to buy, and the main thing to know is that MCP is plumbing, not a product.
What MCP actually is
Modern AI assistants are good at language but, on their own, cannot do anything beyond produce text. They cannot read your files, search the live web, query a database or send a message unless something connects them to those capabilities.
MCP is the standard way of making those connections. Model Context Protocol, published by Anthropic in late 2024 and now used across the AI industry, defines how an AI system talks to external tools and data sources. A piece of software that provides one of those connections is called an MCP server: for example, a server that lets an AI read your calendar, or search a company's documents, or look something up on the web.
Think of it as a universal adapter. Before MCP, every AI-to-tool connection was built custom. MCP is the shared socket that lets them plug together in a standard way.
That is the whole thing. It is infrastructure, like a USB standard or a web protocol. It is not glamorous and it is not an investment.
What MCP is not
This section exists because the confusion is being exploited.
MCP is not a cryptocurrency. There is no official MCP coin or token.
MCP is not a wallet. It does not hold funds.
MCP is not something an individual buys, installs, or owns. It is a protocol that software uses behind the scenes.
So: if someone is offering you an "MCP token", an "MCP wallet", an "MCP presale", or an investment in MCP, you have found a scam with no further checking required. Scammers attach trending technical terms to fake tokens constantly; MCP is simply the current one. The same was true of "AI tokens" and "quantum coins" before it.
Why it matters even though you cannot buy it
If MCP is just plumbing, why pay attention at all?
Because it is the plumbing through which an AI agent reaches real systems, and increasingly, those systems include ones that hold money, customer data, or the ability to take actions on your behalf. The risk is never MCP itself. The risk is what a given AI agent is allowed to reach through it, and whether the tools it connects to can be trusted.
For an individual, this matters in one specific situation: when you connect an AI assistant or "agent" to something that can move your money, such as a wallet or an exchange account. We cover that directly in our guide to AI agent crypto scams, including a real 2026 case where an AI agent connected to a wallet was manipulated into sending funds. The lesson there applies here: the danger is the permissions, not the protocol.
For a business, it matters much more, and that is the rest of this article.
The real risks, in plain terms
Security researchers have catalogued the ways an AI agent connected through MCP can go wrong. The industry body OWASP now maintains a dedicated list of these risks. Here they are without the jargon.
Prompt injection. An AI agent reads content, a web page, a document, a message, and that content contains hidden instructions the agent then follows. Because an AI does not reliably tell the difference between "information to read" and "instructions to obey," anything it reads can potentially steer it. If the agent can also take actions, those smuggled instructions can cause real harm. This is the single most important risk and the hardest to fully fix.
Excessive permissions. An agent is given more access than its job requires, the ability to delete as well as read, to move money as well as check a balance. If it is ever tricked, the damage is bounded by what it was allowed to do. Narrow permissions are the main defence.
Untrusted tools. An MCP server from an unknown source is connected, and it turns out to be malicious or compromised. It then does something harmful with the access it was given. In February 2026 a malicious MCP server was published to a legitimate registry and used to steal credentials and cryptocurrency wallet files from developers who installed it, as we cover in our AI agent scams article.
Secret exposure. The keys, tokens and passwords an agent uses to reach systems leak, through logs, through the agent being tricked into revealing them, or through a compromised tool. We cover how credentials leak in general in our writing on account security.
Data exfiltration. An agent with access to sensitive data is manipulated into sending it somewhere it should not. This combines prompt injection with excessive permissions: the agent is told to leak, and is able to.
None of these is exotic. They are the predictable consequences of giving a system that can be fooled the power to act.
If you run a business: the baseline
This is not a full security guide, and anything touching customer data or money warrants proper review. But the principles are understandable without being an engineer.
Least privilege. Give each agent the narrowest access that lets it do its job. Read-only wherever possible. No standing access to move money without a human step.
Human approval for sensitive actions. Anything that moves funds, changes permissions, deletes data or contacts customers should require a person to approve it, not happen autonomously.
Only trusted tools. Treat an MCP server like any third-party software: know who made it, why you trust them, and what it can reach. Do not connect something because it is convenient.
Short-lived, scoped credentials. The keys an agent uses should expire and should grant only what is needed, so a leak is bounded in both time and scope.
Logging and review. Keep a record of what agents did, and review it. You cannot catch misuse you cannot see.
Assume the agent can be fooled. Design so that even a manipulated agent cannot do catastrophic damage, because prompt injection is not fully solved.
Our guide to connecting an AI agent to a wallet safely covers the individual version of the same discipline.
Red flags
- Anyone selling an MCP coin, token, wallet or investment
- An AI product that wants broad access to your accounts "to work properly"
- An agent that executes money movements without asking you first
- An MCP server or AI tool from an unknown source, promoted through ads or DMs
- Any AI tool requesting your seed phrase, private key or password
- "Autonomous" used as a feature rather than a warning
What this guide cannot do
MCP and AI-agent security is a fast-moving field, and the defences are improving rather than settled. Nothing here makes connecting an AI agent to sensitive systems safe; it reduces and bounds the risk. For a business handling customer data or funds, this is a starting point for a proper security review, not a substitute for one.
This is general information, not legal, financial or security advice.
Use Chain Pursuit's free tools to understand your options, preserve evidence, and identify possible recovery scams. Do not share your seed phrase or private keys with anyone.
Sources
Anthropic, Introducing the Model Context Protocol, November 2024. https://www.anthropic.com/news/model-context-protocol, what MCP is and the problem it was designed to solve.
Model Context Protocol, Official documentation. https://modelcontextprotocol.io/, the open specification and how MCP servers work.
OWASP Foundation, OWASP MCP Top 10. https://owasp.org/www-project-mcp-top-10/, the catalogued security risks of MCP and AI-agent deployments.
The Hacker News, SmartLoader Attack Uses Trojanized Oura MCP Server to Deploy StealC Infostealer, February 2026. https://thehackernews.com/2026/02/smartloader-attack-uses-trojanized-oura.html. A documented malicious MCP server used to steal credentials and wallet files.
MCP is an actively developing standard and its security guidance evolves. This page reflects the position as of October 2026 and is reviewed quarterly.
Frequently asked questions
What does MCP stand for?
Model Context Protocol. It is an open standard, introduced by Anthropic in late 2024, that lets AI systems connect to external tools and data such as files, websites, databases and apps.
Is MCP a cryptocurrency or token?
No. MCP is a technical protocol, not a coin, token or wallet. There is nothing to buy. Anyone offering you an MCP coin, token, presale or investment is running a scam.
Why do I keep seeing MCP mentioned around crypto?
Partly because scammers attach trending technical terms to fake tokens, and MCP is a current one. Partly because AI agents connected through MCP are increasingly linked to wallets and exchanges, which creates genuine security questions about what those agents can reach.
Is MCP dangerous?
MCP itself is just a connection standard. The risk is in what an AI agent is allowed to do through it, and whether the tools it connects to are trustworthy. Weak permissions and untrusted tools are where real harm happens, which matters most to businesses.
What is prompt injection?
It is when an AI reads content containing hidden instructions and then follows them, because it cannot reliably separate information from commands. If the AI can also take actions, those smuggled instructions can cause real damage. It is the central MCP-related risk and is not fully solved.
Is it safe to let an AI agent access my crypto wallet?
Only with caution. Connect it to a wallet holding only what you could afford to lose, require your approval for any transfer, and never grant broad standing access. A real 2026 incident saw an AI agent with wallet access manipulated into sending funds. Our AI agent scams guide covers this.
I run a small business. Do I need to worry about MCP?
If you connect AI agents to systems holding customer data, money or operational control, yes. The baseline is least privilege, human approval for sensitive actions, only trusted tools, short-lived credentials, and logging. Anything touching customer data warrants a proper security review.
How do I know if an MCP server is trustworthy?
Treat it like any third-party software: know who made it, why you trust them, and exactly what it can reach. Do not install one promoted through ads or direct messages, and do not connect something just because it is convenient. Malicious MCP servers have been published to legitimate registries.
Thinking of connecting an AI tool to your accounts?
Eleven questions showing what to weigh before letting any tool touch your funds.
Check my case