Your firm’s knowledge is spread across several systems. Client billing sits in the accounting software. Service history sits in the ticketing system. Promises and price changes sit in email. None of these systems talks to the others, so an AI assistant only sees what someone pastes into it. The Model Context Protocol (MCP) is changing that. It lets one AI assistant work across those systems at once. That saves time, and it means AI needs the same access rules as any employee.
How the Model Context Protocol Works
MCP is an open standard for connecting AI assistants to business systems. Anthropic, the maker of the Claude assistant, released it in November 2024. Anthropic says MCP swaps many one-off links for “a single protocol.” Each system needs one connector, and any AI app that supports MCP can then use it.
No single company owns MCP now. In December 2025 Anthropic gave it to the Agentic AI Foundation, a group inside the nonprofit Linux Foundation. The goal was to keep it “vendor-neutral.” OpenAI co-founded the foundation with Anthropic and Block, and Google and Microsoft support it.
Network Doctor partner and co-founder David Birk explains how MCP works, and how to set it up safely, in our free AI Made Simple webinar on November 17. Before then, list the systems your firm relies on. Then ask each software maker if it has an MCP connector.
Three Questions MCP Can Answer for Your Firm
Once two or three systems are connected, you can ask questions like these three.
Finance meets operations. Your ticketing system does not know what each client pays you. Ask “Show me open service tickets for clients that bill over $10,000 a month.” The assistant reads both systems and joins the two lists.
Smarter collections. Ask “Which client has the most outstanding receivables?” With ticket history connected, it can also name the client contact who works with your team most. That person is often the best one to call about the bill.
Contract checks. A client agrees by email to a new monthly fee of $9,000. Ask whether the invoices since then match. The assistant compares the email thread with your accounting software.
Today each one means matching two reports by hand. Pick the one question you would ask first, and note which systems it touches.
Why MCP Is Only as Safe as Its Setup
Those answers come at a price. The assistant can now reach your billing, your inbox and your receivables. MCP itself does not protect that data. Its specification says “MCP itself cannot enforce these security principles at the protocol level.” Protection depends on the apps and connectors you choose, and on how they are set up.
Weak AI access rules already show up in breach data. IBM’s Cost of a Data Breach Report 2025 studied organizations that had a data breach. Of them, 13% reported a breach of an AI model or app.
“Of those compromised, 97% report not having AI access controls in place.”
IBM, Cost of a Data Breach Report 2025
Anthropic’s help pages say to “only connect services you trust and need for your workflows.” Use connectors from your AI vendor’s directory or from the maker of the system. After that, protection comes in three layers.
Layer One: Business AI Accounts
The first layer is the account your staff sign in to. Business AI accounts keep your firm’s chats out of the vendor’s model training by default. Free personal accounts often do not.
| Tool | Free or personal account | Business account |
|---|---|---|
| ChatGPT | Chats help train OpenAI’s models unless the user turns that off | Not used for training by default |
| Claude | Each user chooses whether chats help train | Not used for training by default |
| Gemini | Chats help improve Google’s AI while Keep Activity is on, and reviewers may read some | In Google Workspace, not used to train AI outside your firm without your permission |
| Copilot | Chats help train Microsoft’s models unless the user opts out | In Microsoft 365, prompts and work data are not used to train its foundation models |
If your firm pays for Microsoft 365, staff can sign in to Copilot Chat with their work account. They then get Microsoft’s enterprise data protection without the paid Copilot add-on. Other tools cost about $20 a person a month. Claude Team, for firms up to 150 people, lists at that price billed yearly.
A business account also puts settings in your hands. “Memory” means the assistant remembers past chats. On most new Claude Team plans, memory is on from the start. An owner can switch it off for the whole firm. A “connector” is the link between the assistant and one system. Staff cannot use one until an owner turns it on. Protect every account with an authenticator app or passkey, as our post on Microsoft retiring text-message codes explains.
Put everyone who uses AI for client work on a business account in your firm’s name.
Layer Two: A Browser Check on What Staff Paste
A good account does not stop a bad paste. Say an employee pastes a client’s Social Security number into a chat window. Once it is sent, no account setting can pull it back. The second layer catches it in the web browser first.
For that check, Network Doctor offers DefensX, one of our preferred security vendors. Its AI data protection checks what staff type into AI tools against words and patterns your firm sets. DefensX says a match is blocked before it reaches the AI tool. It also stops staff from turning on vendor training and keeps approved AI tools behind a company login. It works in the browsers staff already use and can keep a log of AI prompts. We ran a webinar with DefensX on this in July 2026, and the recording is free.
Microsoft 365 has its own rules to stop client data leaving in email or files. Our IT consulting team sets those up.
Ask us how a browser check would work in your office.
Layer Three: Access Rules for Every Connection
The third layer decides what the assistant may see. Give each AI connection the same permissions the person already has, and no more. Say a project manager cannot open payroll in your accounting software. Asking the assistant should not get them payroll either. On Claude’s business plans, each person normally signs in to each connector with their own account. Ask for personal sign-in on every connection.
Shared folders are where this matters most. An AI connection reaches whatever those folders reach. Evergreen owns Network Doctor and is also one of our clients. Its community manager put it this way.
“…you are dealing with a lot of access. We have folders and things that we’re constantly sharing from a finance and accounting level…”
Kristen Shepherd, Community Manager, Evergreen
You can also limit what a connection does. On a Claude business plan, an owner can let a connector read data but block any changes, for everyone in the firm. Start read-only, and leave payroll and HR systems unconnected at first.
Before connecting anything, have us list who can see what in each system. Then match every AI connection to that list.
A Five-Step Plan to Start Safely
Work through this list before the first connection.
- Move everyone who uses AI for client work onto business accounts, with memory and training set by the firm.
- Turn on a browser check for client data, such as Social Security and account numbers.
- Write down who can see what in each system you plan to connect.
- Connect one system through an approved connector, read-only, with personal sign-in.
- Review the prompt log after 30 days, then decide what to connect next.
Book a call or phone 201-735-7260, and our managed cybersecurity team will help with any step.
Questions Owners Ask About MCP
Is MCP the same as an API?
No. An API is the doorway one system offers to other software. Each AI tool used to need custom code for each one. MCP gives AI apps one shared way through those doorways, so one connector can work with any app that supports it.
Does ChatGPT work with MCP?
Yes. MCP’s own site names Claude and ChatGPT among the apps that connect through it.
Will our data be used to train AI models?
Not by default on the business plans of ChatGPT, Claude, Gemini in Google Workspace or Microsoft 365 Copilot. Free and personal accounts often allow training unless the user turns it off.
For Your IT Person
MCP authorization is optional. When an HTTP server supports it, the spec builds it on OAuth 2.1, so require it on every remote server. The security guidance forbids token passthrough (“MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server”). It also calls for scope minimization and least privilege. Prefer per-user delegated sign-in so source-system role-based access applies. Set org-wide tool permissions to read-only or “needs approval.” DefensX’s AI data protection needs its CORE+ package or above.
See AI Put to Work Safely
Join David Birk for our free 30-minute webinar, AI Made Simple and How to Put It to Work, on Tuesday, November 17, 2026, at 1:00 PM ET. David explains how MCP connects AI to your email, files and systems. Speakers from Third South Solutions show real examples of AI at work. You leave with a 30/60/90-day plan, and registrants also get the recording. We serve firms across New Jersey, New York and Pennsylvania from our Englewood Cliffs office.