An MCP server is the software a company runs so AI assistants like ChatGPT and Claude can use its tools and data, and for a small business it's what sits behind the ChatGPT apps and Claude connectors you're invited to switch on. MCP stands for Model Context Protocol, an open standard, and the server decides what the assistant can look up or change once it's connected to your business. Before you point one at your bank, books or loan files, learn to read what a server can do and who runs it.
What is an MCP server, in small business terms?
The protocol's own documentation calls MCP "an open-source standard for connecting AI applications to external systems" and likens it to a USB-C port for AI apps (modelcontextprotocol.io, read October 17, 2026). A protocol is an agreed set of rules for how two programs talk. The AI app is the client, and the company on the other end runs the server, which publishes a list of what it can do.
Each item on that list is a tool, a single action the assistant can ask for. The MCP specification (version 2026-07-28) says tools let a model "interact with external systems, such as querying databases, calling APIs, or performing computations." Ask Claude what the business spent on fuel last quarter, and it picks a tool from a connected server, sends the details that tool needs and works the result into its answer.
For an owner, the server is what sets the limits. If your accounting software's server only offers tools that read reports, the assistant can't post an entry through it, however you word the request.
How MCP shows up in ChatGPT and Claude
In ChatGPT, servers reach you as plugins in the ChatGPT Directory, the word OpenAI's plugin guidelines use today, though some older OpenAI pages still say "apps." In Claude they're connectors, found in Claude's directory or added by hand as a custom connector from a server address.
| Where you find it | What it's called | Who checked it first |
|---|---|---|
| ChatGPT | Plugin in the ChatGPT Directory | OpenAI, against its plugin guidelines |
| Claude's directory | Connector (labeled Community or Verified) or plugin | Anthropic: an automated scan of every listing, plus a test of each tool for Verified connectors |
| Claude, added by address | Custom connector | No directory review, so the checking falls to you |
Read-only vs write access: the labels on every tool
With financial data, this line matters most. A read-only tool looks something up or runs a calculation and leaves everything as it was. A write tool creates, changes or deletes something, such as a new invoice or an edited customer record. MCP lets a server attach annotations, short labels describing how each tool behaves, and both directories make them mandatory.
Anthropic's review checklist requires every listed tool to carry readOnlyHint if it only reads, or destructiveHint if it modifies or deletes data. Those labels drive Claude's permissions: "Read-only tools can run without per-call confirmation, and destructive tools always prompt" (Anthropic connector checklist, read October 17, 2026). Anthropic also rejects a single catch-all tool that both reads and writes. OpenAI tells developers to mark "retrieval, computation, or previews that do not modify the environment" as read-only, and adds that the labels "do not grant permission or replace authentication."
The specification adds a caution: AI apps "MUST consider tool annotations to be untrusted unless they come from trusted servers." A label is the server describing itself, so it's only as reliable as the company that wrote it, and Claude's help center advises choosing "Allow always" only for a server and tool you trust to run unsupervised.
| Tool you might be offered | Reads or writes | A sensible permission |
|---|---|---|
| Show last month's Profit & Loss Statement (P&L) or an aging report | Reads | Allow without asking each time, once you trust the server |
| Recategorize bank transactions or send an invoice | Writes | Approve each run |
| Pay a bill or move funds | Writes and moves money | Not accepted in either directory, so treat a custom server offering it as a red flag |
How MCP connections are secured: no sign-in or OAuth
A server that hands out public information, such as a payment calculator, can work with no sign-in, and Claude's custom connector form includes a "No sign in" option. A server that opens your accounts typically uses OAuth, the familiar "sign in with" flow where you log in on the provider's own page and approve the access requested, so your password never goes into the chat. Anthropic's help center says you "typically go through an OAuth authentication process to securely sign in," and that you can revoke access at any time by disconnecting the connector in Claude's settings.
OpenAI requires a signed-in plugin's flow to be "transparent and explicit," with users told about every permission it requests. Read that permission screen like a loan agreement: if a tool that only reads invoices asks to manage your whole account, stop.
What ChatGPT and Claude check before listing a server
Both companies publish their review rules, and they overlap on the points that matter most for business data (as of October 17, 2026).
| Check | Anthropic (Claude directory) | OpenAI (ChatGPT Directory) |
|---|---|---|
| Tool labels | Title plus read-only or destructive label on every tool | Explicit true or false labels on every tool |
| Data collection | Nothing from the conversation beyond what the tool needs; no access to Claude's memory, chat history or user files | Only the minimum data needed; no payment card data, health information, government identifiers or passwords |
| Published documents | Public documentation by the publish date | A privacy policy covering data categories, purposes, recipients, retention and user controls |
| Money movement | Connectors that transfer money, crypto or other financial assets aren't accepted | Executing money transfers, crypto transfers or investment trades is prohibited |
A directory listing is a floor. It doesn't cover a custom connector you add by address, and Anthropic's help center warns that "malicious MCP servers may include hidden instructions that try to make Claude perform unintended actions."
Is it safe to connect AI tools to my business accounts? A five-point checklist
It can be, when you know what the server does and who's behind it. Run these five questions before any MCP server touches bank, accounting or loan data.
| Question | Where to look | What should stop you |
|---|---|---|
| 1. Who runs it? | The directory listing and the server address | A domain that doesn't match the company (Anthropic expects the two to match) |
| 2. Does it read, write or both? | The tool list in your ChatGPT or Claude settings | Write tools you didn't expect, or one do-everything tool |
| 3. What data does it receive? | The provider's docs and privacy policy | Requests for passwords, full account numbers or a Social Security number |
| 4. What does it keep, and who gets it? | The privacy policy's retention and sharing sections | No retention period, or sharing with unnamed third parties |
| 5. How do you disconnect? | App settings and the provider's docs | No clear way to revoke access |
Then match the permission to the data. Asking an assistant to summarize a statement you exported, list the bank statements lenders often want or compare offers you hold is low risk, while anything that writes to your books deserves approval each time. Keep online banking logins, full account numbers and your Social Security number out of the chat, and don't connect a tool that can move funds. The business loan documents checklist covers what lenders ask for once you apply.
An MCP server example in finance: EQ Funding's lender match
EQ Funding's own MCP server makes a useful worked example of a low-risk finance server. Every fact below comes from EQ Funding's AI assistants page and privacy policy (updated October 16, 2026), both read October 17, 2026.
It works as a plugin in ChatGPT, and in Claude the AI assistants page has you add it as a custom connector from its eqfunding.com address. It offers four tools: match lenders, list funding products (eight kinds of business financing with typical ranges), build a document checklist and estimate a payment. The page says all four are read-only: they look things up or calculate and never change anything, and you need no account or sign-in to use them.
| Checklist question | EQ Funding's answer |
|---|---|
| Who runs it? | EQ Funding, a financing marketplace; the Claude address sits on eqfunding.com |
| Reads or writes? | Reads only; you apply on eqfunding.com yourself |
| What it receives | Business answers only, such as purpose, location, amount, time in business, monthly revenue and an approximate credit score if you give one |
| What it never asks for | Your name, contact details, Social Security number, bank details, login details or documents |
| What it keeps | Answers aren't stored or sent to lenders; hosting logs keep items like time and result status, without your answers |
| Lender names | Shows the type of each lender that fits; names appear in the application on eqfunding.com |
| Disconnecting | Any time, in ChatGPT's or Claude's settings |
Take the page's own sample question: a 2-year-old trucking company in Texas asking about a $150,000 equipment loan. The match tool answers with how many lenders in the network fit, the type of each, the typical time to an offer and the documents each asks for. It doesn't quote rates, so a payment estimate uses a rate you pick. At a 10% what-if rate over five years, the standard fixed-rate formula gives about $3,187 a month, $191,223 in total and $41,223 in interest. Offers themselves come from lenders after they review an application.
When you're ready, the assistant can hand you a link that opens EQ Funding's application with your answers filled in. EQ Funding doesn't lend or approve anyone. It routes one application to lenders in its network who compete to fund the business, for business term loans, SBA loans and more, and lenders see your information only if you submit that application.