MCP Architecture: What Enterprise CTOs Must Know
MCP Architecture: What Enterprise CTOs Must Know
MCP architecture is a client-server standard that lets AI agents call enterprise tools and data through one governed connector layer.
Your agent pilots work. Then the fifth team asks for a custom connector to Salesforce, and security asks what the agents can actually reach.
MCP architecture answers both questions. This guide shows how the pieces fit, where MCP authorization lives, and when a CTO should standardize on it.
Key takeaways:
Gartner expects 40% of enterprise apps to include task-specific AI agents by the end of 2026, up from under 5% in 2025.
Ten agents and twenty systems mean 200 custom connectors. With MCP you build twenty servers once.
The June 2025 MCP spec treats every MCP server as an OAuth resource server, so authorization sits at the server.
IBM found 97% of organizations with an AI-related breach lacked proper AI access controls.
Start with two systems and one gateway. Add servers only after a security review.
MCP architecture is a client-server standard that lets AI agents call enterprise tools and data through one governed connector layer.
Your agent pilots work. Then the fifth team asks for a custom connector to Salesforce, and security asks what the agents can actually reach.
MCP architecture answers both questions. This guide shows how the pieces fit, where MCP authorization lives, and when a CTO should standardize on it.
Key takeaways:
Gartner expects 40% of enterprise apps to include task-specific AI agents by the end of 2026, up from under 5% in 2025.
Ten agents and twenty systems mean 200 custom connectors. With MCP you build twenty servers once.
The June 2025 MCP spec treats every MCP server as an OAuth resource server, so authorization sits at the server.
IBM found 97% of organizations with an AI-related breach lacked proper AI access controls.
Start with two systems and one gateway. Add servers only after a security review.
What Is MCP Architecture and How Does It Work?
What Is MCP Architecture and How Does It Work?
MCP architecture splits agent integration into hosts, clients and servers, so each tool is wrapped once and reused by every agent.
Anthropic released the Model Context Protocol in November 2024 as an open standard. Messages travel as JSON-RPC 2.0 over stdio or Streamable HTTP. An MCP server is a small service that exposes one system's tools, data and prompts in a standard format.
Before MCP, every agent needed its own code for every system. Ten agents talking to twenty systems means 200 integrations to build, secure and patch. With MCP, you write twenty servers and every agent reuses them.
That is why Gartner's forecast matters.
It expects 40% of enterprise applications to feature task-specific agents by the end of 2026. If you don't set a standard now, you'll set one later, after the sprawl. Our guide to agentic orchestration for enterprise CTOs covers the layer that sits above MCP.
MCP architecture splits agent integration into hosts, clients and servers, so each tool is wrapped once and reused by every agent.
Anthropic released the Model Context Protocol in November 2024 as an open standard. Messages travel as JSON-RPC 2.0 over stdio or Streamable HTTP. An MCP server is a small service that exposes one system's tools, data and prompts in a standard format.
Before MCP, every agent needed its own code for every system. Ten agents talking to twenty systems means 200 integrations to build, secure and patch. With MCP, you write twenty servers and every agent reuses them.
That is why Gartner's forecast matters.
It expects 40% of enterprise applications to feature task-specific agents by the end of 2026. If you don't set a standard now, you'll set one later, after the sprawl. Our guide to agentic orchestration for enterprise CTOs covers the layer that sits above MCP.
MCP Server Diagram: Hosts, Clients and Servers
MCP Server Diagram: Hosts, Clients and Servers
MCP Architecture: How a Request Travels
Host, client, server and system, with authorization checked at the server
In an MCP server diagram, the host app runs one client per server, and each server wraps one system such as an ERP, a database or a historian.
Three roles do the work:
Host: the AI application a user sees, such as an IDE, a chat app or your own agent runtime.
Client: a connector inside the host that keeps one session open with one server.
Server: the wrapper around a system. It lists its tools, resources and prompts, and runs the calls.
The diagram above shows the flow. The model never talks to your ERP directly. It asks the host, the host asks the client, and the server decides what runs.
Before any agent touches a server, test it by hand. The open-source Model Context Protocol Inspector lets you list tools and call them one at a time. Teams that skip this step find schema bugs in front of users.
In an MCP server diagram, the host app runs one client per server, and each server wraps one system such as an ERP, a database or a historian.
Three roles do the work:
Host: the AI application a user sees, such as an IDE, a chat app or your own agent runtime.
Client: a connector inside the host that keeps one session open with one server.
Server: the wrapper around a system. It lists its tools, resources and prompts, and runs the calls.
The diagram above shows the flow. The model never talks to your ERP directly. It asks the host, the host asks the client, and the server decides what runs.
Before any agent touches a server, test it by hand. The open-source Model Context Protocol Inspector lets you list tools and call them one at a time. Teams that skip this step find schema bugs in front of users.
MCP Resource vs Tool: What Each One Does
MCP Resource vs Tool: What Each One Does
In MCP, a resource is read-only context, a tool is an action the model can call, and a prompt is a reusable template the user picks.
The difference matters because each primitive has a different owner.
Applications control resources. The model controls tools. Users control prompts.
Primitive | Who controls it | Example | Main risk |
|---|---|---|---|
Resource | Application | A customer record or a log file | Over-sharing data |
Tool | Model | Create a ticket or update an order | Unwanted actions |
Prompt | User | A weekly report template | Low, but test the output |
Here's the rule we use.
Expose reads as resources. Expose writes as tools, and put human approval in front of anything that moves money, changes records or touches a plant system. A tool that can write is a tool that can be tricked.
In MCP, a resource is read-only context, a tool is an action the model can call, and a prompt is a reusable template the user picks.
The difference matters because each primitive has a different owner.
Applications control resources. The model controls tools. Users control prompts.
Primitive | Who controls it | Example | Main risk |
|---|---|---|---|
Resource | Application | A customer record or a log file | Over-sharing data |
Tool | Model | Create a ticket or update an order | Unwanted actions |
Prompt | User | A weekly report template | Low, but test the output |
Here's the rule we use.
Expose reads as resources. Expose writes as tools, and put human approval in front of anything that moves money, changes records or touches a plant system. A tool that can write is a tool that can be tricked.
MCP Authorization: Where Access Control Sits
MCP Authorization: Where Access Control Sits
MCP authorization uses OAuth 2.1 flows, with each MCP server acting as an OAuth resource server that checks tokens before running any tool.
The June 2025 spec revision made this explicit. Servers validate access tokens, and clients must use resource indicators (RFC 8707) so a token is only valid for the server it was issued for. That blocks a stolen token from working somewhere else.
Two mistakes show up often in reviews.
The first is token passthrough, where a server accepts a token meant for another service and forwards it. The spec forbids it. The second is a shared service account, so every agent run looks like one anonymous user in your logs.
Tie MCP authorization to your identity provider and your existing rules. Our enterprise AI governance framework for CTOs shows how to set who approves which scope.
MCP authorization uses OAuth 2.1 flows, with each MCP server acting as an OAuth resource server that checks tokens before running any tool.
The June 2025 spec revision made this explicit. Servers validate access tokens, and clients must use resource indicators (RFC 8707) so a token is only valid for the server it was issued for. That blocks a stolen token from working somewhere else.
Two mistakes show up often in reviews.
The first is token passthrough, where a server accepts a token meant for another service and forwards it. The spec forbids it. The second is a shared service account, so every agent run looks like one anonymous user in your logs.
Tie MCP authorization to your identity provider and your existing rules. Our enterprise AI governance framework for CTOs shows how to set who approves which scope.
MCP Authorization in Four Steps
OAuth 2.1 flow with the MCP server as resource server (spec revision 2025-06-18)
Enterprise AI Governance: Why Most Programs Stall in Year One
Enterprise AI Governance: Why Most Programs Stall in Year One
MCP Server Security Best Practices for Enterprise
MCP Server Security Best Practices for Enterprise
MCP server security starts with least-privilege scopes, an approved server registry, input validation and full logging of every tool call.
IBM's 2025 breach report found that 97% of organizations that reported an AI-related security incident had no proper AI access controls. Agents with broad tool access make that gap expensive. Use this checklist for MCP server security best practices:
Issue narrow scopes per tool, not one admin token per server.
Keep a registry of approved servers. Block unknown servers at the gateway.
Treat tool descriptions as untrusted input. A poisoned description can steer a model into a bad call.
Validate every argument on the server side, as you would for any public API.
Log who called which tool, with which arguments, and what came back.
Require approval for write actions, and test them with adversarial prompts.
Testing deserves its own budget. We cover that in agentic AI testing for CTOs.
MCP server security starts with least-privilege scopes, an approved server registry, input validation and full logging of every tool call.
IBM's 2025 breach report found that 97% of organizations that reported an AI-related security incident had no proper AI access controls. Agents with broad tool access make that gap expensive. Use this checklist for MCP server security best practices:
Issue narrow scopes per tool, not one admin token per server.
Keep a registry of approved servers. Block unknown servers at the gateway.
Treat tool descriptions as untrusted input. A poisoned description can steer a model into a bad call.
Validate every argument on the server side, as you would for any public API.
Log who called which tool, with which arguments, and what came back.
Require approval for write actions, and test them with adversarial prompts.
Testing deserves its own budget. We cover that in agentic AI testing for CTOs.
MCP vs Agentic AI and A2A Protocol vs MCP
MCP vs Agentic AI and A2A Protocol vs MCP
A2A Protocol vs MCP at a Glance
Different jobs, often used together
MCP
A2A protocol
MCP connects an agent to tools and data, the A2A protocol connects agents to each other, and agentic AI is the behavior both support.
People mix these up, so here is the split.
MCP vs agentic AI is not a fair fight, because agentic AI describes software that plans and acts, and MCP is one way to give it tools. The A2A protocol vs MCP question is about direction. Google announced A2A in April 2025 for agent-to-agent messaging, and it moved to the Linux Foundation in June 2025.
Most enterprises need both in time. MCP comes first, because every agent needs tools. A2A matters once agents from different teams or vendors must hand work to each other.
If you run several agents already, read our multi-agent AI orchestration guide before you pick a coordination pattern.
MCP connects an agent to tools and data, the A2A protocol connects agents to each other, and agentic AI is the behavior both support.
People mix these up, so here is the split.
MCP vs agentic AI is not a fair fight, because agentic AI describes software that plans and acts, and MCP is one way to give it tools. The A2A protocol vs MCP question is about direction. Google announced A2A in April 2025 for agent-to-agent messaging, and it moved to the Linux Foundation in June 2025.
Most enterprises need both in time. MCP comes first, because every agent needs tools. A2A matters once agents from different teams or vendors must hand work to each other.
If you run several agents already, read our multi-agent AI orchestration guide before you pick a coordination pattern.
MCP Connectors and MCP API: Build, Wrap or Buy
MCP Connectors and MCP API: Build, Wrap or Buy
MCP connectors should be bought for common SaaS apps, built for core systems, and wrapped around internal APIs you already trust.
An MCP API layer is not a copy of your REST API. A tool per endpoint gives the model 80 choices and it picks badly. Five to ten task-level tools, such as "find overdue invoices", work far better.
Use this split:
Buy: connectors for common SaaS apps, after a security review of the vendor.
Wrap: internal APIs that already have auth, rate limits and tests.
Build: servers for core systems where the logic is yours, like pricing or scheduling.
Developer-focused servers, such as the best MCP servers for Claude Code, suit an engineer's laptop. Don't copy them into production unchanged. Data access is the harder part, and our guide to AI data integration risk covers it.
MCP connectors should be bought for common SaaS apps, built for core systems, and wrapped around internal APIs you already trust.
An MCP API layer is not a copy of your REST API. A tool per endpoint gives the model 80 choices and it picks badly. Five to ten task-level tools, such as "find overdue invoices", work far better.
Use this split:
Buy: connectors for common SaaS apps, after a security review of the vendor.
Wrap: internal APIs that already have auth, rate limits and tests.
Build: servers for core systems where the logic is yours, like pricing or scheduling.
Developer-focused servers, such as the best MCP servers for Claude Code, suit an engineer's laptop. Don't copy them into production unchanged. Data access is the harder part, and our guide to AI data integration risk covers it.
Model Context Protocol in Manufacturing: A Plant Example
Model Context Protocol in Manufacturing: A Plant Example
In manufacturing, MCP servers can expose MES work orders and historian tags to an agent, while writes to PLCs stay off-limits.
Picture a downtime agent at a plant.
One MCP server wraps the MES and returns work orders. A second wraps the historian and returns tag trends as read-only resources. A third opens maintenance tickets, behind approval.
The agent can explain why Line 3 slowed down and open a ticket. It can't change a setpoint, because no server exposes that tool. That boundary is the design.
Model Context Protocol in manufacturing also forces a hard question about OT networks. Put servers in the IT zone, read from a replica, and never give an agent a path to the control layer.
In manufacturing, MCP servers can expose MES work orders and historian tags to an agent, while writes to PLCs stay off-limits.
Picture a downtime agent at a plant.
One MCP server wraps the MES and returns work orders. A second wraps the historian and returns tag trends as read-only resources. A third opens maintenance tickets, behind approval.
The agent can explain why Line 3 slowed down and open a ticket. It can't change a setpoint, because no server exposes that tool. That boundary is the design.
Model Context Protocol in manufacturing also forces a hard question about OT networks. Put servers in the IT zone, read from a replica, and never give an agent a path to the control layer.
A 90-Day Plan to Standardize on MCP
A 90-Day Plan to Standardize on MCP
A 90-day MCP rollout picks two systems, ships a gateway with OAuth and logging in month one, and adds servers only after a security review.
Here's a plan that fits most CTO teams:
Days 1-30: Pick two systems with real agent demand. Stand up a gateway with OAuth, a server registry and call logging.
Days 31-60: Ship both servers as read-only first. Test with the Inspector and with adversarial prompts.
Days 61-90: Add approved write tools behind human approval. Review logs weekly and set an owner for each server.
The edge case to plan for is version drift. The spec moves fast, so pin your SDK versions and schedule upgrades. A server nobody owns becomes a hole in your perimeter.
A 90-day MCP rollout picks two systems, ships a gateway with OAuth and logging in month one, and adds servers only after a security review.
Here's a plan that fits most CTO teams:
Days 1-30: Pick two systems with real agent demand. Stand up a gateway with OAuth, a server registry and call logging.
Days 31-60: Ship both servers as read-only first. Test with the Inspector and with adversarial prompts.
Days 61-90: Add approved write tools behind human approval. Review logs weekly and set an owner for each server.
The edge case to plan for is version drift. The spec moves fast, so pin your SDK versions and schedule upgrades. A server nobody owns becomes a hole in your perimeter.
Frequently Asked Questions
What is MCP architecture?
MCP architecture is the client-server design of the Model Context Protocol, where a host app runs clients that connect to MCP servers. Each server wraps one system and exposes its tools, resources and prompts in a standard format.
What is an MCP server?
An MCP server is a small service that exposes one system's tools, data and prompts to AI agents. It runs the calls and checks permissions, so the agent never touches the system directly.
How does MCP authorization work?
MCP authorization uses OAuth 2.1, with each MCP server acting as a resource server that validates access tokens. Clients use resource indicators so a token only works for the server it was issued for.
Is MCP secure enough for production?
MCP is secure enough when you add least-privilege scopes, an approved server registry, input validation and full call logging. The protocol gives you the hooks, but your team has to configure them.
What is the difference between A2A and MCP?
MCP connects an agent to tools and data, while the A2A protocol connects agents to each other. Most enterprises adopt MCP first and add A2A when agents from different teams must hand off work.
What is the difference between an MCP resource and a tool?
A resource is read-only context that the application controls, and a tool is an action the model can call. Put approval in front of any tool that writes data or moves money.
Conclusion
MCP architecture pays off when you standardize early, secure each server, and keep writes behind approval.
Pick two systems this week and list who can reach them today. Then stand up one gateway with OAuth and logging. If you want a second opinion on your design, the KGT team can review it with you.
Conclusion
MCP architecture pays off when you standardize early, secure each server, and keep writes behind approval.
Pick two systems this week and list who can reach them today. Then stand up one gateway with OAuth and logging. If you want a second opinion on your design, the KGT team can review it with you.
Sources:
Gartner - Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026, August 2025
Anthropic - Introducing the Model Context Protocol, November 2024
Model Context Protocol - Specification and Authorization, revision 2025-06-18
IBM - Cost of a Data Breach Report 2025
Google Developers Blog - Announcing the Agent2Agent Protocol, April 2025
Linux Foundation - Agent2Agent Protocol Project Launch, June 2025
Sources:
Gartner - Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026, August 2025
Anthropic - Introducing the Model Context Protocol, November 2024
Model Context Protocol - Specification and Authorization, revision 2025-06-18
IBM - Cost of a Data Breach Report 2025
Google Developers Blog - Announcing the Agent2Agent Protocol, April 2025
Linux Foundation - Agent2Agent Protocol Project Launch, June 2025
Protocol AI Newsletter
Practical insights on AI, automation, and intelligent systems focused on real-world applications, not hype.
