--- title: "What is MCP? Model Context Protocol for founders | Len P. van der Hof" description: "MCP is a contract for how a model calls tools: what it may see, what it may change, and how the call is logged. A server without a contract is a hole in the…" image: "https://lenvanderhof.com/media/generated/blog-hero-mcp-en-v2.7bfe3204e897.wide.webp" --- [AI Systems](https://lenvanderhof.com/en/blog/category/ai-systems/) Research guide # MCP explained for founders Care about the permission and the log. The logo on the protocol is the least interesting part. Len P. van der HofPublished 16 August 20265 min read Permission and a log. The logo on the protocol is noise. Direct answer MCP, the Model Context Protocol, is a contract for how a language model calls tools. The contract names what the model may see, what it may change, and how each call is logged. A founder should treat an MCP server like an API with production credentials: no anonymous tools, no undocumented write paths, no server that can spend or delete without a ceiling. Without that contract you do not have integration. You have a hole in the repository. ## Key takeaways - MCP is an interface contract, not a product you buy. - Read three things: visibility, mutation, and the log. - A tool without a ceiling is a junior hire with root. - STACK is where those contracts live in a repo that humans and agents share. Founders keep hearing “we added MCP” the way they used to hear “we added an API.” Both sentences are empty until someone names the permission. ## What MCP actually is [MCP](https://lenvanderhof.com/glossary/mcp/), the Model Context Protocol, is an open standard for connecting an AI application to external systems. The first-party docs (tree labelled 2026-07-28, re-read 2026-08-18) say the protocol focuses on context exchange. It does not dictate how the application uses a language model or how it manages the context it just received. Three participants. The **host** is the application that coordinates. The **client** is one connection to one server. The **server** is the program that exposes context. The host creates one client per server. The host is where policy lives. Three primitives on the server, in founder English: - **Tools** are actions. They can write: send mail, call an API, change a file, move money if you were foolish enough to wire that. - **Resources** are context. Read-oriented. A customer record, a spec, a log. - **Prompts** are reusable templates. Not a permission. You do not need the spec memorised. You need three answers in writing for every server you attach to an [agent](https://lenvanderhof.com/glossary/ai-agent/): 1. **Visibility.** What can this tool or resource read? Files, mail, a database, a customer list. Which class of data. Whose credentials. 2. **Mutation.** What can it change, send, merge, close, or delete? 3. **Log.** Where does the call land so a human can reconstruct Tuesday: who, which tool, a summary of arguments, result class, timestamp, a correlator. If any answer is “it depends,” the server is not ready. “It depends” is how a helpful agent mails a customer from a draft you never approved. Walk one pair out loud. “List customers” is a read. “Send the renewal reminder” is a write. If both live on the same server with the same credentials, you have already lost the ceiling. ## Permission is a blast radius A ceiling is the worst thing that happens if the model is wrong and the host is sleepy. Prefer a read-only server before a write server. Split them when you can. Allowlist tools on the host. Do not take “all tools from this server.” The specification tells clients to treat tool annotations as untrusted unless the server itself is trusted. Do not outsource the ceiling to the server’s self-description. The [override doctrine](https://lenvanderhof.com/glossary/override-doctrine/) is the written refuse-list: spend above a ceiling, speak as the company, change production data, close a judgment you still own. It complements the contract. The contract says what this server may do. The doctrine says what it must refuse. Write both before the tool that can send. Authorization in MCP is optional. The docs recommend it when user data, audit, consent, or per-user limits matter. Optional is the word that should keep you awake. A local server with an environment secret can still be root-shaped. ## Write paths and Tuesday’s log Tools are model-controlled. The protocol does not mandate a specific user interface. Applications should keep a human able to deny a call. “Should” is not a gate you can audit. Treat send, spend, delete, and production mutation with the seriousness of a payment integration. Review the first ten calls. After that, the log is the review. No log, no write tool. Ask for Tuesday. “Show me every send from this server between 09:00 and 18:00.” If nobody can, the contract is incomplete. Official security guidance warns about token passthrough for the same reason: a server that accepts a token not issued for it breaks the audit trail. You cannot reconstruct Tuesday if the log belongs to someone else’s audience. ## What MCP is not It is not a moat. Competitors can attach the same open protocol. It is not safety by itself. A protocol that can write is as dangerous as any other write API. First-party security pages exist because confused-deputy problems, token misuse, and malicious metadata URLs are in scope. The protocol catalogues those risks. It does not remove them. It is not a model. It is not an agent runtime. An [agentic workflow](https://lenvanderhof.com/en/blog/agentic-workflow-vs-automation/) still needs a goal, a charter, and a ceiling. MCP is how that worker is allowed to touch the building, not a substitute for the worker definition in [What is an AI agent?](https://lenvanderhof.com/en/blog/what-is-an-ai-agent/). It is not a substitute for [STACK](https://lenvanderhof.com/frameworks/stack/). STACK is the five-layer repo architecture: structure, toolchain, agent configuration, connection, knowledge and quality. MCP sits in the connection layer, with tool contracts, hooks, and a real failure story. If your rules live in five tools and your MCP servers have no owners, you have agentic repo debt. The protocol did not cause it. The missing contract did. A team that cannot [hand work across a boundary](https://lenvanderhof.com/en/blog/why-multi-agent-systems-fail/) will not be saved by a cleaner server. Coordination and connection are different jobs. ## A founder review in fifteen minutes Ask the person who “added MCP” to walk a single tool. - Who owns this server in the repo? - Local or remote? Whose credentials? - What is the authority ceiling? - What does the override doctrine forbid this tool to do? - If it sends, spends, or deletes, who reviews the first ten calls? - If we unplug it at 17:00, what breaks? - Show me last Tuesday’s log for this tool. You are not asking for a demo. You are asking for the same things you ask of a new production integration. Treat it that way and MCP becomes boring, which is the goal. The [public specification](https://modelcontextprotocol.io/) is the first-party source. The architecture page in the 2026-07-28 docs tree is where host, client, server, and primitives are defined. Re-read both before you pin a version. This page will not keep up with every wrapper. ## Where this sits [The Agentic Codebase](https://lenvanderhof.com/books/the-agentic-codebase/) is the book that treats the agent OS as something you version like the app. The [introduction](https://lenvanderhof.com/en/blog/the-agentic-codebase-introduction/) is the book page. MCP is the contract on the connection. Pin a version. Re-read the first-party docs. Then make the server boring. Cite this:MCP explained for founders.Len P. van der Hof. [https://lenvanderhof.com/en/blog/mcp-explained-for-founders/](https://lenvanderhof.com/en/blog/mcp-explained-for-founders/) · Published 16 August 2026. ## Terminology - [MCP](https://lenvanderhof.com/glossary/mcp/) - [STACK](https://lenvanderhof.com/glossary/stack/) - [Override doctrine](https://lenvanderhof.com/glossary/override-doctrine/) ## Sources 1. [MCP (glossary)](https://lenvanderhof.com/glossary/mcp/) 2. [STACK framework](https://lenvanderhof.com/frameworks/stack/) 3. [The Agentic Codebase](https://lenvanderhof.com/books/the-agentic-codebase/) 4. [Model Context Protocol specification](https://modelcontextprotocol.io/) · MCP project 5. [MCP architecture (docs tree 2026-07-28)](https://modelcontextprotocol.io/docs/2026-07-28/learn/architecture) · MCP project 6. [MCP security best practices (docs tree 2026-07-28)](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) · MCP project ## Related essays - [What is an AI agent?](https://lenvanderhof.com/en/blog/what-is-an-ai-agent/) - [The Agentic Codebase: introduction](https://lenvanderhof.com/en/blog/the-agentic-codebase-introduction/) - [Version the agent OS](https://lenvanderhof.com/en/blog/stack-version-the-agent-os/) - [An agentic workflow is not an automation](https://lenvanderhof.com/en/blog/agentic-workflow-vs-automation/) - [LLM integration is an operating-design problem](https://lenvanderhof.com/en/blog/llm-integration-is-operating-design/) - [MCP meaning: Model Context Protocol, not a product](https://lenvanderhof.com/en/blog/mcp-meaning/) - [What is STACK? Five layers, not a vendor diagram](https://lenvanderhof.com/en/blog/what-is-stack/) ## Further reading - [MCP (glossary)](https://lenvanderhof.com/glossary/mcp/) - [STACK](https://lenvanderhof.com/frameworks/stack/) - [The Agentic Codebase](https://lenvanderhof.com/books/the-agentic-codebase/) - [The Agentic Codebase (introduction)](https://lenvanderhof.com/en/blog/the-agentic-codebase-introduction/) - [What is an AI agent?](https://lenvanderhof.com/en/blog/what-is-an-ai-agent/) - [An agentic workflow is not an automation](https://lenvanderhof.com/en/blog/agentic-workflow-vs-automation/) About the author ## [Len P. van der Hof](https://lenvanderhof.com/en/authors/len-p-van-der-hof/) Entrepreneur, AI Innovator and Venture Builder Len P. van der Hof builds practical AI systems, digital ventures and evidence-informed tools for founders. ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Person", "@id": "https://lenvanderhof.com/#person", "name": "Len P. van der Hof", "alternateName": [ "Len van der Hof", "L.P. van der Hof", "Leendert Pieter van der Hof" ], "honorificSuffix": "MSc", "url": "https://lenvanderhof.com/", "image": [ "https://lenvanderhof.com/photos/len-portrait-1.jpg", "https://lenvanderhof.com/photos/len-portrait-2.jpg", "https://lenvanderhof.com/photos/len-portrait-3.jpg", "https://lenvanderhof.com/photos/len-portrait-4.jpg", "https://lenvanderhof.com/photos/len-speaking.jpg", "https://lenvanderhof.com/photos/len-hero.jpg" ], "jobTitle": "Entrepreneur, AI Innovator and Venture Builder", "description": "Len P. van der Hof, MSc, is a Dutch entrepreneur and AI innovator in Zwijndrecht. He builds ReasonKit, MindSesh, Undominated.ai, books under his name, the fiction imprint LPH98.lifestyle, and technology ventures through LPH98.ventures. Eleven titles in Systems for the Strategic Self are available now, in English and Dutch.", "address": { "@type": "PostalAddress", "addressLocality": "Zwijndrecht", "addressCountry": "NL" }, "alumniOf": { "@type": "CollegeOrUniversity", "name": "Rotterdam School of Management, Erasmus University" }, "knowsAbout": [ "Artificial intelligence", "AI agents", "Agentic AI systems", "LLM routing", "SEO", "Generative engine optimization", "Answer engine optimization", "Venture building", "Founder performance", "Founder psychology", "Evidence-based decision-making" ], "sameAs": [ "https://www.linkedin.com/in/lenvanderhof/", "https://x.com/LenvanderHof", "https://www.youtube.com/channel/UCTG20buKqYYbitqqf7l3zJA", "https://www.instagram.com/Lenvanderhof/", "https://www.threads.com/@lenvanderhof", "https://github.com/Lenvanderhof", "https://huggingface.co/LPH98", "https://www.npmjs.com/~lenvanderhof", "https://www.goodreads.com/author/show/70983905.Len_P_van_der_Hof", "https://www.amazon.com/author/lenvanderhof", "https://www.bol.com/nl/nl/b/len-p-van-der-hof-msc/609879394/", "https://bsky.app/profile/lenvanderhof.com", "https://mastodon.social/@Lenvanderhof", "https://crates.io/users/Lenvanderhof", "https://cursor.com/@Lenvanderhof", "https://medium.com/@Lenvanderhof", "https://gitlab.com/Lenvanderhof", "https://hub.docker.com/u/lenvanderhof/", "https://dev.to/lenvanderhof", "https://www.facebook.com/Lenvanderhof", "https://soundcloud.com/Lenvanderhof" ], "affiliation": [ { "@id": "https://lenvanderhof.com/#publisher" }, { "@id": "https://lenvanderhof.com/#mindsesh" }, { "@id": "https://lenvanderhof.com/#lifestyle" } ] }, { "@type": "WebSite", "@id": "https://lenvanderhof.com/#website", "url": "https://lenvanderhof.com/", "name": "Len P. van der Hof", "description": "Len P. van der Hof, MSc, is a Dutch entrepreneur and AI innovator in Zwijndrecht. He builds ReasonKit, MindSesh, Undominated.ai, books under his name, the fiction imprint LPH98.lifestyle, and technology ventures through LPH98.ventures. Eleven titles in Systems for the Strategic Self are available now, in English and Dutch.", "inLanguage": [ "en", "nl" ], "publisher": { "@id": "https://lenvanderhof.com/#person" } }, { "@type": "Organization", "@id": "https://lenvanderhof.com/#publisher", "name": "LPH98.ventures", "url": "https://lph98.ventures", "founder": { "@id": "https://lenvanderhof.com/#person" } }, { "@type": "Organization", "@id": "https://lenvanderhof.com/#mindsesh", "name": "MindSesh", "url": "https://mindsesh.net", "founder": { "@id": "https://lenvanderhof.com/#person" } }, { "@type": "SoftwareApplication", "@id": "https://lenvanderhof.com/#reasonkit", "name": "ReasonKit", "url": "https://reasonkit.sh", "creator": { "@id": "https://lenvanderhof.com/#person" } }, { "@type": "SoftwareApplication", "@id": "https://lenvanderhof.com/#undominated", "name": "Undominated.ai", "url": "https://undominated.ai", "creator": { "@id": "https://lenvanderhof.com/#person" } }, { "@type": "Organization", "@id": "https://lenvanderhof.com/#lifestyle", "name": "LPH98.lifestyle", "url": "https://lph98.lifestyle", "founder": { "@id": "https://lenvanderhof.com/#person" } }, { "@type": "ImageObject", "@id": "https://lenvanderhof.com/en/blog/mcp-explained-for-founders/#primaryimage", "url": "https://lenvanderhof.com/media/generated/blog-hero-mcp-en-v2.7bfe3204e897.wide.webp", "contentUrl": "https://lenvanderhof.com/media/generated/blog-hero-mcp-en-v2.7bfe3204e897.wide.webp", "representativeOfPage": true }, { "@type": "BreadcrumbList", "@id": "https://lenvanderhof.com/en/blog/mcp-explained-for-founders/#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://lenvanderhof.com/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://lenvanderhof.com/en/blog/" }, { "@type": "ListItem", "position": 3, "name": "AI Systems", "item": "https://lenvanderhof.com/en/blog/category/ai-systems/" }, { "@type": "ListItem", "position": 4, "name": "MCP explained for founders", "item": "https://lenvanderhof.com/en/blog/mcp-explained-for-founders/" } ] }, { "@type": "WebPage", "@id": "https://lenvanderhof.com/en/blog/mcp-explained-for-founders/#webpage", "url": "https://lenvanderhof.com/en/blog/mcp-explained-for-founders/", "name": "MCP explained for founders", "description": "MCP is a contract for how a model calls tools: what it may see, what it may change, and how the call is logged. A server without a contract is a hole in the repo.", "isPartOf": { "@id": "https://lenvanderhof.com/#website" }, "primaryImageOfPage": { "@id": "https://lenvanderhof.com/en/blog/mcp-explained-for-founders/#primaryimage" }, "breadcrumb": { "@id": "https://lenvanderhof.com/en/blog/mcp-explained-for-founders/#breadcrumb" }, "inLanguage": "en-GB" }, { "@type": "BlogPosting", "@id": "https://lenvanderhof.com/en/blog/mcp-explained-for-founders/#article", "mainEntityOfPage": { "@id": "https://lenvanderhof.com/en/blog/mcp-explained-for-founders/#webpage" }, "headline": "MCP explained for founders", "description": "MCP is a contract for how a model calls tools: what it may see, what it may change, and how the call is logged. A server without a contract is a hole in the repo.", "datePublished": "2026-08-16T09:00:00.000Z", "author": { "@id": "https://lenvanderhof.com/#person" }, "publisher": { "@id": "https://lenvanderhof.com/#person" }, "image": [ "https://lenvanderhof.com/media/generated/blog-hero-mcp-en-v2.7bfe3204e897.square.webp", "https://lenvanderhof.com/media/generated/blog-hero-mcp-en-v2.7bfe3204e897.landscape.webp", "https://lenvanderhof.com/media/generated/blog-hero-mcp-en-v2.7bfe3204e897.wide.webp" ], "articleSection": "AI Systems", "inLanguage": "en-GB" } ] } ```