What MCP is and why it matters for finance

Model Context Protocol (MCP) is the open standard — introduced by Anthropic in November 2024 — through which AI models connect uniformly to external systems, comparable to USB-C for data integrations. For finance this is the link between AI and your accounting system: without MCP a library with no front desk, with MCP a model that can read open items, propose journal entries, and fetch bank balances — standardized, auditable, and reusable.

An AI model that only talks based on its training is a library without a front desk. It knows a lot — how a ledger works, roughly what IFRS 15 says, how a variance analysis is structured — but it can't pull anything out of your accounting system and it can't put anything back. The moment you want a model to read an open-items list, post a journal entry, or fetch a bank balance, you need a connection. Model Context Protocol (MCP) is the standard that makes those connections uniform.

For finance, MCP is specifically relevant: it's the layer where AI applications meet the accounting system without building a custom integration for every combination of AI tool and accounting package.

Why MCP exists

Before MCP, every AI vendor had its own connector system. OpenAI had plug-ins, Microsoft had Copilot connectors, every tool built its own integration per model. For every combination of AI + tool, code had to be written. That doesn't scale: 50 models × 500 tools = 25,000 integrations.

Anthropic published MCP in 2024 as an open protocol. The principle is simple: a tool provider builds one MCP server. Every AI model that speaks MCP can talk to it directly. The tool provider writes the integration once; it works in Claude, ChatGPT, Cursor, and Copilot. Like USB-C: one plug, many devices.

By early 2026 MCP has broad adoption. Anthropic, OpenAI, Microsoft, and Google all support the protocol. The public MCP ecosystem counts more than 10,000 servers — from Notion and GitHub to Supabase, Gmail, SharePoint, browser automation, local file systems, and — for finance — integrations with Exact and other accounting packages.

How MCP technically works

MCP is a client-server protocol. The AI application is the client (Claude Desktop, Cursor, a custom agent or platform). The tool provider runs a server — software that describes in a standardized format which actions are available and how to call them.

An MCP server provides three types of objects:

• Tools — actions the model can execute: "fetch open invoices," "create a draft journal entry," "send a mail draft." Each with parameters and a description.
• Resources — data the model can fetch: a ledger-account balance, a file, a calendar item.
• Prompts — predefined prompt templates the server offers.

At startup, the AI client discovers what tools the server offers. During a conversation, the model decides on its own which tool is needed, calls it with the right parameters, receives the result, and weaves it into the answer. To the user, that looks like one fluent conversation; under the hood, client and server exchange structured messages.

The security layer is tight by design: you grant permission per server, the server runs locally or under your cloud account, and many clients ask explicit confirmation on write actions. For finance the last point is critical: an MCP server that can create postings should always run through an approval layer.

What's different from traditional API integrations

A classic API integration is custom-built for one application. You write code that authenticates, knows the right endpoints, transforms data, handles errors. For every new tool, again.

MCP flips it. The tool provider describes its API once as an MCP server. Every AI model that understands MCP automatically knows:

• which actions are available,
• which parameters they need,
• what the result looks like.

No code on the AI side. No custom wrappers. You connect the server, supply credentials, and the model can work with it.

What MCP can mean for finance

The most interesting applications for SME and scale-up finance:

• Accounting MCP (Exact, Twinfield, AFAS) — so AI can directly query open items, read balances, or — via an approval layer — create draft postings. This is the heart of AI work in finance.
• Banking MCP — fetch bank statements directly for reconciliation flows, monitor payment statuses.
• MS365 MCP — Outlook, calendar, SharePoint, and OneDrive directly accessible for finance context (consult the close manual, draft mails, drop the board pack into SharePoint).
• Fireflies MCP — pull meeting transcripts for automatic follow-ups after customer calls or audit meetings.
• Notion or fileshare MCP — access to internal knowledge bases (your tax handbook, KPI documentation).

Concrete example: a controller connects an accounting MCP to an AI platform, asks "which open debtors are older than 60 days and what is the total?". The AI calls the right tool, receives the data, and gives a direct answer — no export, no Excel intermediate step, no manual aggregation.

How MCP differs from connectors

Large AI platforms also offer their own "connectors" — pre-built integrations you switch on with one click (Copilot for Outlook, ChatGPT for Gmail or Drive). The difference with MCP:

• Connectors are built by the platform, limited in number, and work only inside that platform.
• MCP servers can be built by anyone, are cross-platform, and often run locally or under your own cloud account.

In practice you use both. Connectors for the standard work (mail, calendar, drive) because they're easy to switch on and maintained by the platform vendor. MCP for specific tools or finance systems with no connector — for example the direct accounting link platform connectors typically don't offer.

Three questions before deploying an MCP server in finance

1. What can the server do technically? Read-only, or also write, delete, prepare payments? An accounting MCP that only reads is an order of magnitude less risky than one that can post.
2. Where does the server run? Locally, in your own cloud, or with an external provider? For finance, this determines where your customer numbers go. EU hosting and a data processing agreement are almost always required for customer data.
3. Who built it? Official servers from an accounting vendor or a serious AI provider are low risk. An unknown open-source MCP server from a random GitHub account that suddenly gets access to your books isn't — especially since we've seen MCP servers in practice contain hidden prompt-injection patterns.

The governance side

For finance, MCP isn't optional in terms of governance. The moment one controller installs an MCP server that can read the whole customer database, a GDPR question lands on the table. A few minimal agreements:

• List of approved MCP servers per role — like a list of approved software.
• Separate read and write — start read-only, upgrade to read-write only when the workflow is proven and the approval layer is in place.
• Audit trail — most AI clients log which tool calls were made; make sure those logs are kept and reviewable at finance level.
• Sandbox tenant — experiments with write actions on a test tenant, not on production.

MCP is the layer where AI stops being an information tool and becomes an operational system for finance. Done right, this turns AI from something that helps the controller into something doing work inside the finance process. Done sloppily, you open a channel through which accounting data can flow out unchecked.