What is MCP (Model Context Protocol)?

What changes when AI assistants can use your app through MCP?

MCP turns your product into something an AI assistant can use, not only something a person clicks through. Your customers can ask their assistant to create a ticket, update a record or pull a report from your app. That is a feature customers increasingly ask for, and a new way in to their data.

The engineering question is the same as for any integration, with higher stakes: an agent must never be able to do more than the person who connected it, whatever the model decides to try.

What is an MCP server?

An MCP server is the part of an application that speaks the Model Context Protocol: it describes what AI assistants may do in the app and carries out their requests. It offers three building blocks: tools the assistant can call, resources it can read for context, and prompts a user can pick.

It is a new front door to your data, used by software that follows instructions from text it reads, so it needs everything a public API needs and a little more.

How does MCP work?

The specification names three parts. The host is the AI application a person uses. Inside it, a client holds the connection to one server. The server is your side, offering tools, resources and prompts. The three exchange JSON-RPC 2.0 messages.

The design borrows from the Language Server Protocol, which did the same job for code editors. A client can also offer the server elicitation: a way to ask the user for more information mid-task.

For servers reached over HTTP, the specification bases sign-in on OAuth 2.1. The server must check that each access token was issued for it specifically, must answer an invalid or expired token with a 401, and must not pass tokens through to other services. Tokens never go in the URL.

What mistakes make an MCP server unsafe?

An MCP server becomes unsafe when it trusts tool descriptions, uses a service-wide key so the agent sees data the person cannot, accepts any bearer token instead of only ones issued for it, or writes without explicit user consent. Each mistake lets an agent do more than the person who connected it.

• Trusting tool descriptions. The specification says annotations describing tool behaviour should be treated as untrusted unless the server is trusted.
• Using a service-wide key for every call, so the agent sees data the person cannot. In a Supabase app this bypasses row-level security.
• Accepting any bearer token instead of only ones issued for this server.
• Writes without consent. The specification expects hosts to get explicit user consent before invoking a tool.

What does an MCP server need before real users connect?

Before real users connect, an MCP server needs proper sign-in and consent, every call checked against that person's own permissions, rate and spending limits on tools that write or cost money, an audit log that attributes each action to the agent and the person, and a way for the owner to switch agents off.

• Proper sign-in and consent, usually OAuth, so a person chooses what the agent may do.
• Every call checked against that person's own permissions, never broader ones.
• Rate and spending limits on tools that write or cost money.
• An audit log that attributes every action to the agent and the person behind it.
• A way for the owner to switch agents off.

How does Looph run MCP in production?

Looph's MCP server, live since September 29, 2026, is a separate app with its own OAuth sign-in and consent screen. For every request it mints a sixty-second database token for that person, so their own row-level security decides every row.

It offers 28 tools, 12 read and 16 write, logs and attributes every action, and the workspace owner can switch agents off at any time.

If you want an MCP server on a product built with Lovable, the database permissions underneath have to be right first. Our production readiness check tests them, and a vibe coding rescue fixes what it finds.