Model Context Protocol (MCP)
The Model Context Protocol (MCP) is an open protocol through which AI applications connect tools, data and services in a uniform way.
Anthropic introduced MCP as an open protocol in November 2024; many applications and providers now support it. An MCP server provides tools, such as “place order” or “read calendar”, that an agent can call through an MCP client. For access, the specification provides authorization based on OAuth.
MCP governs how an agent calls a tool, not whether it may use it at this moment for this purpose. That question is answered by a check against the mandate before the call.
Example
An assistant may place orders with a supplier through an MCP server. Before the server runs the tool, it asks a decision service: is the order within the mandate? Only on “allowed” is the order placed, and a receipt records the result.
How it differs
An API key grants access without distinguishing between tasks. OAuth governs a client's access to resources. A mandate, by contrast, describes which action is allowed on whose behalf and within which limits, one level above.
In practice
- Grant tools per agent and task, not across the board for all agents of a server.
- Check calls with consequences, such as orders or payments, against a mandate before execution.
- Record the result of every such call in a receipt that references the decision.
Role in KYA
KYA verifies the evidence created around a tool call: the mandate, the decision before execution and the receipt afterwards. This makes it possible to show later that a call through MCP was allowed.
A term from the flow, not a check of its own. To the method
A gateway that checks tool calls against a mandate before execution is offered, for example, by the reference implementation Mandact (from the operator of KYA).
Frequently asked questions
What is MCP?
The Model Context Protocol, an open protocol through which AI applications connect tools and data sources in a uniform way. Anthropic introduced it in November 2024.
Is MCP secure?
MCP itself governs the connection and provides authorization based on OAuth. Whether a call is allowed in a given case must be checked additionally, for example against a mandate with limits.
How do you secure tools in MCP?
With least privilege per tool, a decision before every execution, receipts after execution and protection against injected instructions in the content being processed.