Agent Access to Enterprise Data (MCP)

What it is

The protocol defines a common way for an AI application to reach a tool or a data source, so that each connection does not have to be built separately. On 9 December 2025 its originator announced that it was donating the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation, co-founded with two other companies.

The Linux Foundation's announcement lists the protocol among three founding project contributions and names eight platinum members, including the largest cloud providers. An independent consultancy places the protocol in the Trial ring of its technology radar.

Why it matters

If agents reach enterprise data through a common protocol, access control and audit for that route become a governance question. Its own security guidance lists attacks such as confused deputy and token passthrough.

The protocol's Security Best Practices document describes confused-deputy, token-passthrough, server-side request forgery, session-hijacking and local-server-compromise attacks. Of token passthrough it says that incident investigation, controls and auditing become more difficult.

The problem it addresses

DII editorial view

Each connection between an AI application and a data source has been built separately, which is slow and inconsistent. A shared protocol removes that work. It also makes it easy to expose governed data to agents before anyone has decided who is allowed to authorise it.

Business and organisational relevance

DII editorial view

The question for a data organisation is not whether the protocol is popular with developers, which is a wider matter. It is whether governed data should be reachable by agents at all, and under whose authority.

Practical use cases

• An AI assistant querying an internal data source through a connector
• A common interface to several internal systems for agent-based tools
• A controlled pilot against data that is not sensitive

Benefits and opportunities

• One way of connecting AI applications to systems, in place of many
• Neutral governance of the protocol

Risks, limitations and dependencies

• The attack types the protocol's own security guidance describes
• A new route to data that existing access control and audit may not cover
• DII has read no independent evidence of use against governed enterprise data; the two corroborating organisations are the steward and the project itself

Prerequisites for adoption

DII editorial view

• Access control, logging and ownership decided for this route
• A reading of the protocol's own security guidance
• A pilot scope limited to data that is not sensitive

Implementation considerations

• Decide the controls first. Do not expose governed data through agent connectors until access control, logging and ownership for that route are decided.
• Read the security guidance. The protocol's own documentation describes the attacks to design against.
• Treat it as a new access route. Apply the same approval as for any new way of reaching governed data.

The DII Radar assessment

Approved DII Radar assessment

DII assesses Agent Access to Enterprise Data (MCP) as Watch relevance, with direction Rising. Its strategic impact is assessed as Moderate and its enterprise adoption as Early. It is one of the ten entries on the current Radar.

DII relevance is our assessment of current significance and momentum, based on evidence, market development and adoption. Direction is the observed trajectory of relevance and adoption. Strategic impact is the potential or current significance to enterprise data capability, and enterprise adoption is the extent of current real-world enterprise adoption; together they set the position on the Radar. The Radar is not a prediction, vendor comparison or performance ranking.

Evidence basis: Linux Foundation press release, 9 December 2025 (Agentic AI Foundation); MCP specification, Security Best Practices; Anthropic announcement, 9 December 2025 (originator).

See Agent Access to Enterprise Data (MCP) on the Radar →

What to consider next

DII editorial view

• Do not expose governed data through agent connectors until access control, logging and ownership for that route are decided
• Design against the attack types the security guidance describes
• Apply the same approval as for any new way of reaching governed data