A plain-English guide to MCP, the standard linking AI assistants to law firm software

One plug instead of many adapters

As Legal Desire reported in its explainer for lawyers, the Model Context Protocol (MCP) is an open standard: a shared rulebook that lets an AI assistant work with outside software. That software might be a document management system, a legal research service or a practice management tool.

Before MCP, a firm that wanted its assistant to pull files from its document system had to pay for a custom connector for that exact pairing, then keep it working. With MCP, the software maker publishes a single connection point, called a server. Any assistant that speaks MCP can use it, within whatever permissions the firm has set.

Anthropic, the company behind Claude, released MCP on 25 November 2024. The launch included the specification, developer kits, local server support in its Claude desktop apps and example servers for tools such as Google Drive, Slack and GitHub.

How an assistant actually uses a connector

The official documentation describes three roles. The host is the AI application the lawyer uses. It opens a client for each connection, and each client talks to one server, the program that exposes a particular system's data or functions. Servers can run on a user's own computer or as a hosted online service, and most enterprise legal products take the hosted route.

When a lawyer makes a request, the assistant asks the connected servers what they can do and picks the one that fits. It sends a structured request, and the server checks who is asking, does the work inside its own system and hands back the result. Remote servers usually rely on OAuth, a standard sign-in method, so access can follow the person's existing account and permissions.

One related point: an MCP server typically sits on top of a product's existing API, the technical doorway software already uses to talk to other software. The API still does the work. MCP describes it in a format any compatible assistant can discover and use.

Who runs it, and who has signed on

Anthropic no longer controls MCP's governance. On 9 December 2025 it donated the protocol to the Agentic AI Foundation, a fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. Google, Microsoft, Amazon Web Services, Cloudflare and Bloomberg are supporters. The project's maintainers still make technical decisions through the community's own process.

For buyers, the point is that the standard is not tied to one AI company. Anthropic says it works with ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code, and counted more than 10,000 active public servers by December 2025.

• Thomson Reuters linked Claude with CoCounsel Legal through MCP in May 2026.
• iManage launched its own MCP server the same month, and says documents stay in its system instead of being bulk exported.
• NetDocuments has offered MCP access to ndMAX Enterprise customers since 1 April 2026.
• Harvey describes MCP plans in forward-looking terms rather than as a finished feature set.

There are gaps. LexisNexis announced Claude legal plugins inside Lexis+ with Protégé in May 2026, but its release does not mention an MCP server. Legal Desire also found no official Clio MCP server, only community-built ones, which it says deserve extra caution when they touch client systems.

Where the risks sit

Easier connections mean more exposure, and the guide names four trouble spots.

Prompt injection. An AI model reads instructions and content as one stream of text. A retrieved document, email or web page can hide commands that steer the model, for example into sending a file out through another connected tool. The more tools the assistant can reach, the worse a successful attack can be. The MCP specification says a person should always be able to refuse a tool action.

Over-broad permissions. The protocol's security advice favors starting with minimal, read-only access and avoiding blanket "full access" settings. Anything that can delete or send documents should be off by default.

Untrusted servers. A server downloaded and run on a laptop can execute code with that user's privileges, so firms should decide which ones may be installed.

Ethical walls and audit trails. Law firms wall off teams from certain clients' files. A connector that ignores those matter-level limits could break them. Vendors say their servers respect existing permissions and log activity, but those claims should be tested.

What the professional rules add

No regulator has written MCP-specific rules. Existing guidance on generative AI covers any tool reached this way. The American Bar Association's Formal Opinion 512, issued on 29 July 2024, applies the Model Rules on competence, communication, fees and confidentiality. Lawyers need a working understanding of their tools, must protect client information and may need informed client consent in some cases. Managers must set policies and supervise.

In England and Wales, the Solicitors Regulation Authority issued a warning notice on AI misuse on 17 August 2026. It says client data should enter AI systems only with suitable contractual, technical and organisational safeguards, and not be used for model training without explicit authorisation. It also warns that careless sharing may permanently waive legal professional privilege, and that solicitors stay responsible for their work.

The guide's vetting questions are practical. Who built the server? Does access use each person's own credentials? Can administrators limit it to read-only and switch it off fast? Are calls logged? What do contracts say about retention and training? Does the assistant ask before sending, deleting or filing? A pilot on test matters is the suggested way to find out.