Model Context Protocol (MCP) Explained for Lawyers and Legal Teams

Last updated: 30 October 2026. This guide draws on Anthropic’s November 2024 announcement of the Model Context Protocol and its December 2025 donation to the Agentic AI Foundation, the official MCP specification and security best practices at modelcontextprotocol.io, vendor announcements from Thomson Reuters, iManage, NetDocuments and Harvey, ABA Formal Opinion 512 and the Solicitors Regulation Authority’s August 2026 warning notice on the misuse of AI. It is general information, not legal or technical advice.

Short answer: The Model Context Protocol (MCP) is an open standard that lets AI assistants connect to other software, such as a document management system, a research platform or a practice management tool, through one common interface instead of a custom integration for each product. Anthropic launched it in November 2024, and it is now governed by the Agentic AI Foundation under the Linux Foundation.

Key takeaways

• Anthropic released MCP as an open standard on 25 November 2024. On 9 December 2025 it donated the protocol to the Agentic AI Foundation, a directed fund of the Linux Foundation co-founded by Anthropic, Block and OpenAI.
• Anthropic says MCP is supported in ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code, with more than 10,000 active public MCP servers by December 2025.
• Legal vendors have moved quickly: Thomson Reuters connected Claude to CoCounsel Legal through MCP in May 2026, iManage launched an MCP server the same month and NetDocuments opened MCP access for ndMAX Enterprise customers from 1 April 2026.
• The protocol’s own specification says there should always be a human in the loop who can deny tool calls. Lawyers’ duties under ABA Formal Opinion 512 and SRA rules apply in full whatever the connection method.

What is the Model Context Protocol?

The Model Context Protocol is a set of rules for how an AI application talks to outside systems. Anthropic described it at launch as an open standard for connecting AI assistants to “the systems where data lives”, including content repositories and business tools. The aim was to replace a patchwork of one-off integrations with a single protocol that any AI product and any software vendor could implement.

A common comparison is a universal plug. Before MCP, a firm that wanted its AI assistant to read files from its document management system needed someone to build and maintain a bespoke connector for that pairing. With MCP, the document system publishes one MCP server, and any MCP-compatible assistant can connect to it, subject to the permissions the firm sets.

When Anthropic announced MCP on 25 November 2024, it released the specification, software development kits, local server support in its Claude desktop apps and an open-source set of example servers for tools such as Google Drive, Slack and GitHub. For a wider view of the assistants that now use connectors like these, see our guide to AI for lawyers.

How does MCP work?

The official MCP architecture documentation describes three participants. The host is the AI application the lawyer uses. The host creates a client for each connection, and each client talks to one server, which is the program that exposes a particular system’s data or functions. A server can run locally on a user’s computer or remotely as a hosted service, which is how most enterprise legal products offer it.

Servers can offer three main kinds of capability, which the specification calls primitives:

In practice, the assistant asks each connected server what tools it offers, decides which one fits the user’s request, and sends a structured call. The server checks the user’s credentials, does the work inside its own system and returns the result to the assistant. Remote servers typically use OAuth for sign-in, so access can follow the user’s existing account and permissions.

Who controls MCP now?

Anthropic no longer owns the protocol’s governance. On 9 December 2025 it donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation. Anthropic, Block and OpenAI co-founded the AAIF, with Google, Microsoft, Amazon Web Services, Cloudflare and Bloomberg as supporters. MCP joined Block’s goose agent framework and OpenAI’s AGENTS.md as founding projects.

The MCP project blog says the existing maintainers still make technical decisions through the community’s specification enhancement process, and that the Linux Foundation will not dictate technical direction. For legal buyers, the practical point is that MCP is no longer tied to one AI company. A firm that builds its integration strategy around MCP is not locked into a single model provider, at least at the protocol level.

Which legal tech vendors support MCP?

Adoption by legal vendors accelerated in the first half of 2026. The table lists announcements we could confirm from the vendors’ own releases or blogs. It is not a full market survey, and availability often depends on licence tier.

The Thomson Reuters press release says customer data is not used to train third-party models. We covered the deal in our report on Thomson Reuters connecting Claude with CoCounsel Legal, and our CoCounsel review explains what the product itself does. iManage’s announcement stresses that documents stay in its system rather than being bulk exported to AI tools.

Harvey’s MCP overview on its blog is more forward-looking than the others. It says Harvey “could also function as an MCP server” and that centralised permissions and ethical walls “could” apply across connected systems, which signals direction rather than a finished feature list. Our Harvey AI guide covers the platform more broadly.

Two gaps are worth noting. LexisNexis announced in May 2026 that Anthropic’s Claude legal plugins were integrated into Lexis+ with Protégé, but its press release does not describe an MCP server. We also found no official Clio announcement of an MCP server, although several unofficial, community-built Clio servers are listed in public directories. Firms should treat unofficial servers for client systems with particular caution.

What are the security and confidentiality risks?

MCP makes it easier to connect an AI assistant to sensitive systems, which is the point and also the risk. Four issues matter most for law firms.

Prompt injection. An AI model reads instructions and data in the same stream of text. A document, email or web page retrieved through one server can contain hidden instructions telling the model to do something else, such as send a file through another connected tool. The more tools an assistant can reach, the more damage a successful injection can do. The MCP tools specification says there “SHOULD always be a human in the loop with the ability to deny tool invocations”, and that clients should show tool inputs to the user before calling a server, to avoid malicious or accidental data exfiltration.

Over-broad permissions. The protocol’s security best practices warn against wildcard or “full access” scopes and recommend a least-privilege model that starts with low-risk, read-only access. A connector that can delete or send documents should not be enabled by default.

Untrusted servers. The specification tells clients to treat tool descriptions and annotations as untrusted unless they come from a trusted server. Local servers that a lawyer downloads and runs on a laptop can execute code with that user’s privileges, so firms should control which servers can be installed.

Ethical walls and audit. A connector that ignores matter-level access controls could expose one client’s documents to a team that is walled off from them. Vendors such as iManage and NetDocuments say their servers respect existing permissions and log activity, and those claims should be checked during procurement and testing.

What do ABA Formal Opinion 512 and UK regulators require?

No bar regulator has issued rules specific to MCP, but existing guidance on generative AI applies to any tool connected through it. The ABA issued Formal Opinion 512 on 29 July 2024. It applies the Model Rules on competence (1.1), communication (1.4), fees (1.5) and confidentiality (1.6) to generative AI. Lawyers need a reasonable understanding of the tools they use, must protect all information relating to a representation, and in some cases need informed client consent before putting client information into a tool, particularly one that may learn from inputs. Managerial lawyers must also set policies and supervise others’ use under Rules 5.1 and 5.3. Our explainer on ABA Formal Opinion 512 covers each duty.

In England and Wales, the Solicitors Regulation Authority published a warning notice on the misuse of AI on 17 August 2026. It says client information should only be entered into AI systems where appropriate contractual, technical and organisational safeguards protect confidentiality, that client data should not be used to train models unless explicitly authorised, and that improper sharing may permanently waive legal professional privilege. It warns that failing to have regard to the notice puts solicitors at risk of disciplinary action. The notice also stresses that solicitors remain responsible for their work, which matters for agentic tools that act across several systems at once.

How should a firm evaluate an MCP connector?

An MCP connector should go through the same review as any other system that touches client data, with some extra questions:

• Who built and maintains the server: the software vendor itself, the AI provider or an unknown third party?
• Does access run through each user’s own credentials, and does it respect matter-level permissions and ethical walls?
• Can administrators restrict the server to read-only tools, and switch it off quickly?
• Are tool calls logged in a form the firm’s risk team can review?
• What do the contracts say about data retention, model training and where data is processed?
• Does the AI client ask for confirmation before actions such as sending, deleting or filing?

A controlled pilot with test matters is the best way to answer these questions. Our guide to running a legal AI pilot sets out how to structure one so it ends in a clear decision.

Frequently asked questions

Who created the Model Context Protocol?

Anthropic, the company behind Claude, introduced MCP as an open-source standard on 25 November 2024. In December 2025 it donated the protocol to the Agentic AI Foundation, a Linux Foundation fund co-founded with Block and OpenAI, so the standard is now under vendor-neutral governance.

Is MCP only for Claude?

No. MCP is an open standard and any AI application can implement it. Anthropic says it is supported in ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code, and legal vendors such as iManage and NetDocuments say their servers work with several different AI tools.

Is an MCP server the same as an API?

Not quite. An MCP server usually sits on top of a product’s existing API and describes its functions in a standard format that AI models can discover and call. The underlying API still does the work, but any MCP-compatible assistant can use it without a custom integration.

Does connecting AI through MCP move client documents out of the firm’s systems?

It depends on the server and the AI client. iManage and NetDocuments say their servers avoid bulk exports and keep documents in their platforms, but retrieved text still passes to the AI model to answer a request, so the AI provider’s data terms matter too.

What is prompt injection in an MCP setting?

Prompt injection is when content the AI reads, such as a document or email, contains instructions that try to hijack the model. With MCP, a successful injection could trigger actions in other connected tools, which is why least-privilege permissions and human approval of actions matter.

Do lawyers need client consent to use MCP connectors?

Not always. ABA Formal Opinion 512 says informed consent may be needed before client information goes into some generative AI tools, especially those that learn from inputs. The SRA expects appropriate safeguards before any client data is entered, so check engagement terms and firm policy.

This article is general information about the Model Context Protocol and related professional guidance in the United States and England and Wales. It is not legal, regulatory or technical advice. Vendor features and availability change often, so confirm details with the vendor and your own risk, IT and ethics advisers before connecting AI tools to client systems.