MCP, the Model Context Protocol, is an open standard connecting an AI assistant (Claude, ChatGPT or another) to external tools and data sources. A software product publishes an MCP server describing what can be asked and done; the assistant uses those capabilities with your permission and your access rights. For accounting this opens a new door: instead of opening the program, finding the right view and exporting a report, you ask in conversation "what are our outstanding receivables?" – and the assistant queries the answer from the system rather than guessing it. The same door works in reverse: "draft April's invoice for Mart" can trigger a real action that waits for your approval.
How does it work technically?
Three parties. Your business software publishes an MCP server: a list of tools (“search invoices”, “create invoice”, “show balance”) and resources. Your assistant connects to that server - a connection you establish, not a third party. And every action runs through your session: the assistant does not have access, it borrows yours, visibly and logged. That architecture is why MCP spreads faster than earlier "AI integrations": one standard, no pairwise connectors.
What can you actually do in accounting through it?
Two classes, in order of maturity. Questions already work broadly: balances, outstanding invoices, customer history, cost breakdowns; whatever the system holds becomes conversationally available. Actions are the second stage: drafting an invoice, sending a reminder, categorizing a document; here good practice has the assistant prepare and you approve, exactly the agentic finance pattern write small. A growing number of business tools publish MCP servers; before counting on it, check whether yours is among them.
Is it safe?
As safe as the implementation: ask three things. Whose permissions do actions run under? The right answer: the user's, not a general "integration account". Do mutating actions require approval? They should. And does everything done via MCP land in an audit log? It black. With those answers in order, a conversational interface adds no new risk: it adds a new, more convenient door in front of the same permissions you already had.