The enterprise question is changing. It used to be, "Do you have an API?" Now it is, "Can agents safely use your platform through MCP?" If you sell software, agents will soon expect to reach you through an MCP server the way they expect a REST API today. That expectation is the trend. What you do with it is the decision.
Read the table as the choice every platform team now faces.
| Design choice | Raw MCP server | Governed MCP server |
|---|---|---|
| What it exposes | Generic tools, run_sql, broad access | Scoped, semantic business capabilities |
| Identity | Often a shared service token | Per-user identity propagated to execution |
| Query correctness | The model guesses SQL | Intent compiled to deterministic SQL |
| Access enforcement | After the answer, if at all | RBAC, ABAC, row and column policy before execution |
| Audit | The call is logged | Intent, query, data, and decision are logged |
A platform that exposes raw tools has moved its integration risk into a more autonomous channel. A platform that exposes governed capabilities has done the opposite. Same protocol, different outcome.
The trend is already here, not coming
This is not a prediction anymore. It is an observation with dates.
- OpenAI adopted MCP on 2025-03-26. Sam Altman: "People love MCP and we are excited to add support across our products."
- Google committed on 2025-04-09. Demis Hassabis called MCP "rapidly becoming an open standard for the AI agentic era."
- Microsoft shipped native MCP support at Build 2025 on 2025-05-19.
- The SaaS wave arrived on 2025-05-01, when Asana, Atlassian, Block, PayPal, Sentry, and Stripe launched remote MCP servers to connect their platforms to Claude and other clients.
- Data platforms shipped servers too: the Looker MCP Server from Google, a Teradata MCP Server, and AtScale on the Databricks MCP Marketplace.
- Even news providers joined: Reuters launched an MCP server on 2026-07-08.
Then the protocol became vendor-neutral infrastructure. On 2025-12-09, Anthropic donated MCP to the Linux Foundation's Agentic AI Foundation, with AWS, Google, Microsoft, OpenAI, Block, Bloomberg, and Cloudflare among the founding members. Building for MCP is now building for a standard, not for one company's protocol. The full record is in how MCP became enterprise infrastructure.
What an MCP server is, and why APIs do not go away
An MCP server is not a rebranded API. It is built for a different consumer. A REST API is written for a specific client integration a developer hand-codes. An MCP server is written for agents. It adds standardized tool discovery, tool metadata, session semantics, and OAuth-native authorization, so any MCP client can use it without a bespoke connector.
Your APIs stay. Agents need a higher layer on top of them, one that describes what each tool does and how to call it safely. One precise correction, because it shows up in a lot of platform docs: Microsoft Copilot Studio supports MCP tools and resources, not prompts, per Microsoft Learn updated 2026-08-03. Know exactly what your server exposes.
The dangerous version: raw access without control
The fastest way to ship an MCP server is to wrap a database in a run_sql tool. It is also the fastest way to ship a liability.
Correctness collapses on real data. On Spider 2.0, the enterprise text-to-SQL benchmark, GPT-4o solved 10.1 percent of tasks and o1-preview 17.1 percent. Real schemas average about 812 columns. On BIRD, the best system reaches 81.95 percent with oracle knowledge, still below the 92.96 percent human baseline. In self-service analytics, 90 percent accuracy behaves like zero, because no analyst checks the number. See deterministic versus probabilistic text-to-SQL for why.
Raw exposure has already caused incidents. In June 2025, an access-control logic flaw in Asana's MCP feature exposed data from about 1,000 organizations to other tenants. Elastic Security Labs found 43 percent of tested MCP implementations had command-injection flaws and 30 percent allowed unrestricted URL fetching. Cloudflare's enterprise MCP reference architecture, dated 2026-04-14, already treats raw exposure as an anti-pattern and prescribes governed MCP portals with policy enforcement, DLP, per-group access, and per-tool allowlisting. The full incident record is in MCP security risks.
What a production MCP server needs
A server you can run in production pairs the protocol with a control plane. The requirements are consistent across serious deployments:
- Identity propagation. The agent acts for a real user, role, or service, not a shared account.
- Authorization. Access is checked before the action, not after.
- Scoped tools. Expose approved capabilities, not broad, free-form access.
- Semantic context. The server carries business meaning: entities, metrics, valid joins.
- Validation. Inputs and outputs are checked, not trusted.
- Observability and failure handling. Every call is traceable, and failures are safe.
Why data platforms need a semantic layer behind the server
Here is the wedge. The moat is not the server. It is what runs behind it. Connecting an agent to a database does not teach it what revenue means, which joins are valid, what a region hierarchy is, or which rows a user may read. A governed semantic layer does. MCP exposes the interface. The semantic layer governs meaning, access, and execution.
Two objections deserve a straight answer.
"The warehouses ship their own governed MCP servers now." True. Snowflake pairs Cortex Analyst with semantic views, Databricks pairs Genie with Unity Catalog, and Google ships a Looker MCP server, each with native RBAC. Concede it. They are single-vendor and single-warehouse. Enterprises run heterogeneous estates and want one governed layer across them, identity-aware at call time, not a separate one per warehouse. Compare the positions in Colrows vs Cube and Colrows vs the dbt Semantic Layer.
"Text-to-SQL is a feature now, not a platform." Partly true. Salesforce acquired Waii in 2025. A bolted-on accuracy layer is not deterministic governance. The platform choice is whether your MCP server exposes a guessing tool or a governed one.
Fix the Context, Not the Model. A platform does not make its MCP server trustworthy by picking a smarter model. It does it by giving the agent governed context and enforcing access at execution. Build the context layer, not a bigger prompt.
By 2027, an MCP server is table stakes. Governance is the moat.
Once every platform speaks MCP, having a server stops being a differentiator, the way having an API stopped being one years ago. The advantage moves to what the server protects: correct answers, per-identity access, and a clean audit trail. Ship the server. Then decide what it is allowed to do, because that decision is the one competitors cannot copy from a spec.
Where Colrows fits: the governed layer behind your MCP server
Colrows is the governed data and analytics layer a platform puts behind its MCP server. Agents emit intent over MCP. Colrows resolves that intent against a typed semantic graph, proves every join, enforces RBAC, ABAC, and row and column policy at compile time, and emits dialect-perfect SQL across 16+ engines with a full audit trail. It exposes an MCP server and a REST surface over the same governed tools, so agent traffic and dashboard traffic compile through one graph and return the same answer. See how to build an MCP semantic layer server and the Company Brain series for the wider case.
Frequently asked questions
Why will every enterprise platform need an MCP server?
Because agents will expect to reach your platform the way they expect an API today. By mid-2026, OpenAI, Google, Microsoft, and AWS shipped MCP support, and a SaaS wave including Stripe, PayPal, Block, Atlassian, Asana, and Sentry launched remote MCP servers. MCP is now a Linux Foundation project. An MCP server is becoming the integration unit of the agent era.
Is an MCP server just another API?
No. An MCP server is built for agent consumers, not for one hand-coded client integration. It adds standardized tool discovery, tool metadata, session semantics, and OAuth-native authorization, so any MCP client can use it without a bespoke connector. APIs do not go away. MCP is the higher layer agents reach them through.
What is the difference between a raw and a governed MCP server?
A raw MCP server exposes generic tools, such as run_sql, with broad access and a shared token. A governed MCP server exposes scoped, semantic business capabilities, propagates per-user identity, compiles intent to deterministic SQL, enforces RBAC, ABAC, and row and column policy before execution, and logs intent, query, data, and decision. The differentiator is what you expose, not whether you have a server.
Do the data warehouses already provide a governed MCP server?
In part. Snowflake pairs Cortex Analyst with semantic views, Databricks pairs Genie with Unity Catalog, and Google ships a Looker MCP server, each with native access control. They are single-vendor and single-warehouse. Enterprises run heterogeneous data estates and want one governed, identity-aware layer across all of them, not a separate one per warehouse.
What does a production-grade MCP server need?
Identity propagation, authorization, scoped tools instead of raw access, semantic context, input and output validation, observability, and failure handling. For a data or analytics platform, it also needs a governed semantic layer behind the server so agents reach approved metrics and valid joins, not a guessing tool over raw schemas.
