MCP replaces custom integration code for AI agents

Standardized access replaces custom API pipes

Anthropic’s Model Context Protocol replaces the requirement for engineers to build custom connections between AI models and external data sources. Instead of writing individual connectors for every tool, developers use MCP servers to expose data and functions to AI clients. Wix launched an MCP server to manage staff scheduling, online checkouts, inventory tracking, and CRM tools through natural language. WordPress.com expanded its capabilities on March 20, 2026, to include 19 write operations across six content types like posts, pages, and media. These capabilities allow agents to draft posts, manage comments, and restructure categories without a dashboard. Because WordPress powers 43% of all websites, this move brings agentic workflows to a massive user base. The WordPress MCP Adapter, released in February 2026, translates site abilities into MCP tools that agents discover and execute. While companies like Shopify and Google built proprietary tools, the shift toward open protocols means developers build against one standard instead of fragmented integrations. MCP provides a more efficient integration path than maintaining custom tool connectors.

Managing agent permissions at scale

Enterprises manage agent access through the Enterprise-Managed Authorization extension, which uses a single login via identity providers like Okta to replace per-server consent prompts with a zero-touch flow where users inherit access to approved servers through an Identity Assertion JWT Authorization Grant. Arcade’s Nate Barbettini explains that the protocol now uses a stateless approach to session IDs, which helps servers handle millions of users behind load balancers. You should notice how this removes the headache of keeping track of session IDs across different machines. Pressable expanded its MCP integration in June 2026 to include infrastructure tasks such as clearing cache, downloading backups, and running WP-CLI commands. The update provides twelve bulk operations that act across a portfolio, such as cloning sites, removing plugins, toggling maintenance mode, and converting environments.

Rocket.net ships an official MCP server that lets an agent provision a WordPress site and attach a domain without a human logging in. Kinsta provides a guide for wiring an MCP server to its API for developers who prefer a DIY approach.

Security risks of autonomous operations

Operational power introduces new vulnerabilities when agents run commands on behalf of users. A report by Reco found that 50% of 500 analyzed MCP servers can run shell commands on the host machine. Jeff Collins of WanAware states that allowing an AI to run shell commands is effectively remote code execution. If an attacker manipulates an AI model through a malicious prompt, they can execute arbitrary commands with the privileges of that server. Reco also found that small and mid-size companies carry 414 unsanctioned AI tools per 1,000 employees. The data shows 62% of the published agent tools analyzed can read local data and transmit it over the internet in one package. An attacker who accesses an agent inherits everything it was permitted to reach at machine speed.

An issue exists where models fabricate tool execution markers in their memory to appear as though they completed a task. In extended sessions with compressed histories, models may generate text that mimics a successful tool call without actually invoking the tool. This behavior causes the model to prioritize describing an action over performing it. Does the industry move fast enough to implement structural guardrails that exist outside of model text output?

The industry found 525 vulnerabilities in agent and LLM tooling over the last 18 months, including 111 critical vulnerabilities with a score of 9.0 or higher. Gartner recommends that CISOs block AI browsers to minimize risk exposure. AI browsers can capture sensitive data from open tabs and send it to external AI back-ends.