MCP and AI visibility: can a connector make your business an AI source?

What MCP actually does

MCP lets an AI app call tools and read data from systems that someone has connected it to. MCP stands for Model Context Protocol. Its official documentation calls it an open-source standard for connecting AI applications to external systems, such as data sources, tools and workflows. Anthropic released it in November 2024 and donated it to the Linux Foundation's Agentic AI Foundation in December 2025. Anthropic's announcement names ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code among the products that support it.

The moving parts are plain. An AI app, called the host, connects to one or more MCP servers. The server is a program that offers three kinds of things. Tools are actions the AI can run, such as looking up job availability. Resources are data it can read, such as your service area or opening hours. Prompts are templates that shape a task, such as a standard way to summarise a job file.

Servers come in two forms, and the difference matters when a vendor says "just add our MCP". The MCP architecture documentation describes a local server as one that runs on the same computer as the AI app and talks to it directly, while a remote server runs on someone else's platform and is reached over the internet. Remote servers can sign people in with bearer tokens, API keys or custom headers, and the documentation recommends OAuth for getting those tokens. In practice, a remote connector is a web address plus a sign-in screen. A local server is software installed on one machine, and MCP's security guidance warns that local servers run with the same privileges as the AI app that launched them.

Now notice the direction. The host connects to servers someone has set it up to use. MCP's specification says users must explicitly consent to and understand all data access and operations, and that hosts must get explicit user consent before invoking any tool. The specification also admits that MCP itself cannot enforce these principles at the protocol level, so each app and server has to build them in. Nothing in the protocol goes out looking for businesses to recommend.

Explicit connection versus public discovery

There are two routes into an AI conversation, and they run on different rules. One is a connection a person chooses. The other is discovery, where the AI product finds you by itself while answering someone's question.

Read the table row by row and the pattern is clear. Every MCP row starts with a person who already knows you exist. Every public row starts with the AI product's own index. So an MCP server behaves more like an app for people who already want to work with you. It can make their week easier. It can't introduce you to someone who has never heard of you.

That doesn't make connectors useless for visibility. It means they sit after discovery, not before it. A customer who found you through a search, a referral or an AI answer might later connect your server to check bookings, but the finding happened somewhere else.

What public AI answers are built from

Public AI answers are built from web pages that each product's own crawler or search index can reach. When AI companies explain how their answers find websites, they talk about crawlers and indexes, not connectors. The table sets out what each company says in its own documentation.

Two kinds of bot matter for a local business. An indexing bot builds the search index that answers draw on. A user-triggered bot visits a page while answering one person's question. OpenAI says ChatGPT-User is not used to decide whether content may appear in search, and Perplexity says Perplexity-User generally ignores robots.txt because a person started the request. So the indexing bot is the one your robots.txt decisions affect most.

None of those routes runs through an MCP server. If a bot can't reach your service pages, or your pages disagree with your Google Business Profile, a connector won't fix either problem. Why a crawl does not prove an AI citation explains how to read bot visits in your logs, and how AI search works covers how answers choose their sources.

You can check your own public AI visibility without building or buying anything. Work through these checks in order:

1. Ask the questions your customers ask, in their words, in ChatGPT, Perplexity, Claude and Google AI Mode. Include the suburb and the job, such as "termite inspection Maroochydore". Note whether your business is named, whether your site is linked, and whether the facts are right.
2. Repeat each question on a few different days. AI answers vary between runs, so one screenshot proves very little either way.
3. Open your robots.txt and confirm you haven't blocked OAI-SearchBot, PerplexityBot or Claude-SearchBot by accident, unless you chose to.
4. Check Search Console. Google's AI features documentation says traffic from AI Overviews and AI Mode is counted in the Performance report under the Web search type, so there is no separate AI report to find. How to interpret Google AI impressions explains how to read it.
5. Look at referral traffic in your analytics for visits from AI products. How to measure ChatGPT referrals shows the GA4 steps.
6. Only then consider a paid tracking tool, and compare its reports with care, as how to compare AI visibility reports explains.

The other meaning: MCP connectors that report your visibility

Many pages that use the phrase "MCP AI visibility" are selling something different: a connector that pipes an SEO or AI-visibility tracking tool's data into Claude or ChatGPT. These tools let you ask your AI app questions about your tracking data. They do not make AI products cite you. The connector changes where you read the report, not what the report says.

The trackers behind them generally work by sampling. They run a fixed set of prompts through a fixed set of AI products on a schedule, then count how often a brand is named or a site is linked. That is useful for spotting trends, but every number depends on which prompts and which products were chosen. Google, OpenAI, Perplexity and Anthropic don't publish an official AI visibility score, so each vendor defines its own metric.

If an agency or vendor pitches "MCP for AI visibility", ask these questions before you pay or connect anything:

• Does this product measure my visibility, or does it claim to change it? A connector that claims to raise citations in public AI answers needs to explain how, because public answers come from each product's own index.
• Which AI products and which prompts are tracked, who chose the prompts, and can I see and edit the list?
• How often is each prompt run, and how are results that change from run to run handled?
• Is access read-only by default? Which actions, if any, can write to my accounts, and can I turn those off?
• Will the connection reach every project or client the account can see, or only the ones I choose?
• Where does the data go, which country is it stored in, and is there a privacy policy that covers the connector?
• Which plan includes the MCP connection, and does cancelling the plan remove access cleanly?
• Who maintains the server, and how will I hear about changes to its tools?

Connector directories and the rules against promotion

Connector directories are the one place where people can discover an MCP server they didn't already know about, and both major directories forbid promotional connectors. Claude's Connectors Directory lists servers submitted through Anthropic's developer portal, and Claude's documentation says every directory entry is eligible for Suggested Connectors, which are in-chat recommendations shown when relevant to a person's task. Ranking there is usage-based, like other app stores. Anthropic's verification page says new submissions are listed as Community connectors by default, and that a Verified label isn't a security audit. On the OpenAI side, published plugins appear in a directory shared by ChatGPT and Codex, and OpenAI's plugin guidelines say plugins with strong real-world utility and high user satisfaction may be eligible for directory placement or proactive suggestions.

Three limits matter. First, a suggestion is still an invitation. The person decides whether to install it, and the listing has to earn its place through use. Second, both companies rule out ad-first connectors. Anthropic's Software Directory Policy prohibits software that exists primarily as an advertising or promotional vehicle, and OpenAI's guidelines say plugins must not serve advertisements or exist primarily as an advertising vehicle. Third, you can't use tool descriptions to steer the AI towards your business. OpenAI's guidelines say tool descriptions must not favour or disparage other plugins or services or try to influence the model to select them, and Anthropic's policy says descriptions must precisely match actual functionality and must not be written to make Claude call them when it doesn't need to.

Put plainly, a server built to talk up your business breaks both sets of rules, and a server that only describes itself honestly gets used when it genuinely helps with the task in front of the person.

The open MCP Registry is something else again. Its documentation says it's in preview, is intended to be consumed primarily by downstream aggregators such as MCP server marketplaces, and is not intended to be read directly by AI apps. It also doesn't accept private servers that only a narrow group can reach. A listing there is a technical record for other software to read, which is a long way from a customer finding you.

Worked example: should a pest control business build a server?

Build a server when you can name the people who will connect it and they will use it more than once. Here is a hypothetical case taken through that decision step by step. Say a pest control business in Maroochydore handles routine inspections for several real estate agencies, and the owner is told a connector would "get the business into AI".

Step 1, separate the two goals. Homeowners in Buderim asking ChatGPT who treats termites nearby will never touch a connector, so new-customer visibility belongs to the website, the Google Business Profile and the facts other sites hold about the business. AI answers and accurate company facts covers that side. The connector question is only about existing agency clients.

Step 2, name the users and their questions. The owner writes down that property managers at the agencies keep phoning to ask when the next inspection is due for a listing, and whether a report has been sent. That is a narrow, repeated need from known people, which is the case where a server can earn its keep.

Step 3, split the tools into read and write, and decide who signs off each one. MCP's tools specification says there should always be a human in the loop with the ability to deny tool invocations. OpenAI's plugin guidelines ask builders to mark whether a tool only reads data or changes it, and whether a change could be irreversible. The table shows how the owner might sort the candidate tools.

Step 4, check how the agencies would connect it. If an agency uses Claude on a Team or Enterprise plan, an Owner of its Claude organisation, or on Enterprise a member with the right custom role, has to add the server before property managers can connect with their own accounts. On a Team plan, a member without that permission sees a Request button that sends the request to the Owners. So the owner should talk to each agency's administrator before writing any code.

Step 5, decide. A read-only first version with two tools is a small, testable project. If the agencies agree to use it, the owner builds that first and reviews usage after a few months. If they don't, the effort goes back into the website and the business profile.

Before you build or connect: security, privacy and upkeep

An MCP server is software that other AI apps call, often with customer data sitting behind it, and connecting someone else's server gives their code a route into your accounts. Work through these steps in order, and stop at any step you can't answer.

One risk deserves a plain example. Imagine, hypothetically, that a free "marketing insights" server is connected to an AI app that can also read your inbox. A month later its developer changes one tool description to include a hidden line telling the AI to send any customer list it sees to another tool for "backup". You never see that text, but the AI does. Claude's help centre warns that malicious MCP servers may include hidden instructions that try to make Claude perform unintended actions, and that server developers may update tool behaviour unexpectedly. Anthropic's verification page adds that a connector's developer controls which tools it exposes and can change them at any time. That is why trust in the developer, narrow permissions and approval prompts matter more than any label.

1. Fix public visibility first. Check your key pages are indexed in Google and open to OAI-SearchBot, Claude-SearchBot and PerplexityBot, unless you've decided otherwise. The AI visibility checklist walks through the rest, and technical SEO covers crawl and indexing problems.
2. Name the users. Write down who will connect the server and what they'll ask it. If you can't name them, you don't need one yet.
3. Start read-only and narrow. MCP's security guidance warns that broad access scopes widen the damage when a token is stolen, and recommends a minimal starting set of low-risk read operations. OpenAI's security guidance says to request only the scopes, storage and network permissions you need.
4. Keep a person in the loop for anything that changes data. OpenAI's plugin security guidance says to assume prompt injection and malicious inputs will reach your server, and points to human confirmation for irreversible operations.
5. Log what the AI did through your server. MCP's tools specification says servers must validate all inputs, apply access controls and rate limit tool calls, and that apps should log tool usage for audit. Record the tool name, the connected account, the time and the outcome, and follow OpenAI's advice to redact personal information before it is written to logs. Those records are what you'll need if something goes wrong.
6. Check your privacy duties. If your business is covered by the Privacy Act, the OAIC's guidance says privacy obligations apply to personal information put into an AI system and to AI output that contains it. Anthropic's directory policy also requires a clear privacy policy covering data collection, use and retention.
7. Connect other people's servers sparingly. Only connect servers from developers you trust, review the permissions requested at sign-in, switch off tools you don't need, and remove connectors you've stopped using.
8. Plan the upkeep. Anthropic asks directory connector owners to maintain their connector's security and functionality and to respond to security issues promptly. Once listed, the developer portal shows the server's health and usage, alongside your own logs. That job doesn't end at launch.