Why Defenders Are Asking Whether MCP Still Matters

Every few months, legal tech declares a new revolution, and defenders — already buried under bodycam files, jail call audio, and a discovery dump that arrived three days before the preliminary hearing — are expected to drop everything and evaluate it. So when "MCP server" started showing up in the same breath as Claude, the fair question was whether this was another fad or something worth ten minutes of your time.

The honest answer from the data: this one has legs. The UK AI Safety Institute analyzed 177,436 AI agent tools and found that publicly released MCP tools grew from roughly 5,000 to 177,000 between November 2024 and February 2026, while downloads jumped from 80,000 to 14 million. The same study calls MCP "the dominant open standard for giving AI agents access to external tools and services." That's not a flash in the pan — that's infrastructure.

For the uninitiated: MCP (Model Context Protocol, launched by Anthropic in November 2024) is the plumbing that lets Claude connect to outside tools and data. Instead of copy-pasting a police report excerpt into a chat window, you ask Claude a question and it queries the tool directly. Legal is already a real use case — CourtListener, the Free Law Project, runs a production MCP server that works across Claude, ChatGPT, and Gemini Enterprise, offering live case-law queries and grounded citation checks specifically to reduce hallucinations.

But skepticism is warranted, because MCP is situational, not magic. Engineering analyses are blunt about where it adds value:

• When an agent must choose operations from a natural-language request, rather than follow a fixed script
• When the next step depends on what the agent discovers along the way
• When multiple AI clients — say, Claude Desktop and Claude Code — need the same service without bespoke integrations
• Not when workflows are predetermined, high-volume, or demand millisecond determinism

There's also a risk angle defenders should care about. The AISI study found that potentially consequential agent actions are increasingly happening in the least controlled environments — payment-execution servers alone grew from 46 to over 1,200 in a single year. Restricting what a tool can do reduces the range of operations available to the agent, though it doesn't eliminate risk entirely. Read-only access with full audit trails is the design posture that matters for evidence handling.

So the question isn't really whether MCP still matters — the adoption curve settled that. The question is whether it matters for defense work, where the daily grind is reviewing 40 hours of bodycam, checking a report against what the camera actually shows, and prepping a suppression motion. That's where the rubber meets the road, and it's worth looking at concrete examples before deciding whether to invest the time.

The Data Says Yes: MCP Is Growing, Not Fading

The numbers settle the question quickly. In a study of 177,436 AI agent tools, the UK AI Safety Institute found that publicly released MCP tools grew from roughly 5,000 to 177,000 between November 2024 and February 2026 — while downloads jumped from 80,000 to 14 million. AISI calls MCP "the dominant open standard for giving AI agents access to external tools and services."

Adoption at the enterprise level tells the same story. Remote MCP servers — the deployment model major SaaS companies use — are up nearly 4x since May 2025, with companies like Atlassian, Figma, and Asana building them because customers are asking for them. The PulseMCP registry alone lists over 5,500 servers.

For defense teams, the more useful question is when MCP earns its keep. The honest answer from engineering analyses: it's situational. MCP adds real value when an AI must discover and choose operations from a natural-language request — "find the bodycam moments where the officer's account diverges from the report" — and when the next step depends on what the agent finds. It adds little when the workflow is predetermined, which is why Red Hat's guidance is blunt: if your application isn't using a language model, you don't need MCP.

Evidence review is squarely in the first camp. The clearest legal-world proof point is CourtListener's production MCP server, which works across Claude, ChatGPT, and Gemini Enterprise and provides grounded citation checks to reduce hallucinations — the same principle defense teams need when an AI touches discovery.

That situational framing also shapes how a server should be built for evidence work:

• Read-only tool surfaces, since restricting available operations reduces (though doesn't eliminate) agent risk
• Org-scoped access with revocable tokens, so a departing investigator's access ends cleanly
• Full audit logging, because traditional API logging is insufficient for dynamic, non-human agent contexts
• Citations on every answer, so any AI-surfaced material traces back to the source moment

Evidence Copilot's MCP server follows exactly this design: read-only, org-scoped, revocable, and fully audited, letting a defense team query cases from Claude Desktop or Claude Code without exposing originals to modification. One caution from the AISI data: consequential agent actions are increasingly occurring in the least controlled environments — payment-execution servers alone grew from 46 to over 1,200 in a year. A read-only, audited server is the deliberate counter to that trend, and the right posture for anything touching a client's case file.

Legal Work Is Already a Proven MCP Use Case

Ask any defender who's been burned: an AI assistant citing a case that doesn't exist is worse than no assistant at all. That's why the legal profession's most credible MCP story matters — it's not a demo, it's production infrastructure solving exactly the hallucination problem that made lawyers distrust AI in the first place.

Free Law Project's CourtListener runs a production MCP server that works across Claude, ChatGPT, and Gemini Enterprise. Instead of relying solely on a model's built-in training data, AI assistants using it can query live case-law databases for accurate, recent information. The feature that matters most for practitioners is grounded citation verification — checks designed to reduce hallucinations, per the CourtListener documentation. The server also handles docket tracking and alerts, all against live data rather than whatever the model memorized during training.

This is the pattern the whole legal category is converging on. The UK AI Safety Institute's study of 177,436 AI agent tools found MCP has become "the dominant open standard for giving AI agents access to external tools and services," with tool counts growing from roughly 5,000 to 177,000 between November 2024 and February 2026. Legal compliance tools exist within that ecosystem, though software development still dominates at 67% of published tools. Legal is early — but it's real, and it's production-grade.

The demand signal from lawyers backs this up. Search interest in "claude for lawyers" is up 3,029% year over year, according to keyword data — a spike that size doesn't come from curiosity, it comes from practitioners actively looking for ways to put AI to work inside their existing tools. What they're looking for, whether they phrase it this way or not, is the CourtListener model: AI that answers from a verifiable source instead of from memory.

For defense teams, the same principle applies to evidence, not just case law. The pattern we built into Evidence Copilot's MCP server follows the CourtListener logic: read-only access to your own case evidence (list_cases, search_evidence, read_window, get_citation), org-scoped with revocable tokens and full audit logging, queryable from Claude Desktop or Claude Code. Every answer ties back to the exact second of bodycam or page of a police report it came from — the evidence-side equivalent of a citation check.

The design choices matter as much as the capability. AISI's research found that 95% of general-purpose tool downloads involve action capabilities, and warned that "potentially consequential agent actions are increasingly occurring in the least controlled environments." As CircleCI's engineering analysis puts it, restricting the tool surface doesn't eliminate prompt-injection risk, but it does reduce the range of operations available to the agent. For evidence handling, read-only is the right default.

CourtListener proves the use case. The question for defense teams isn't whether MCP servers are useful — it's whether the ones you connect to your discovery follow the same grounded, audited, read-only discipline.

What Safe-by-Design Looks Like: Read-Only, Scoped, Audited

Here's the uncomfortable part of the MCP growth story: the UK AI Safety Institute analyzed 177,000 agent tools and found that general-purpose, unconstrained tools grew from 41% to 50% of downloads, with 95% carrying action capabilities. In their words, potentially consequential agent actions are increasingly occurring in the least controlled environments.

For a defense team, that should give you pause. You would never hand an intern unsupervised write access to case files. The same instinct applies to AI agents — and it is exactly why tool design matters more than tool count.

The engineering consensus is blunt about what actually reduces risk. Restricting the tool surface does not eliminate prompt-injection or authorization risks, but it does shrink the range of operations an agent can take. In other words: fewer doors, fewer ways in.

That is the design philosophy behind how we built the Evidence Copilot MCP server, and it is worth spelling out what safe-by-design looks like in practice — with the obvious caveat that this is our own product documentation, not third-party validation:

• Read-only by design. The server exposes exactly five operations — list_cases, list_evidence, search_evidence, read_window, get_citation. Claude can search your discovery and pull citations, but it cannot delete a file, alter a transcript, or touch an original.
• Org-scoped access. A token sees only the cases within your organization. Nothing leaks across clients or offices.
• Revocable tokens. Access can be cut off the moment a laptop is lost or a team member leaves — no waiting on a vendor support ticket.
• Full audit trail. Every query is logged. Security practitioners put it plainly: you can't secure what you can't see, and in MCP, visibility starts with auditing.

The read-only constraint is not a limitation to apologize for — it is the point. Your originals stay immutable, every AI answer stays marked as pending human review, and the agent's job is to find and cite, not to act. That maps to how defense work actually functions: you want Claude to pull the exact second of bodycam where the officer's story shifts, not to "helpfully" edit your case file on the way out.

If you are evaluating MCP integrations from any vendor, the AISI risk data gives you a simple screening question: does this server let the agent take irreversible actions, or only read and cite? The answer tells you most of what you need to know about the vendor's risk posture.

How to Actually Use an MCP Server in Your Case Prep

If you've already uploaded discovery into Evidence Copilot, connecting it to Claude takes about five minutes — and once it's connected, you can work your case without leaving the chat window.

The setup uses Evidence Copilot's MCP server, which exposes five read-only tools: list_cases, list_evidence, search_evidence, read_window, and get_citation. You generate a token in your workspace, paste it into Claude Desktop or Claude Code, and the org-scoped connection is live. Tokens are revocable, and every query is fully audited — so your investigator's Claude session can't touch another office's cases, and nothing is ever written back to evidence.

Why read-only matters here: a recent UK AI Safety Institute study of 177,000 MCP tools found that 95% of general-purpose tool downloads involve action capabilities, and consequential agent actions are increasingly occurring in the least controlled environments. Restricting the tool surface doesn't eliminate every risk, but as engineering analysis puts it, it does reduce the range of operations available to the agent. For evidence handling, that's the right trade.

Once connected, here's what the workflow actually looks like in Claude:

• List your evidence inventory. Ask "list evidence in the Smith case" and get the full dump — bodycam files, jail calls, the 911 audio, scanned PDFs — without opening the player.
• Search across transcripts and OCR'd documents. "Search for consent in the suppression case" pulls hits from the officer's report, the bodycam transcript, and the interrogation footage in one sweep — the report-vs-bodycam comparison that used to take an afternoon.
• Read the exact window. When a hit looks relevant, read_window pulls the surrounding transcript segment with speaker names and word-level timestamps, so you're reading the real exchange, not a summary.
• Grab the citation. get_citation returns a deep link into the exact second of video or page of the PDF — paste it into your notes and anyone on the case can verify it against the original.

This is the same pattern the legal world has already validated. CourtListener's production MCP server works across Claude, ChatGPT, and Gemini Enterprise for live case-law queries and grounded citation checks to reduce hallucinations — Evidence Copilot applies the same citation-grounding to your own evidence instead of case law.

The point isn't that Claude replaces your judgment. Every answer you pull is marked AI-generated and pending human review, and the originals stay immutable. You're just cutting the time between "I remember something in a jail call" and the verified quote — with pricing published upfront, no sales wall between you and the workspace.