MCP Servers in Plain English: What Defenders Are Actually Asking

The six servers Anthropic named when it launched the Model Context Protocol on November 25, 2024 are still the clearest answer to this question: Google Drive, Slack, GitHub, Git, Postgres, and Puppeteer. The official MCP servers repository adds reference implementations like Filesystem, Memory, and Fetch — though the repo itself warns these are demonstrations of the protocol, not production-ready tools.

The architecture is simpler than it sounds. A host application — Claude Desktop is the common one — opens a dedicated client connection for each server. The server then describes its tools in plain natural language, and the LLM decides when to call them, with every exchange traveling over JSON-RPC 2.0. As one academic survey puts it, the agent autonomously discovers, selects, and orchestrates tools based on task context.

For a defense practice, the "why should I care" is concrete: MCP is how you ask an AI questions about your own case data without copy-pasting discovery into a chat window. Instead of dragging a 40-hour bodycam dump or a scanned police report into a prompt, the AI reaches into your workspace through a server you control. A tool like list_cases might be described to the model as "returns the cases in your workspace with their evidence counts" — the model then calls it when you ask "what's in the Smith case?"

That pattern is already moving into legal tech. Harvey, the legal AI platform, announced in December 2025 that it operates as both an MCP client and an MCP server, exposing document analysis and research queries to other systems. Evidence Copilot takes the same approach for criminal-defense work: its MCP server exposes five read-only tools —

• list_cases — see what matters are in the workspace
• list_evidence and search_evidence — find the bodycam, jail call, or report you need
• read_window and get_citation — pull the transcript window and the exact cited moment

— all org-scoped, gated by revocable tokens, and fully audited. That audit posture matters: the NSA has noted that MCP's rapid proliferation has outpaced its security model, so read-only, logged access is the right default for anything touching client files.

The scale here is real, not hype. Server downloads went from roughly 100,000 in November 2024 to over 8 million by April 2025, and the ecosystem now counts 10,000+ published servers. If you review discovery in Claude Desktop, the servers you connect are the new perimeter — pick ones that log everything and touch nothing they don't need to.

A Domain-Specific Example: An MCP Server Built for Case Evidence

Generic MCP servers like GitHub or Postgres show the pattern, but they don't answer the question a defender actually cares about: what does this look like when the data is discovery? A domain-specific example makes it concrete.

Evidence Copilot — a grounded evidence-review workspace for criminal-defense teams — ships an MCP server with five read-only tools:

• list_cases — pull the cases you have access to
• list_evidence — enumerate the files in a case
• search_evidence — full-text search across transcripts and documents
• read_window — read a specific transcript window
• get_citation — retrieve the exact source moment behind an answer

In practice, from Claude Desktop or Claude Code, it looks like plain conversation. You ask it to "list my cases." You ask it to "search the bodycam transcripts for the Miranda warning." You ask it to "read the transcript window around 14:32." The MCP host creates a client for each server, the server responds with natural-language descriptions of its tools, and the model decides when to call them — the architecture described in the protocol's technical documentation.

The design choices matter more than the tool names. Every tool is read-only. Tokens are org-scoped and revocable. Every call is fully audited. That posture is deliberate: the MCP ecosystem's documented weak point is security, with the official spec now requiring OAuth 2.1 best practices and forbidding token passthrough, and the NSA noting that MCP's "rapid proliferation has outpaced the development of its security model." A read-only, audited server sidesteps most of that risk surface — nothing can be modified, only queried.

This isn't a gimmick pattern in legal tech, either. Harvey, the legal AI platform, announced MCP adoption in December 2025, operating as both an MCP client and an MCP server, and pointed to MCP's support for centralized permissions, auditing, and ethical walls applied uniformly across connected systems. When a legal AI vendor with enterprise clients builds on MCP with governance front and center, the pattern earns credibility with an ethics-conscious audience.

The five-tool shape also maps directly onto how defense work actually happens. Before a suppression hearing, you search the interrogation footage for the Miranda warning and read the window around it. Before cross, you pull the exact citation for a quoted line from a jail call. The MCP server doesn't replace the workspace — it lets you run those queries from the assistant you're already sitting in, with the audit trail intact.

For a skeptical reader, the takeaway is simple: an MCP server is just a structured, permissioned way to let an AI assistant ask your case data questions — and the legal industry is already building them that way.

The Part That Matters for Attorneys: Read-Only, Scoped, Audited

Before you connect any AI tool to client files, you should ask the security questions the vendor hopes you won't. MCP has real, documented vulnerabilities — a known CVE (CVE-2025-6514) rated CVSS 9.6 in mcp-remote, a second in MCP Inspector, and an NSA assessment that MCP's "rapid proliferation has outpaced the development of its security model." That's the elephant in the room, and a skeptical defender should name it before trusting any MCP server with discovery.

The spec itself is catching up. The official MCP security guidance now requires OAuth 2.1 best practices and explicitly forbids token passthrough — the pattern where a server forwards your credentials to a third party without your knowing. Legal AI vendor Harvey made the same point when adopting MCP, citing centralized permissions, auditing, and ethical walls as the reason the protocol fits legal work.

So what does a defensible MCP server look like when client confidences and work product are on the line? Run the same governance checklist you'd run on any outside vendor touching privileged files:

• Read-only tools. The server exposes queries — list cases, list evidence, search, read a transcript window, pull a citation — not actions. Nothing in the toolset can modify, delete, or send evidence anywhere.
• Org-scoped access. A token belongs to one defense office. Your Claude Desktop session sees your cases and nobody else's, ever.
• Revocable tokens. When an investigator leaves the office, you revoke the token and their access ends — no shared passwords floating around.
• A full audit trail. Every query is logged, so if a discovery dispute or ethics question ever arises, you can show exactly what was accessed and when.

Evidence Copilot's MCP server is built on exactly that posture: five read-only tools (list_cases, list_evidence, search_evidence, read_window, get_citation), org-scoped, revocable, fully audited. You can ask Claude Desktop "which bodycam clips in the Smith case mention the K-9 alert?" and get answers with citations into the exact video second — while the underlying files stay immutable and every AI output stays marked as pending human review.

That combination matters more than any feature list. When the question is whether a tool is safe enough to point at a client's interrogation footage, the honest answer is the architecture: read-only by design, scoped by organization, logged end to end. Anything less deserves the skepticism.

Try It: Querying Your Cases from Claude Desktop

The best way to understand an MCP server is to point one at your own caseload. Here's a walkthrough using Evidence Copilot's MCP server, which exposes five read-only tools — list_cases, list_evidence, search_evidence, read_window, and get_citation — to Claude Desktop or Claude Code.

First, generate a token from your workspace settings. The token is org-scoped, revocable, and every call is audited, which matters given that the NSA has noted MCP's rapid proliferation has outpaced its security model. You then add the server to Claude Desktop's config, and Claude discovers the tools automatically — the host creates a dedicated client per server, and the LLM decides when to invoke each tool, per the protocol's architecture.

Try these prompts against a real case:

• "List my active cases" — calls list_cases and returns every matter in your org scope.
• "Search for discrepancies between the police report and the bodycam transcript" — search_evidence runs full-text search across diarized transcripts and OCR'd documents, surfacing report-vs-bodycam conflicts.
• "Show me the transcript around the moment cited in that answer" — read_window pulls the exact cited window, down to the second of video or page of the PDF.

Notice what's happening under the hood. The server is doing what MCP was built for: connecting the AI assistant to your data sources without custom integrations, the scaling problem Anthropic cited when introducing the protocol in November 2024. Legal AI is moving this direction generally — Harvey announced MCP adoption in December 2025, operating as both client and server with centralized permissions and auditing, a pattern Harvey describes as enabling ethical walls across connected systems.

The workflow constraints carry through: every answer cites the exact source moment, and every AI output is marked pending human review. The MCP server is read-only by design — Claude can query your cases, never modify evidence. Originals stay immutable, and the audit trail records each call.

If you want to see this against your own discovery, book a 20-minute walkthrough at evidencecopilot.com/book, or start on the Solo plan at evidencecopilot.com/signup — $39/user/mo, published pricing, no feature tiers.