Model Context Protocol (MCP)

How MCP works

MCP has three roles:

Role	What it is
Host	The AI application the person uses: a chat app, a desktop assistant, a coding agent
Client	The connection the host opens to one server
Server	The application side, which describes and runs its tools

A server can offer three kinds of capability:

• Tools: actions the model can call, each with a name, a description and an input schema in JSON Schema, for example "search assets" or "create a share link".
• Resources: data the host can read and give to the model as context.
• Prompts: reusable instructions the server suggests to the person.

Messages use JSON-RPC 2.0. A local server runs on the person's computer and talks over standard input and output; a remote server is reached over HTTPS with the Streamable HTTP transport. When a session starts, the client asks the server for its list of tools. During the conversation, the model decides which tool to call and with which arguments, the client sends the call, and the server runs it and returns the result.

MCP vs a REST API

	REST API	MCP server
Who decides what to call	A developer, in code written in advance	The AI model, during the conversation
How capabilities are described	Documentation read by people	A tool list with schemas, read by the model when it connects
Integration work	Code for each client	One server for every MCP-capable assistant
Typical caller	Websites, product information systems, scripts	Assistants and agents acting for a person

An MCP server usually sits on top of an existing API and applies the same permissions. The API remains the right choice for fixed integrations; MCP is for tasks a person describes in their own words.

Security and governance

• The server acts as a user. Every tool call should run with the permissions of a real account, so the assistant can never do more than that person could.
• Least privilege. An assistant that only searches needs read-only access. Write tools should be granted only when the task needs them.
• Authorisation. For remote servers, the specification bases authorisation on OAuth 2.1: the server publishes protected resource metadata (RFC 9728) that tells the client where to sign in, and the client uses PKCE to obtain a token for that person.
• Prompt injection. Text returned by a tool, such as an asset description written by an outside supplier, can contain instructions that the model may follow. Keeping destructive actions out of the tool list limits the damage.
• Audit. Each tool call should be logged with the account, the action and the result, like any other API request.

MCP in DAM and marketing work

• A marketer asks: "Find approved lifestyle photos of the oak table and put them in a collection for the March newsletter." The assistant searches, filters and creates the collection.
• A product manager asks for a share link to the latest datasheets for a distributor, with an expiry date.
• A librarian asks the assistant to read the controlled vocabulary and propose descriptions for assets that have none, then reviews the changes before they are saved.
• A developer working in a coding agent fetches asset identifiers and details while building a product page.

MCP in Freedam

• Freedam includes an MCP server on each workspace, using the Streamable HTTP transport. The MCP Server page in Administration shows the endpoint, ready-to-copy configuration for common AI assistants and coding tools, the list of tools and a test command.
• It has eleven tools. Five only read: search assets (full-text and semantic search), get one asset, list collections, get vocabularies, and get the status of a background operation. Six can write: upload assets, update an asset's metadata, bulk update, create a collection, add assets to a collection, and create a share link. No tool deletes assets or collections.
• An assistant connects with an API token, or through OAuth: the assistant finds the sign-in page on its own, the person signs in to the workspace (with a password or single sign-on) and approves the connection on a consent screen. Freedam supports dynamic client registration, PKCE and refresh tokens.
• Each tool checks the token's abilities and acts as the token's owner. Access control still hides assets, and creating a share link checks the assets' rights policies.
• Tool calls count against the same limit of 60 requests per minute as other API calls and appear in the same audit log, with the token name, action, IP address and response.

Details: the MCP developer page and the MCP Server page in the Freedam docs.

Frequently asked questions

Is MCP the same as an API?

No. MCP is a protocol for describing and calling tools that an AI model chooses at run time. Most MCP servers call an existing API underneath, with the same permissions and limits.

Which AI assistants support MCP?

Most major AI chat apps, desktop assistants and coding agents can act as MCP clients. Some only connect to local servers, others also connect to remote servers over HTTPS. Check whether your assistant supports remote servers and OAuth sign-in.

Is it safe to connect an AI assistant to a DAM?

It is as safe as the account it uses. Give the assistant a token or a connection with the fewest abilities its task needs, start with read-only access, and choose a server that logs every tool call and offers no delete tool.