AI agents in business: MCP, use cases and risks for SMEs

What an AI agent is, and what it is not

There is no fixed definition; the European Commission points out that the term “AI agent” is used inconsistently. The core is agreed: an agent takes in input from its environment and carries out actions based on it. Germany’s Federal Office for Information Security (BSI) describes it as a software system that independently carries out actions based on inputs to a large language model. Anthropic distinguishes two designs: in workflows, the language model and tools run along predefined code paths. In agents, the model itself directs which steps it takes and which tools it uses.

• Model: a language model understands the task, plans the next step and phrases the result.
• Tools: defined functions such as “find customer”, “read calendar” or “create case”. These are the only way the agent reaches your systems.
• Goal: a clearly scoped assignment, for example “classify the enquiry and draft a reply with the order data”.
• Loop: the model calls a tool, gets the result back and decides again, until the task is done or a stopping condition applies, such as a maximum number of iterations.

What an agent is not: a digital employee you can hand a mailbox to. The model can misunderstand tasks and carry errors through several steps. Anthropic names exactly this as the price of autonomy: higher costs and the potential for compounding errors. An agent is therefore only as reliable as the rules, permissions and checks built around it.

Chatbot, workflow, agent: the difference

Bitkom, the German digital industry association, draws the line briefly in its 2026 survey: unlike a chatbot, which only answers questions, an AI agent completes tasks on its own, for example by researching price comparisons and obtaining quotes. In between sits the workflow, in which AI handles individual steps.

If your process has fixed steps, workflow automation is usually the better start. An agent pays off where no fixed path can be set out in advance.

How agents act: function calling and tool use

Technically, agents rely on a feature the big providers call function calling or tool use. According to the OpenAI and Anthropic documentation, the flow is essentially the same: your application describes the available tools to the model with a name, a description and a JSON schema for the parameters. The model decides whether it needs a tool and returns a structured call. That call is executed by your application, not by the model. The result goes back to the model, which then answers or calls the next tool.

MCP: the Model Context Protocol explained

MCP is meant to standardise how AI applications connect to other systems. Anthropic introduced MCP on 25 November 2024 as an open standard, together with a specification, SDKs and ready-made servers, including for Google Drive, Slack, GitHub and Postgres. On 9 December 2025, Anthropic donated MCP to the newly founded Agentic AI Foundation (AAIF), a fund under the umbrella of the Linux Foundation. It was co-founded by Anthropic, Block and OpenAI; its founding projects are MCP, Block’s agent framework goose and OpenAI’s AGENTS.md. According to Anthropic, ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code, among others, used the protocol at that point.

• Roles: the host is the AI application, such as a chat program or a development environment. Within it, a client connects to an MCP server that provides access to a system, for example an order database.
• Building blocks: a server offers tools (functions the model can have executed), resources (data and context) and prompts (templates for users).
• Technology: the messages are JSON-RPC. Local servers run over a process’s standard input and output (stdio), remote servers over Streamable HTTP.
• Version: the current specification is 2026-07-28. It made the protocol stateless: every request carries its own protocol version, and the connection handshake is gone.

The practical benefit for an SME: an MCP server for an internal system is built once, checks sign-in and permissions centrally and can serve different AI applications. The protocol does not provide security automatically, though. The specification itself states that MCP cannot enforce its security principles at the protocol level. It requires the AI application to obtain the user’s explicit consent before invoking any tool and treats tool descriptions as untrusted unless they come from a trusted server. Vet third-party MCP servers before use, like any other software.

Realistic use cases in an SME

Agents are still the exception in German companies. In Bitkom’s summer 2026 survey, 11 percent of companies that use AI or plan or discuss its use already deploy AI agents. 29 percent plan to, 31 percent are discussing it, and for 24 percent it is currently not a topic. The survey covered companies with 20 or more employees. Bitkom president Ralf Wintergerst puts it this way: AI agents today are roughly where artificial intelligence as a whole stood three years ago. The survey gives no figures for businesses with fewer than 20 employees.

• Sorting the inbox: the agent identifies concern and urgency, looks up customer and order in the CRM and saves a draft reply that a person checks and sends.
• Taking appointments and orders: ask for missing details, check free slots in the calendar, suggest appointments. Nothing is booked until it is confirmed.
• Status queries: read delivery status from the inventory system and, if it deviates, create a case in fields defined in advance.
• Research and comparison: gather quotes or data sheets from approved sources and present them as a table. A person chooses.

Such cases suit an agent well when the necessary interfaces exist, errors can be caught before they take effect and the agent can start out read-only, producing drafts. More examples are in the article AI automation in SMEs: 6 use cases.

The three big risks

Prompt injection: instructions hidden in third-party content

Prompt injection ranks first in the current OWASP Top 10 for LLM Applications (2025 edition). The indirect variant is the dangerous one for agents: the instruction is not in your input but in an email, document or web page that the agent reads. The BSI gives the example of a manipulated email that makes an agent forward all future emails. The core of the problem: according to the BSI, a language model on its own cannot tell user instructions, system instructions, external instructions and data apart. As early as 2023 the BSI pointed out that no reliable countermeasure fully eliminates the problem; OWASP likewise considers it unclear whether fool-proof prevention exists.

Permissions that are too broad

OWASP lists “Excessive Agency” as a risk in its own right and names three causes: too much functionality, too many permissions and too much autonomy for high-impact actions. The OWASP Top 10 for Agentic Applications of December 2025 illustrates this with a simple case: an agent meant only to summarise emails can delete or send emails without confirmation. Add a prompt injection, and the permissions decide the damage.

Costs from loops

Cloud models bill by processed tokens. With agents, according to the Anthropic documentation, the tool descriptions, the calls and every tool result count too, and in its example the second request sends the previous conversation again. Long loops therefore get expensive quickly. The OWASP Top 10 for Agentic Applications describe a typical failure pattern: an agent that repeatedly calls costly interfaces until services fail or the bill spikes. The related risk in the LLM list is “Unbounded Consumption”: uncontrolled usage up to financial losses.

Safeguards every agent project needs

The recommendations of OWASP, the BSI and the MCP specification largely overlap. Together they limit the possible damage:

• Least privilege: only the tools the task needs, narrowly scoped, with a dedicated technical user. Read-only where that is enough; the summariser gets no send or delete rights.
• Approvals: actions with consequences, such as sending, booking or deleting, wait for a person to confirm, ideally with a preview of what will happen.
• Logs: record every tool call with time, parameters and result, and review them regularly.
• Sandbox and network limits: run code and tools in isolation and allow outbound connections only to approved destinations.
• Budgets and stopping conditions: a maximum number of steps per task, token or cost limits per day, automatic throttling when they are exceeded.
• Mark third-party content as data: keep emails and documents clearly separate from the actual assignment, as the BSI baseline protection of September 2026 describes.
• Tests: before go-live with real, anonymised cases and deliberate attack attempts, and again after every change to model, prompt or tool.

This is how I build AI agents for businesses: starting in suggestion mode, permissions in the code rather than in the prompt, logs and cost limits from day one.

The legal framework in brief

Under the EU AI Act, according to the European Commission’s AI Act Service Desk, agents are not a separate category: the rules for AI systems and general-purpose AI models apply to them too. If an agent interacts with people or generates content, the transparency obligations under Art. 50 have applied since 2 August 2026. If it is used in a high-risk area under Annex III, such as selecting job applicants, the additional obligations apply from 2 December 2027 following the Digital Omnibus on AI, and from 2 August 2028 for AI in products covered by the EU product legislation in Annex I. The full timeline is in the article The EU AI Act for SMEs.

At least as important is Art. 22 GDPR: nobody has to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them. The Court of Justice of the EU reads this as a prohibition in principle, with exceptions only in the cases listed in Art. 22(2): contract, legal provision, explicit consent. The Datenschutzkonferenz (DSK), the conference of German data protection authorities, gives an example that fits agents almost word for word: an AI application that evaluates applications and independently invites candidates to interviews infringes Art. 22(1). According to the DSK, merely formal human involvement is not enough. What else applies to tiers, contracts and data flows is in the guide to AI and the GDPR.