👋 Hey, I'm Kaleb. I help research teams go from surviving to thriving in the Age of AI.
Every research leader I've talked to this quarter keeps circling the same question—and it isn't "build or buy" anymore. It's: “can we just wire AI into the repository we already have?”
Build versus buy was last year's fight (soooo passé): own the whole stack or rent someone else's. I've lived both ends—we built our research insights engine multiple times at Instacart: a partner tool, a homegrown AI one, then back to a partner, the cycle repeating. Each version carries its own issues and costs. (I unpacked that whole saga in last week's piece—Buy or Build with AI: You Pay Either Way.)
But there's a third door now, and it's the one everyone's reaching for: don't rebuild, don't rip-and-replace—just connect an AI to what you've already got. On paper, it's the best of both worlds. In practice, it mostly is. But like anything, it takes diligence and vigilance because the wire approach comes with its own bills: security, safety, and speed.
That third door has a name—Model Context Protocol (MCP for short)—and here's the one line I want you to remember before we unpack the approach: access is not rigor. Wiring the AI in is the easy part. What flows through the connection, and who's accountable for it, is the hard part.
A primer on MCPs
First, fast and plainly, because on a panel last week I watched the same question scroll past a few hundred researchers over and over: "Okay, but what actually is an MCP?"
What MCP actually is. MCP stands for Model Context Protocol—basically the standard that lets an LLM reach information, services, and tools. Anthropic released it as an open standard in late 2024, and it just went through its biggest revision yet, only weeks ago—so if the ground feels like it's still shifting under this thing, that's because it is. You've probably already used one without knowing it: if you've used one of Claude's connectors to pull a doc from your Google Drive without copy-pasting it, that runs over an MCP layer.
Why are MCPs en vogue? Rewind a couple of years. If you wanted your AI to talk to Slack, someone from the engineering team had to hand-build that connection. Then another for Drive. Another for your repository. And every AI tool needed its own copy of each—a wired mess of custom code where one change downstream snapped something else. MCP moves all of that to the middle: a tool builds one MCP server (usually the vendor builds it), and any AI that speaks the protocol just connects. Built once instead of a hundred times. The image that sticks: MCP is the standard for connecting things. Think USB-C. USB-C didn't make your laptop or your headphones better—it just meant one plug fits everything; you can power your laptop and download files through it. So one cord replaces a drawer of adapters. MCP is that standard for AI. Your tools build one end (the server), your LLM is the other end (the client), and MCP is the standard both agree to. It's not an app, and it's not something you buy—it's the shape of the connection, not the thing on either side of it.
What MCP is not. This is where most people get tangled—so, fast:
Not a skill. A skill is a set of instructions you hand the AI, a recipe. MCP is the connection the AI uses to reach your stuff. You can have either without the other.
Not a plugin or an app. You don't download an MCP the way you install an app. The tool stands up a server; your AI connects to it as the client.
Not just another API. Tools still have APIs underneath. MCP is the shared standard on top, so you stop hand-building a new connection for every single one.
Not a security layer. The standard says how to connect, not how to keep the connection safe. Left open, it can be hijacked—through over-broad access or a hidden instruction in your data that makes the AI act on its own. Security is something you add, not something the standard ships.
Not intelligence. It doesn't make the AI smarter or do any of the thinking. It only decides what the AI can reach—which is exactly why access is not rigor.
The standard guarantees everything fits—not that it's secure, safe, or fast. That's the catch a standard hides, and it's why access is not rigor: MCP standardizes the connection and leaves the three things you actually care about to you.
Panacea or Placebo?
Look at what Wire does to the build-versus-buy decision. You keep your own well-kept repository—your taxonomy, your data, your boundary—so you get the control that made build attractive. But you skip the eighteen-month engineering project, because the connector is mostly built for you—so you get the speed that made buy attractive. No full rebuild, no full lock-in. That's why it's the door du jour that everyone's reaching for, and I'm reaching for it too: as a consultant, I have my Obsidian file system, my Drive for official documents, Granola note-taker, and my well-kept research repository wired into one Claude. When I'm prepping for a client call, I ask "what do I already know about X?" and get a cited answer in seconds that pulls across all of it. Research stops being a graveyard of finished decks and becomes something you can question quickly to have an immediate answer live. That's real.
You've probably already bumped into someone's crude version of it. Ask Claude to fix one line in an existing Google Doc and it won't—it spins up a brand-new doc instead. Annoying, until you see it for what it is: the tool vendor, in this case Google, decided that letting an AI edit your existing work is too risky, so they clamped it down to create-only. That's their version of a surge protector. For everything they didn't clamp—your repository, your transcripts, your participant data—the protection is yours to wire in. (Ask me how I know: I once told Claude to edit one section of a Figma file and it deleted the whole thing.)
Now, the gotchas you need to remember.
A connector doesn't do the thinking—it just gives you faster access to whatever sits on the other side. Point it at a mess of uncoded, untagged transcripts and MCP hands you faster access to the slop. Garbage in, garbage out…just quicker. So cleanliness and organization still matter.
Also, the moment you connect, your data crosses a boundary—Marvin's own help center says it plainly: "when you ask the AI to analyze a transcript or search your data, the content is sent to the AI model as part of the conversation." Credit to them for writing it down. A universal plug makes everything fit the socket; it says nothing about what you send through it, how to protect it, or whether that current should be flowing at all. Surge protection isn't baked into the standard—you gather and build that yourself.
Four questions to run before you connect anything. Not a checklist to rush—the real work Wire hands back to you. (The full run-before-you-connect version is this week's Desk.)
1. Have you scoped it, or just opened it?
Have you connected one curated project, read-only—not the whole repository?
Have you kept the exposed tool count under ~10–15? The more tools you expose, the worse the AI gets at picking the right one: right about 91% of the time at 10 tools, slipping to 87% by 15 (Rodrigues & Vas, 2026).
Have you intentionally sorted read-only vs. write/delete/send—with a human in front of anything irreversible?
2. What actually leaves the building—and is it organized and optimized to do so?
What's in the repository—and what protection sits on the personally identifiable information inside it?
Is permissioning and redaction supported in the MCP layer—so confidential (e.g., attorney-client privilege, personally identifiable data, health, financial) data isn’t leaked to the wrong person?
What's your org's data security & privacy policy on sending participant data to a model provider?
"Not used for training" and "not transmitted" are two different promises—which one do you actually hold?
3. Who else can reach in once it's connected?
What security protocols and protections do they have in place? A standard makes things fit; it doesn't keep them secure. Every tool you expose is another door—and wiring in through MCP roughly doubled the break-in rate in testing, from 26.4% to 52.8%, climbing higher as tools were chained together (Maloyan & Namiot, 2026).
Is this a read-only, scoped connection—or a standing open line into your whole repository?
Could a booby-trapped file, or an instruction hidden inside your own data, make the AI act through the connection without you asking? (Think of it as the phishing email attachment you shouldn't open—now living inside your repository.)
Do they have a red-teaming report for their MCP layer that they can share with you?
4. Who got consent—because the protocol won't?
MCP governs what you let the AI reach. It has no concept of participant consent.
Do you have a valid GDPR lawful basis to send this personal data to a new processor?
For older records: does the original consent even cover AI processing? Purpose limitation says a consent collected for one purpose doesn't stretch to a new one—so those two-year-old transcripts are the trap. (Not legal advice—loop in your privacy or legal people.)
So is wiring through MCP the best of both build vs. buy worlds?
Mostly. If you can pay the bill it requires: scoping and intentionally designing for privacy, security, and performance. Remember: whichever door you pick, you pay either way.
Build pays in engineering and maintenance.
Buy pays in cost and lock-in.
Wire pays in governance and maintenance—and because the connector is so easy, that's the payment people forget is ongoing.
The method of connecting (MCP) is the last ten percent. The repository people trust—kept clean, governed, actually used—is the ninety percent that no protocol ships you.
The Desk
This week's Desk: the MCP Connection Readiness pack—six checks to run before you connect, and the questions to ask your vendor before you trust one. Every line carries its one source (the spec, the research, the law).
👇 Subscribe below to see get the MCP Connection Readiness pack. 👇
The Red PeN
26.4% 👉 52.8 %
Researchers ran 847 simulated attacks on AI setups. When the AI was wired into its tools through MCP, attackers broke through about twice as often—the success rate jumped from roughly a quarter of attempts to over half. And the more MCP tools you chained together, the worse it got.
— Maloyan & Namiot, 2026, Breaking the Protocol (arXiv:2601.17549)
Remember: MCP’s are not inherently secure. The wider the access, the more security risk you introduce. Frame it as architectural inheritance, not a reason to panic—but scope read-only and gate the destructive tools, because you're inheriting that surface the moment you connect.
The Tabs
A collection of what I’ve been reading the past couple of weeks, if you’re curious like I am:
Buy or Build with AI: You Pay Either Way (Hey Kaleb & Co.)—Last week's piece—the build-versus-buy decision this edition's third door grows out of. Start here if you're still deciding, not yet connecting.
Why Research Repositories Fail (NN/g, Rosala)—Your well-kept repository is the whole ballgame. Here's why most fail even without AI—the connector doesn't fix this, it inherits it.
Access Marvin data in MCP-compatible tools (Marvin)—The clearest sentence any vendor has written about MCP: yes, your transcript content is sent to the model. Read it as the template for what to ask your vendor.
The EDPB's opinion on AI in compliance with GDPR (Orrick)—The regulators' own view on lawful basis when AI meets personal data—the consent question, from the source.
THE AIXUXR Watercooler
A few weeks back, I joined a panel with a couple hundred researchers on exactly this question: what MCP changes for research data.
Live-action shot of Ben Wiedmaier (HeyMarvin), me (Kaleb Loosbrock - AIxUXR/HeyKaleb & Co), and Martin Garcia (Ninjatrader) discussing all things MCP. Thanks for the invite, Marvin team!
The MCP panel—watch the replay. The through-line I keep citing: the spec has no baked-in participant consent primitive, so the governance work lands on you.
The KNICK-KNACKS
A place for comfort, fun, and distraction to brighten up your day.
Sage advice on Care vs. Carry (reel)—themimak_ on distinguishing the difference between caring and carrying.
Scaling isn’t straightforward (reel)—ayana.g123 argues that traditional AI scaling methods are hitting a wall and yielding diminishing returns, hinting that smaller models may be on the horizon.
Europe's next euro banknotes (the shortlist)—from Marie Curie to migrating storks, the designs in the running. A small, lovely rabbit hole.
Artemis II, set to film (watch)—a cinematic tribute to the mission's imagery. Three minutes of looking up.
Got any ideas? Say hey and send ‘em my way or drop them in the comment box below…😜
Tell me in the comment box below—have you built, bought, or hacked together your research repository? What broke? I'm collecting the patterns, and I'll bring them back in a future edition.
Stay curious, stay critical, stay cool.
Kaleb
AI Usage Disclosure: Practicing the T in HEARTS. This piece is human-led and AI-assisted. The story, the point of view, and every editorial choice are mine. I used AI to help with gathering, structuring and formatting the content. The judgment calls — what to keep, what to cut, what's true to my experience — stayed with me.