Agency Lookout"MCP" has started showing up in every marketing tool's changelog, usually with a line like "connect Claude to your data". If you run an agency, the useful question is not what the acronym stands for. It is: what can the AI now do with my clients' accounts, and what could go wrong?
This is a practical explanation, with examples from how we use it.
The one-paragraph version
Model Context Protocol (MCP) is a standard way for an AI assistant (Claude, ChatGPT, Cursor, and others) to use tools that live outside the chat: read a database, call an API, edit a file. A tool provider publishes an "MCP server"; you add it to your AI app as a connector, sign in, and from then on the assistant can call those tools during a conversation. Instead of pasting a CSV into the chat, the assistant fetches the data itself. Instead of copying its suggested code into WordPress, it makes the edit.
It runs on your existing Claude or ChatGPT subscription. The connector is the bridge; the AI plan pays for the thinking.
What it looks like in an agency day
Some things our team does through a connector, in plain words:
"What's open for Acme Plumbing?" The assistant reads the client's tasks, the latest audit findings and the last 30 days of results, and summarises them. Thirty seconds instead of three tabs.
"Work the SEO task about image sizes on Booth King." The assistant reads the task, reads the client's site profile (which theme, which page builder, which caching plugin), looks at the affected pages, makes the change on the live site, re-checks the page, comments on the task with what changed, and marks it done. The person reviews the comment and the page.
"Draft next month's plan for the three clients with failed rechecks." It reads the recheck results and writes the plan as tasks.
"Which clients are over-pacing their Google Ads budget this month?" It reads the pacing numbers for every account and answers with the list.
None of these are magic. They are the same work the team does, done faster because the assistant has the same access the team does, through tools that already know where everything is.
Why this beats "paste it into ChatGPT"
Three reasons, in increasing order of importance:
- No copying. The data is read where it lives, in full, every time. No stale exports.
- It can act, not just advise. Advice you still have to implement is half the job. A connector lets the assistant do the implementation, with your approval.
- It uses your plan, not an API bill. A Claude Pro or Max subscription has a fixed price. Routing agency work through it, rather than through pay-per-token API calls, makes heavy use predictable.
The safety rules to insist on
This is the part most "connect your AI" announcements skip. An assistant that can edit client websites and read client accounts needs the same guardrails you would give a new hire, and a few more.
Per-client access, never one master login. The connector should reach each client's site or account through that client's own connection, held on the server. The assistant should never be handed a list of passwords, and should never be able to see one. If a tool's answer ever contains a credential, that tool is badly designed.
Reads are free; writes are logged. Every change the assistant makes (a page edit, a setting, a snippet) must be recorded with who asked for it and when, in the client's history, so a person can see it later and the monthly report can include it.
Undo for the reversible; confirmation for the irreversible. A page edit can be live immediately if there is an undo. Anything that runs code on the site, deploys to a repository, or changes a setting site-wide should wait for a person to say yes in the conversation, and the connector should refuse to proceed without that.
Read before write. The assistant should not be able to change a page it has not read in this session. This one rule prevents most "it overwrote the whole page" accidents.
Sign-in, not a shared token. Each person connects their own Claude with their own sign-in to the agency's tool, so access stops when they leave, and the audit trail has a name on it. Tokens pasted into config files leak; sign-ins can be revoked from one screen.
Admins only, with an off switch. The person who can connect an assistant should be an admin, and there should be one switch that turns every connected assistant off at once if something goes wrong.
If a vendor cannot answer "where do the credentials live?" and "how do I see what the AI changed?", wait.
Two ways to use it
In the chat you already use. Add the connector in Claude's settings (Settings → Connectors → Add custom connector), sign in, and turn it on in a conversation. Best for questions, summaries, planning, and one-off tasks. Works on claude.ai and the desktop app.
In Claude Code or a coding assistant. Add the same server as an MCP server in Claude Code, Codex or Cursor. Best for longer website work: a list of fixes across several pages, a theme change, a migration. The assistant can run for a while, keep notes, and come back with a summary.
Both run on the person's own subscription. Neither requires a developer.
What we built
Agency Lookout exposes its MCP server per agency. Connect Claude, Claude Code, Codex or Cursor with a sign-in, and the assistant can read your clients' results, audits, notes, tasks and history, create and update tasks, and do website work on each client's WordPress through that client's own connection, following the rules above: page edits are logged and undoable, code snippets and commits wait for your yes, credentials never leave the server, and every connected app is listed on one page with a disconnect button.
It is the same tooling our own team uses, which is the only honest way to find out whether the safety rules hold up. So far they do, and the time saved on "what's open for this client" alone has paid for the subscription.