In the past 18 months generative artificial intelligence (“AI”) software companies have embraced Model Context Protocol (“MCP”), a new standard for building the next generation of AI applications. MCP promises a future of more powerful and efficient AI, but MCP also introduces significant new challenges for legal professionals, particularly in the realm of eDiscovery.
Relationship between APIs and MCPs
In the past, corporate legal departments and eDiscovery professionals dealt with issues associated with Application Programming Interfaces (“APIs”), a related technology that preceded MCPs. APIs are the rules that allow software programs to communicate with each other and exchange data.
In eDiscovery, APIs have been responsible for “red herrings.” For example, during custodial interviews, a custodian identifies a system as the source of data they use day in and day out, but the data is really being pulled in and displayed from a different system of record.
Much like APIs, MCPs are designed to allow AI agents to access external information and tools and exchange data, APIs differ from MCPs in that APIs enable communication between applications, whereas MCPs are built to support the dynamic, conversational behavior of AI agents.
MCP began as a project at the GenAI company Anthropic and has since been widely adopted across the industry. In December 2025, its creators donated MCP to the Linux Foundation, removing barriers to its widespread use and adoption as a standard. As a result, Anthropic no longer “owns” the intellectual property and there is greater access to MCP technology. For users, this means AI assistants using MCP will become more capable, able to perform complex, multi-step tasks like planning a trip by booking flights, reserving hotels, and adding calendar reminders, all from a single prompt.
Implications for eDiscovery
For corporate legal departments and eDiscovery professionals, this new layer of interaction creates a complex web of discoverable data. When an AI agent uses an MCP to interact with another service, such as asking Claude to send a Slack message, a cascade of digital events occurs. Each system logs these interactions, creating a detailed trail of data that could be crucial if that message, decision, or action, is later the subject of litigation. Understanding and navigating this new data landscape is a challenge that legal teams need to address proactively, not after a lawsuit has already begun.
Traditional APIs facilitate communication between applications. MCPs are built for the dynamic, conversational nature of AI agents. MCPs enables what Anthropic CPO Mike Krieger calls a "ping-pong of intelligence" between systems.
Consider a simple user request: "Claude, send a Slack message to my colleague." That request has at least six actions associated with it, and this assumes the MCP connects to ONE application to fulfill the request:
- The Request: The user gives a command.
- The Recognition: Claude recognizes that the Slack MCP server is connected.
- The Verification: The AI verifies that a tool exists for sending messages and that it has permission to access it.
- The Action: Claude executes the command through the Slack MCP.
- The Confirmation: Slack reports back to Claude that the action was successful.
- The Report: Claude informs the user, "Message sent."
This entire exchange, which feels like a single action to the user, generates a trail of data across multiple systems.
More Discoverable Data – Questions for Corporate Legal Departments
For e-discovery professionals, the critical takeaway is the sheer volume and complexity of the data generated by MCP-enabled systems. The interactions are no longer simple, linear events (input prompt – output) but a conversation between multiple AI agents and software tools. Every system involved maintains its own logs, creating a fragmented but interconnected record of activity.
This presents several questions for corporate legal departments to consider as the business deploys more complex AI agents:
- Data Preservation: How do you identify and preserve all the relevant data points when they are spread across multiple platforms, some of which may be outside your organization's direct control? How do you determine whether these data points are relevant or proportional? A single request could involve your company's AI, third-party services like Slack, and the underlying AI model from a provider like OpenAI or Google.
- Chain Reactions: Tracing the "rabbit trail" of interactions to understand what information was used to make a specific decision will be a difficult task if litigation arises. The relevance of the rabbit trail data may not always be apparent at the onset of a litigation.
- Relevance and Scope: What constitutes the "document" in this scenario? Is it just the final output, or is it the entire string of prompts, API calls, and system responses that led to that output? The scope of discovery could expand significantly to include the logic and intermediate steps of AI agents.
Determining which portions of this data are relevant may be challenging, and, as with all data sources, understanding of its relevance may change over the course of litigation. While preservation and collection of this data may not be proportional to the needs of the case, MCPs create another decision documentation point in the identification and assessment phase of litigation. The fact that companies like Adobe, a staple in many corporate environments, are rolling out MCPs this week means this is not a distant, hypothetical problem. Companies using Adobe may have to track data “moving” back and forth to other systems through the MCPs in use by Adobe.
The goal of MCP is to create a seamless experience where the technology is invisible to the end user. But this "magic" behind the model's ability to solve a task may be scrutinized during discovery. Understanding the mechanics of AI agents and MCPs and preemptively addressing potential questions that may arise during eDiscovery, is an important step toward AI litigation readiness.
YES! PLEASE SIGN ME UP TO RECEIVE EMAIL ALERTS FROM OTHER GUNSTER PRACTICE AREAS.
This publication is for general information only. It is not legal advice, and legal counsel should be contacted before any action is taken that might be influenced by this publication.
Gunster. Florida's Law Firm for Leaders.
As a full-service law firm, Gunster provides full-service legal counsel to leading organizations and individuals from its 13 offices statewide. Established in 1925, the firm has expanded, diversified and evolved, but always with a singular focus: Florida and its clients’ stake in it. A magnet for business-savvy attorneys who embrace collaboration for the greatest advantage of clients, Gunster’s growth has not been at the expense of personalized service but because of it. The firm serves clients from its offices in Boca Raton, Coral Gables, Fort Lauderdale, Jacksonville, Miami, Naples, Orlando, Palm Beach, Stuart, Tallahassee, Tampa, Vero Beach, and its headquarters in West Palm Beach. With more than 320 attorneys and consultants, and 300 committed support staff, Gunster is ranked among the top 200 largest law firms by the National Law Journal and has been recognized as one of the Top 100 Diverse Law Firms by Law360. More information about its practices, industries, offices and news is available at www.gunster.com.
