Every data tool shipped an MCP server this year. Your agent still can't build on most of them.

MCP服务器成了今年数据工具的标配，几乎所有产品都宣称支持它。“我们的AI能调用它”已经不再是卖点。但开发者真正该问的问题是：AI调用完这个工具后，到底能拥有什么？这就像给AI一把钥匙，但有些钥匙只能打开玻璃窗看看里面的报表，AI读完数据却无处存放自己算出来的新结果，用一次就忘，本质上只是个计算器。而真正合格的MCP服务器，应该给AI一个可以持续写入和读取的“私人工作台”，让它能创建数据库、存入数据、反复回来修改迭代，做出超越单次对话的成果。这个区别看起来技术，影响却很实在。以后你用AI分析数据，可能不会只是得到一段文字回复，而是获得一个由AI帮你搭建好、持续更新的数据工作区。对企业来说，选错工具意味着AI永远只能当顾问不能当员工；而选对工具，AI才真正从“聊天的”变成了“干活的”。判断标准很简单：AI干完活之后，留下了什么？

Originally published at <a href="https://nlqdb.com/blog/mcp-server-what-does-the-agent-own/?utm_source=devto" rel="noopener noreferrer">nlqdb.com/blog</a> MCP is the new "we have an API." Writing a competitor comparison recently, I went to mark "agent-callable" as our differentiator against an AI data-notebook tool — and stopped, because they'd shipped an MCP server too. So had the BI tool two rows up. The honest move was to concede the checkbox. But conceding it surfaced the real axis, and it's one worth naming. <h2> Two shapes of MCP server </h2> There are two shapes of MCP server, and they look identical in a feature matrix. The first wraps a destination app: "ask my published notebook a question," "answer from my dashboard in Slack." The human's workflow, now reachable by an agent. The second exposes infrastructure the agent owns: provision a database, write rows, query them, migrate the schema. Both speak MCP. Only the second lets an agent build something that outlives the conversation. The tell is to ask what the agent owns after the call returns. If the answer is "a view into a human's analysis," that's a genuinely useful human-in-the-loop surface — and a dead end for an autonomous agent, because the agent can read but can't accumulate. It has nowhere to put the row it just computed. An agent that can query but not persist is a calculator, not a coworker. <h2> "Does it have MCP" is the wrong question </h2> So the question to ask a tool's MCP server isn't "does it exist" — by 2026 it always does. It's "what does it let the agent own?" Read-only over someone else's app, or a substrate the agent can write to and come back to. The matrix can't tell them apart; you have to read what the verbs actually do. (At <a href="https://nlqdb.com" rel="noopener noreferrer">nlqdb</a> the MCP verb <code>nlqdb_query</code> materialises a Postgres on first reference — omit the database id with none provisioned and it creates one from the goal, so the agent gets a database it owns, not a window into ours. The comparison that prompted this is at <a href="https://dev.to/vs/hex/">nlqdb vs Hex</a>.)