A step is not a task
'Get customer 4821' is a step. 'Send this customer their contract and invoice the deposit' is a task — it may involve fetching the customer, locating the job, generating a document, creating a signing session, sending it, then creating an invoice.
An API can perform every one of those steps. What it cannot do is decide that those are the steps.
Who composes the sequence?
Historically a developer did, in code, ahead of time. That works when the sequence is known and repeated. It does not work for the long tail of requests a business actually makes, which are phrased in intent, not in endpoints.
MCP lets the model compose the sequence while it runs, calling one tool, reading the result, and deciding the next call.
What keeps that safe?
- Only curated tools are exposed.
- Every tool validates its own input.
- Identity and organization scope travel with every call.
- Irreversible actions require an explicit confirmation step.
- Every executed step is written to an audit trail.