MCP is the difference between an assistant that discusses your firm and one that works in it. Without it, you paste case facts into a chat window. With it, you ask a question and the assistant goes and reads the matter itself.
MCP for lawyers covers what the protocol is. This is the practical layer: which connectors are worth running, in what order, and what to lock down before you turn any of them on.
Case management, first and most valuable
This is where the answers live, so it is where the value is concentrated. Connected properly, you can ask which matters have had no activity in 30 days, what the posture is on a specific file, or which cases are missing a required document, and get an answer from live data rather than a report someone ran last week.
Clio’s MCP server is the most mature option for firms on Clio. Other case management vendors are moving in the same direction at different speeds, and if yours has an API, a custom connector is achievable.
Start read-only. The value of asking questions is most of the total value, and it carries almost none of the risk.
Calendar and deadlines
Second, because deadline questions are constant and the data is simple.
What is on the calendar this week across the firm, which matters have a deadline in the next ten days, where are the conflicts. Court deadlines are the highest-consequence data a firm holds and the least well surfaced, because they sit in a calendar nobody looks at in aggregate.
Keep this read-only permanently in most firms. An assistant that can create calendar entries can also create wrong ones, and a wrongly moved deadline is the kind of mistake that becomes a malpractice claim.
Documents
A connector to your document store lets the assistant find and read the right file instead of you locating and uploading it. “Find the retainer agreement on the Alvarez matter and tell me what the fee split says” becomes one question.
The exposure to think about is scope. A document connector with access to everything can read everything, including the personnel file and the firm’s own financials. Scope it to the matter directories and nothing else.
Useful and the one to be most careful with. Reading email to summarize a thread or find what a client last asked is genuinely helpful. Sending email on your behalf is a different order of risk entirely.
If you connect email, connect it read-only, or require an explicit confirmation before anything sends. An assistant that can send mail from your address is one bad instruction away from an embarrassing problem, and email is the channel where mistakes travel furthest.
Billing, last and read-only
Time and billing data answers real questions: unbilled time by matter, realization rates, who is behind on entries. All of that is worth having.
None of it justifies write access. Trust accounting and billing records are regulated, and an AI adjusting a ledger entry is a conversation with your bar association that you do not want. This is the same line drawn in build vs buy: compliance-bearing systems stay conservative.
The permission rules to set before you connect anything
| Rule | Why |
|---|---|
| Read-only until proven | Reading is most of the value and almost none of the risk |
| Scope to the minimum | A connector should see the matters it needs, not the whole system |
| Human confirmation on writes | Any change to a client record gets a person’s approval |
| Never connect trust accounting for writes | Regulated ledger, unacceptable downside |
| Log what it did | You need to reconstruct actions later, and eventually you will need to |
| One system at a time | Wire one, use it for two weeks, then add the next |
That last rule prevents the common failure. Firms connect six systems in a weekend, something produces a wrong answer, and nobody can tell which connector caused it. Adding them one at a time makes each one’s behavior legible.
Verify before you trust
Run questions you already know the answer to. Ask how many matters opened last month when you already know. Ask what the deadline is on a file you just looked at.
Do that for a couple of weeks. Connectors fail in quiet ways: a filter that silently excludes archived matters, a date field that means something other than what you assumed, a permission that hides records from the connector’s account. You find those by checking answers against known truth, not by trusting confident output.
Once reads have been reliable for a while, and only then, consider writes on the lowest-stakes system you have.
Do this today
Check whether your case management vendor publishes an MCP server. If you are on Clio, the setup is the shortest path in this whole list.
Connect it read-only. Then spend twenty minutes asking questions you already know the answers to. That session tells you whether the connector sees your data correctly, which is the only thing worth knowing before you rely on it.