ExpressVPN MCP server: the first VPN built for the AI era

The world’s most popular VPN quietly made a move that bridges the gap between AI coding tools and internet privacy infrastructure.

First, what even is MCP?

If you haven’t heard of the Model Context Protocol yet, you will be hearing a lot more about it.

MCP was introduced by Anthropic (the company behind Claude) in November 2024 as an open standard for connecting AI systems to external tools and data sources. Think of it as a universal plugin system for AI — instead of every developer having to write custom code to link their AI assistant to a specific tool (a database, a GitHub repo, a file system, a browser), MCP gives everyone a shared language to make those connections happen.

The analogy that makes the most sense: it’s like a “universal remote control” for AI. Before MCP, connecting an AI assistant to, say, a PostgreSQL database required a bespoke, custom-built integration. With MCP, the same protocol that lets Claude search your files can also let it query your database, manage your code — or, now — control your VPN.

The architecture is elegant. There’s a host application (like Claude Code or Cursor), an MCP client built into that host, and an MCP server that exposes specific capabilities to the AI. The server acts as the bridge — it tells the AI what it can do, and then executes the commands the AI sends back.

Since its launch, MCP has been adopted widely across developer tooling. Claude Desktop, Cursor, OpenAI’s Codex, and dozens of other platforms now support it. What’s been notably missing from this ecosystem, though, is VPN infrastructure. Until now.

Enter ExpressVPN — the first VPN to go MCP

On March 5, 2026, ExpressVPN announced the beta launch of its Model Context Protocol (MCP) server, becoming the first VPN provider in the world to adopt the technology.

Here’s the simple version of what ExpressVPN has built: a local MCP server that runs inside the ExpressVPN desktop app and lets compatible AI coding tools control your VPN connection using plain English commands.

So instead of alt-tabbing out of your code editor to manually switch your VPN to a UK server, verify your kill switch is on, or run a DNS leak test — you just ask your AI assistant to do it. Right there, in your workflow.

“Connect to a UK server.” — Done.
“Am I protected right now?” — Done.
“Run a full diagnostic and tell me what’s wrong.” — Done.

The MCP server currently works with Claude Code (Anthropic), Codex (OpenAI), and Cursor, as well as any other MCP-compatible AI client that can connect to local MCP servers via URL. It runs on ExpressVPN’s desktop apps for macOS, Windows, and Linux.

Related /

Why should developers care?

The modern developer workflow has changed dramatically. AI coding assistants now write code, run tests, manage files, and even deploy applications. The bottleneck that’s remained stubbornly manual? Network configuration.

Before running a sensitive script on production data, you want to verify your VPN is active. Before testing a geo-restricted API, you need to switch server regions. When something weird happens with latency or routing, you’re running diagnostics manually in a separate app while your AI assistant sits idle.

With the ExpressVPN MCP server, those manual steps disappear into the workflow. Your AI can:

Check your connection status before running sensitive scripts
Switch server regions to test geo-dependent features across different locations
Verify security settings — kill switch status, DNS routing, protocol selection
Run diagnostics when performance drops
Automate complex workflows that combine security checks and region switches

The practical use cases are already compelling. Imagine an AI assistant that automatically verifies your VPN is active before deploying to a staging environment. Or one that cycles through five different server regions, tests how your app behaves from each, logs the results, and switches you back to your home server — all without you touching a thing. That’s not speculation. That’s what this thing is built to do.

The security design is actually smart

Here’s where ExpressVPN deserves credit beyond just being “first.” The way they’ve designed the security boundaries around this feature shows careful thinking about the real risks involved.

ExpressVPN has addressed potential concerns with several protection layers:

Disabled by default. The MCP server doesn’t turn on automatically. You have to go into the ExpressVPN desktop app and explicitly flip a toggle to enable it. No surprises, no accidental activation.

Runs locally only. Everything happens on your device. Remote connections to the MCP server are blocked entirely, meaning there’s nothing external to hijack. The AI tool and the VPN client communicate directly on your machine.

Approved commands only. The AI can only issue commands from a fixed allowlist. It can read VPN status, switch regions, change protocols, and run diagnostics. It cannot access your account credentials, browsing history, or session data.

Zero logs. The MCP server operates under ExpressVPN’s existing no-logs policy — no activity logs, no connection timestamps, no destination data.

It’s a thoughtful design. The strictly local bridge approach in particular is the right call — it means the attack surface for remote threats is essentially zero, which is exactly what you want when AI agents are being handed control over security tools.

Who can use it right now?

The MCP server launched as a beta on March 5, 2026, and it’s not yet available to everyone.

Right now, it’s exclusively available to ExpressVPN subscribers on:

Basic, Advanced, or Pro tier plans (1-year or 2-year subscriptions)
ExpressVPN for Teams

The good news is there’s no additional cost — the MCP server is included with eligible subscriptions. And as a new subscriber, ExpressVPN’s standard 30-day money-back guarantee applies if you want to try it risk-free.

Setup is simple: enable the MCP toggle in the ExpressVPN desktop app settings, configure your AI tool of choice to connect to the local MCP server via URL, and start issuing natural language commands.

The bigger picture: VPNs in the AI era

Zoom out for a moment and this announcement is really about something larger than a neat developer feature.

We’re entering a phase where AI agents — not just AI assistants — are going to be doing real work on our behalf. Not just answering questions, but executing tasks, managing systems, and making decisions within boundaries we set. The tools these agents interact with need to be ready for that shift.

Most software infrastructure hasn’t been built with that in mind. VPNs, in particular, have been almost entirely absent from the MCP ecosystem. ExpressVPN just changed that. If other VPN providers follow suit — and they almost certainly will now that the first has done it — we could see network security become a native, programmable layer of the AI development stack: something automatically checked, configured, and verified as part of any automated workflow, rather than a manual afterthought.

That’s a genuinely better outcome for security overall.

The bottom line

ExpressVPN’s MCP server is a beta product, so it’s not without rough edges, and the supported AI tools list is still fairly short. But the core concept is solid, the security design is sensible, and the timing is right.

For developers already deep in AI-assisted workflows using Claude Code, Codex, or Cursor, this is a genuinely useful addition — one that removes a stubborn manual friction point from an otherwise increasingly automated process. For everyone else, it’s a clear signal of where VPN software is heading: away from being a separate, clunky tool you grudgingly remember to use, and toward being a programmable, automated layer of how you work.

ExpressVPN being the first to do it isn’t just a marketing headline. It’s a meaningful technical step in the right direction — and if the rest of the VPN industry is paying attention, it won’t be the last.