MCP Explained: How AI Tools Are Starting to Talk to Each Other

Updated for July 2026

Eighteen months ago, the Model Context Protocol was a niche open-source spec that Anthropic quietly published on a Monday. Today it's the plumbing running underneath most of the AI industry — from Claude and ChatGPT to VS Code, Cursor, and thousands of enterprise "AI coworker" deployments. This piece walks through what MCP actually is, how it evolved, where it stands right now, and where the real risks and open questions are — with links to primary sources throughout so you can verify everything yourself.

1. The problem MCP was built to solve

Before MCP, connecting an AI model to anything outside its training data — your Slack workspace, a database, a CRM, your filesystem — meant writing a bespoke integration. Every AI application needed its own connector for every data source, and every data source vendor needed a different connector for every AI application. Analysts frequently describe this as an "N×M" integration problem: 10 AI applications and 100 tools could mean up to 1,000 separate integrations, each maintained separately and breaking independently (Gupta, guptadeepak.com).

Anthropic introduced MCP as an open standard on November 25, 2024, describing it as a common protocol for connecting AI assistants to external systems where data lives — content repositories, business tools, and development environments — replacing fragmented, one-off connectors with a single protocol (Anthropic's original announcement).

The comparison that stuck — and that Anthropic itself has used — is USB-C: rather than a different cable for every device, MCP aims to be one standard port that any AI application can plug into and any tool can expose itself through.

2. How MCP actually works (the technical core)

MCP is a client-server protocol built on JSON-RPC 2.0. Three roles matter:

  • Host — the AI application the user interacts with (Claude, ChatGPT, an IDE like VS Code or Cursor)
  • Client — the connector living inside the host that maintains a 1:1 connection to a server
  • Server — a lightweight program that exposes specific capabilities: tools (actions the model can invoke), resources (data the model can read), and prompts (reusable templates)

A client discovers what a server can do by requesting its capability manifest, then invokes tools through structured JSON-RPC calls. Transports have evolved: early MCP relied heavily on local STDIO and remote Server-Sent Events (SSE), but the ecosystem has been migrating toward Streamable HTTP for remote servers, which scales better on ordinary web infrastructure (DigitalApplied MCP adoption statistics, May 2026).

The full technical spec, versioned and publicly maintained, lives at modelcontextprotocol.io/specification, with the project's own blog at blog.modelcontextprotocol.io.

3. From Anthropic side project to Linux Foundation standard

The timeline, verified against primary sources:

  • November 2024 — Anthropic releases MCP as open source. Initial SDK downloads are around 100,000 in the first month (Knak, MCP Adoption 2026).
  • Through 2025 — OpenAI, Google DeepMind, and Microsoft each ship MCP client or server support, breaking what had been provider-specific tool-calling formats.
  • December 2025 — Anthropic donates MCP's governance to the newly formed Agentic AI Foundation, a neutral body under the Linux Foundation, with OpenAI, Google, Microsoft, AWS, and Block among the backers. This is widely cited as the inflection point where MCP stopped being "Anthropic's protocol" and became shared industry infrastructure (WorkOS, "Everything your team needs to know about MCP in 2026").
  • March 2026 — Official TypeScript and Python SDKs reach roughly 97 million monthly downloads, up nearly 970x from launch in about 16 months — for comparison, React took roughly three years to reach 100 million monthly downloads (DigitalApplied, "MCP Hits 97M Downloads").
  • May 2026 — A registry pull from the official MCP Registry API counts 9,652 "latest" server records and nearly 29,000 server/version records overall; GitHub's search API separately returns close to 16,000 repositories tagged mcp-server, and the flagship modelcontextprotocol/servers repo has crossed 86,000 GitHub stars (DigitalApplied, verified adoption data).
  • July 2026 — The next major spec revision, dated 2026-07-28, ships as the largest overhaul since launch (more on this below).

Worth flagging honestly: adoption numbers in this space are noisy and vendor-reported figures don't always agree. One widely circulated claim — that "78% of enterprise AI teams run MCP in production" — is repeated across several marketing blogs but is not independently sourced back to a primary study; treat specific percentage claims like that with some skepticism even when they appear in multiple places, since duplication across secondary sources isn't the same as verification.

4. Who's actually using it

By mid-2026, first-party MCP documentation or MCP server infrastructure exists across Anthropic, OpenAI, Google, Microsoft, GitHub, Vercel, VS Code, Cursor, and ChatGPT (DigitalApplied, May 2026 verification pull). On the server side, companies with official or community-maintained MCP servers include Slack, GitHub, Salesforce, Stripe, HubSpot, Shopify, Notion, Linear, Sentry, Figma, Cloudflare, Postman, and WordPress (which shipped an official MCP Adapter in February 2026) (WorkOS; Knak).

The heaviest early use case, by volume, has consistently been AI-assisted coding: tools like Claude Code, Cursor, and VS Code use MCP to give models live context about a codebase, dependencies, and documentation. Cloudflare's "Code Mode" is a notable example — letting agents dynamically discover and call tools instead of loading every tool definition upfront, which Cloudflare reported cut token usage by more than 98% in some workloads (cited via WorkOS's MCP 2026 overview).

Boston Consulting Group has described MCP as deceptively simple with outsized implications, pointing out that without a shared protocol, integration complexity rises roughly quadratically as agents spread through an organization, whereas MCP turns that into roughly linear growth — build one server per system, and every compliant client can use it (cited in Gupta's enterprise adoption guide).

5. What changed in 2026: MCP grows a body, not just hands

Two developments this year matter more than any download counter.

MCP Apps — the protocol gets a UI

Until January 2026, every MCP interaction was pure text. MCP Apps, the first official extension built on the extensions framework introduced in the November 2025 spec, lets servers return interactive HTML interfaces that render inside a sandboxed iframe in the chat itself — dashboards, design tools, formatted message composers — without leaving the conversation. It was co-developed with OpenAI and works across Claude, ChatGPT, Goose, and VS Code, with launch partners including Asana, Box, Canva, Figma, Slack, and Salesforce. The security model relies on iframe sandboxing, pre-declared UI templates that hosts can review before anything runs, and routing every UI-triggered action through the same audit and consent path as a normal tool call (WorkOS, MCP 2026 guide; Model Context Protocol blog, July 2026 release candidate notes).

The 2026-07-28 specification — MCP goes stateless

The Model Context Protocol project's own blog, co-authored by lead maintainers David Soria Parra and Den Delimarsky, describes the next spec version (locked as a release candidate on May 21, 2026, with final publication July 28, 2026) as the largest revision since launch. The headline change: MCP becomes stateless at the protocol layer, so it can run on ordinary HTTP infrastructure rather than requiring persistent connections. Alongside that, the spec adds:

  • Tasks — a formal extension (moved out of the core spec, where it shipped experimentally in November 2025) for long-running work, where a server can hand back a task handle and the client polls or cancels it
  • Authorization hardening — closer alignment with OAuth and OpenID Connect deployment patterns
  • A formal deprecation policy — so future versions won't force implementers to rewrite transport or lifecycle code from scratch (Model Context Protocol blog)

Separately, the project's Enterprise-Managed Authorization (EMA) extension was promoted to stable status in July 2026. It replaces the old model of repeated, per-server, per-user consent prompts with a centralized flow tied to an organization's identity provider — sign in once, and access to approved servers follows automatically. Anthropic has implemented it across Claude, Claude Code, and Cowork; VS Code added support; and server-side adopters listed at launch include Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase, with Slack in progress. Okta is the first identity provider supported, via its Cross App Access approach (InfoQ, "AI Model Context Protocol Adds Centralised Auth for Enterprise," July 2026).

This matters because, as one security commentator put it in coverage of the EMA launch, the old per-user OAuth model created a genuine operational mess — manual onboarding for every server, difficulty enforcing centralized policy, and a blurred line between personal and corporate accounts. EMA is explicitly a response to that pain, though as the same coverage notes, it governs connection-level access, not fine-grained per-action policy — organizations still need separate runtime controls for sensitive decisions (InfoQ).

6. MCP vs. A2A: two different problems, often confused

If MCP is the protocol getting the headlines for tool access, A2A (Agent2Agent), released by Google in April 2025 with over 50 launch partners including Salesforce, SAP, and Accenture, is the parallel effort for agent-to-agent coordination. The distinction that most technical writeups converge on:

  • MCP is vertical — it connects one AI agent down to tools, data, and APIs. Client-server, JSON-RPC over stdio/HTTP.
  • A2A is horizontal — it lets one AI agent delegate a task to a different, independently-built agent. Every A2A-compatible agent publishes a machine-readable "Agent Card" at a well-known URL describing what it can do, how to authenticate, and how to reach it (genta.dev comparison).

A2A was donated to the Linux Foundation in mid-2025 and, alongside MCP, now sits under the Agentic AI Foundation. By its one-year mark in April 2026, the Linux Foundation reported production A2A deployments (not just pilots) in supply chain, financial services, insurance, and IT operations, with integrations into Microsoft Azure AI Foundry, Copilot Studio, AWS Bedrock AgentCore, and Google Cloud (beam.ai).

Google's own positioning — echoed across most independent analyses — treats A2A as complementary rather than competing: MCP equips a single agent with capabilities, and A2A lets that already-equipped agent hand work off to other agents (beam.ai; Descope). In production multi-agent systems, it's common to see both running together: MCP for pulling in data and executing tools, A2A for orchestrating which agent does what.

It's worth noting the reaction to A2A's 2025 launch wasn't uniformly warm — some developers viewed it as a genuinely missing coordination layer, while others saw it as one more vendor-driven protocol landing before there was clear production demand for it (Rost Glukhov's analysis). A year on, the production-deployment numbers above suggest the skeptics were at least partly wrong about urgency, even if the "another acronym" critique still has some bite.

7. The security picture — this is the part to take seriously

MCP's design explicitly prioritized interoperability and simplicity over security hardening at launch, and the ecosystem has been catching up ever since. This is not a minor caveat — it's the subject of a formal U.S. National Security Agency advisory.

The NSA's May 2026 security guidance. The NSA's Cybersecurity Information report, "Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation," states plainly that MCP has become the de facto standard for AI-driven service communication and is now found in production deployments across business, finance, legal, and software development, naming products like AutoGen Studio, Harvey AI, Agentverse, and Copilot as real-world examples. The report says observed security issues need to be addressed through implementation rigor, secure coding practices, clearer protocol specifications, and better validation tooling (full PDF via media.defense.gov).

Tool poisoning is the headline risk. The most-cited MCP-specific attack is tool poisoning: hiding malicious instructions inside a tool's metadata or description — text the model reads when deciding which tool to call, but which the human user typically never sees. Microsoft's developer blog frames this as a form of indirect prompt injection: because the LLM treats tool descriptions as trusted context, an attacker who controls that metadata can manipulate the agent's behavior without ever touching the user-facing conversation (Microsoft for Developers).

What makes tool poisoning distinct from earlier prompt-injection research is persistence: a normal prompt injection needs the attacker to keep delivering malicious content through some new channel — a document, a web page, an email. A poisoned tool description ships once, inside a package or a remote server's config, and then fires on every single invocation, silently, for every user, until someone notices (ITECS).

Real disclosed vulnerabilities. A few concrete, citable incidents:

  • CVE-2025-49596 — a critical remote code execution vulnerability in Anthropic's own MCP Inspector tool, disclosed by Oligo Security (Oligo Security write-up).
  • The OX Security disclosure, May 2026 — a design-level issue in how official MCP SDKs handle the STDIO transport for local tool execution, which reporting describes as exposing roughly 200,000 vulnerable MCP instances across IDEs, internal tools, and cloud services before it was addressed. Coverage notes Anthropic confirmed the underlying behavior was intentional by original design, which is part of why the fix required rethinking rather than a quick patch (ITECS).

Academic threat modeling. A peer-reviewed analysis published in Information (MDPI) in May 2026 applied STRIDE and DREAD threat-modeling frameworks across six MCP components — host, client, LLM, server, external data stores, and authorization server — and concluded tool poisoning is the most prevalent and impactful client-side vulnerability, finding significant validation weaknesses across most of the seven major MCP clients tested (MDPI, Information, 2026). Separate arXiv research has proposed automated frameworks specifically for detecting "implicit" tool poisoning, and other groups have published systematic MCP security landscape surveys as early as 2025 (arXiv:2601.07395; background survey arXiv:2503.23278).

What security teams are being told to actually do. The consistent advice across the NSA report, Microsoft's guidance, and independent security writeups is defense-in-depth, not a single silver bullet: tool allowlisting, treating AI agents as privileged identities subject to the same least-privilege and monitoring standards as admin accounts, static validation of tool metadata before it ever reaches a model, runtime behavioral monitoring, and human-in-the-loop checkpoints for consequential actions (ITECS; NSA advisory). Standards bodies are moving, but slowly — NIST's AI Agent Standards Initiative launched in February 2026, with an interoperability profile not expected until Q4 2026.

8. Genuine gaps that remain unsolved

Even generally MCP-positive sources are candid about what the protocol still doesn't handle well as of mid-2026:

  • No standardized audit trail. Enterprise teams building production MCP deployments are largely inventing their own logging, tracing, and compliance layers from scratch (WorkOS).
  • Multi-tenancy isn't defined at the protocol level. SaaS vendors building MCP servers that serve many customers have to isolate tenant data and enforce tenant-specific policy themselves; MCP gives them no built-in model for this.
  • Registry trust and curation. With registries ranging from roughly 9,600 to well over 17,000 servers depending on which census you trust, and essentially no barrier to publishing a server, discovery and vetting remain immature. The project's own 2026 roadmap lists "MCP Server Cards" — a proposed .well-known metadata standard — as planned but not yet shipped (Model Context Protocol 2026 roadmap).
  • Fragmentation risk. Several enterprise analyses flag the risk that vendor-specific extensions to MCP could quietly undermine the interoperability that's the entire point of the protocol.

The project's own roadmap, published by lead maintainer David Soria Parra in March 2026, is refreshingly candid about this: it explicitly reorganizes priorities around Working Groups rather than release dates, names enterprise readiness (audit trails, SSO-integrated auth, gateway behavior, configuration portability) as a top priority with no dedicated Enterprise Working Group yet formed, and defers deeper security/authorization work and event-driven triggers to an "On the Horizon" section rather than claiming they're solved (Model Context Protocol blog, March 2026).

9. My take

MCP earned its current position the unglamorous way — not through a marketing push, but by solving a real, boring, expensive problem (the N×M integration tax) with a design simple enough that developers who were already hand-rolling similar patterns could adopt it without learning a new paradigm. That's a large part of why the download curve looks like it does.

But "de facto standard" and "secure by default" are not the same claim, and the gap between them is currently the most important thing happening in this space. Tool poisoning is not a theoretical concern — it's the subject of an NSA advisory, a peer-reviewed threat-modeling study, and at least two concretely disclosed vulnerabilities in 2025–2026. If you're building on MCP right now, the protocol's own maintainers, Microsoft, and the NSA are all converging on the same practical answer: treat every connected MCP server as something that needs the same scrutiny you'd give a new admin account, not a plug-and-play API call.

Sources

Note: adoption percentages vary meaningfully by source and some widely-repeated figures (e.g., specific "% of enterprises in production") are not independently verified against primary data — where that's the case, it's flagged above rather than stated as settled fact.