Model Context Protocol (MCP) explained: what it is and why it won

In DepthIshaan VardhanOct 4, 202612 min read

The Model Context Protocol (MCP) is an open standard that lets an AI app such as Claude, ChatGPT, Gemini, Copilot or Cursor plug into outside tools and data through one shared interface, so nobody has to build a custom integration for every pairing of model and service. Anthropic released it in November 2024. Within about a year OpenAI, Google, Microsoft, AWS and GitHub had all adopted it, and in December 2025 Anthropic handed it to a Linux Foundation fund, which is why most AI tools now support it.

Key takeaways

• MCP is a client-server protocol that runs on JSON-RPC 2.0. AI apps act as hosts, and they connect to MCP servers that expose tools, resources and prompts.
• It went from Anthropic’s launch on 25 November 2024 to adoption by OpenAI (March 2025), Google (April 2025), Microsoft, GitHub, AWS and Cloudflare.
• Since December 2025 MCP has been governed under the Agentic AI Foundation, a directed fund of the Linux Foundation. The current spec revision is dated 28 July 2026 and makes the protocol stateless.
• The main risks are prompt injection, tool poisoning and over-broad tokens.

What MCP is, in plain terms

The official docs compare MCP to a USB-C port for AI applications: one standard socket that lets any compliant app connect to any compliant data source or tool, according to the Model Context Protocol website. Instead of a custom connector for every chatbot-and-service pairing, a company builds one server and every MCP-capable assistant can use it.

Anthropic launched the protocol on 25 November 2024 with three pieces: the specification and SDKs, support for local MCP servers in the Claude Desktop apps, and an open-source repository of ready-made servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer, according to Anthropic. At launch it named Block and Apollo as early adopters, along with developer-tool makers Zed, Replit, Codeium and Sourcegraph.

How MCP works: hosts, clients and servers

MCP has three roles. The host is the AI application the user sees, such as a chat app or an IDE. Inside it, the host runs one client per connection, and each client talks to exactly one server. A server is a small program or web service that exposes a particular capability, such as your files, a CRM or a payments API, according to the MCP architecture spec.

The design is deliberate. Servers should be easy to build and combine, but no server can read the whole conversation or see into other servers: the host keeps the chat history and enforces security boundaries. Each side declares its features, and only mutually agreed capabilities are used.

All messages are JSON-RPC 2.0, a lightweight format for remote procedure calls, according to the specification.

The building blocks: tools, resources and prompts

Servers can offer three kinds of feature:

• Tools: functions the AI model can call, such as “create an issue” or “run this query”.
• Resources: context and data that the user or the model can read.
• Prompts: templated messages and workflows that users can start.

Clients can offer features to servers in return. The main one today is elicitation, which lets a server ask the user for more information partway through a task. Elicitation was added in the 2025-06-18 revision, according to the changelog. Two older client features, sampling (letting a server borrow the host’s model) and roots (telling a server which folders it may use), were deprecated in the 2026-07-28 revision along with logging. They keep working for at least 12 months, but new implementations should avoid them, according to the 2026-07-28 changelog.

Transports: local stdio and remote Streamable HTTP

With stdio, the client launches the server as a local subprocess and the two exchange messages over standard input and output, which suits tools that run on your own laptop. With Streamable HTTP, the server is an independent process that can serve many clients over HTTP POST and GET, optionally streaming responses with Server-Sent Events, according to the transport spec. The spec requires HTTP servers to validate the Origin header to block DNS-rebinding attacks, and it recommends that local servers bind only to localhost.

Streamable HTTP replaced the original HTTP+SSE transport in the 2025-03-26 revision, which also added an authorization framework based on OAuth 2.1 and annotations that mark whether a tool is read-only or destructive, according to the 2025-03-26 changelog.

How the spec has changed since 2024

MCP ships dated revisions rather than version numbers. The main milestones, drawn from the official changelogs:

Scroll the table sideways →

The 2026-07-28 revision is the biggest rewrite so far. Every request now carries its own protocol version and client capabilities, so servers no longer need to hold per-connection state. That makes MCP servers easier to run behind ordinary load balancers, according to the changelog. The release also formalised optional extensions, including Tasks, MCP Apps for interactive UI inside chats, and enterprise-managed authorization, according to the MCP blog. The 2025-11-25 entries come from the 2025-11-25 changelog.

Next on the roadmap, published on 22 August 2026, are HTTP-only transport (including for local servers) and stronger agent identity for enterprises, according to the MCP blog.

Why every AI tool supports MCP

Adoption came fast, and largely from Anthropic’s competitors:

• OpenAI added MCP support to its Agents SDK in March 2025 and said support for the ChatGPT desktop app and the Responses API would follow, according to TechCrunch. At DevDay in October 2025 it previewed an Apps SDK that shares context through MCP, according to InfoQ.
• Google: Google DeepMind CEO Demis Hassabis said in April 2025 that Gemini models and the Gemini SDK would support MCP, according to TechCrunch. In December 2025 Google Cloud launched fully managed remote MCP servers for Google Maps, BigQuery, Compute Engine and Kubernetes Engine, according to Google Cloud.
• Microsoft set out plans at Build in May 2025 for MCP support in Windows 11, including a registry of vetted servers and least-privilege controls, according to the Windows Experience Blog. MCP support in VS Code became generally available in version 1.102 on 14 July 2025, according to GitHub.
• Cloudflare launched tooling for hosting remote MCP servers with OAuth in March 2025, according to Cloudflare.
• AWS previewed a managed remote AWS MCP Server in November 2025. It can call more than 15,000 AWS APIs under IAM permissions, according to AWS.

The logic is network effects: every new assistant needed MCP to reach existing servers, and every SaaS company could reach all assistants with one server. By December 2025 there were more than 10,000 active public MCP servers and over 97 million monthly SDK downloads across Python and TypeScript, according to Anthropic. By July 2026 the Tier 1 SDKs were close to half a billion downloads a month, and the TypeScript and Python SDKs had each passed one billion total downloads, according to the MCP maintainers. These are the project’s own figures.

Who runs MCP now: the Agentic AI Foundation and the Registry

On 9 December 2025 Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, according to Anthropic. Anthropic, Block and OpenAI co-founded the AAIF, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. Block’s Goose agent and OpenAI’s AGENTS.md joined as the other founding projects. Anthropic said MCP’s existing governance model would stay in place. Neutral ownership makes MCP easier for enterprises and rivals to bet on.

Finding servers is the other half of the story. The official MCP Registry launched in preview on 8 September 2025 at registry.modelcontextprotocol.io as an open catalogue and API for public servers, according to the MCP blog. Companies can build public or private “sub-registries” on top of it, and the community can flag spam, impersonation or malicious servers for removal. At launch the maintainers warned that the preview came with no guarantee that data would be preserved.

Security risks: prompt injection, tool poisoning and token scope

The specification itself warns that tools amount to arbitrary code execution and that hosts must get user consent before calling any tool, according to the specification.

Tool poisoning and rug pulls

In April 2025, Invariant Labs showed that a malicious server can hide instructions in a tool’s description. The model reads them, but the user never sees them. In its demo against Cursor, a poisoned “add” tool tried to read the user’s SSH key and MCP config file, according to Invariant Labs. The researchers also described “rug pulls”, where a server changes its tool descriptions after the user has approved it, and “shadowing”, where one server’s description changes how the agent uses a trusted server. They recommend showing full tool descriptions, pinning server versions and isolating servers.

Prompt injection and the lethal trifecta

Developer Simon Willison describes a “lethal trifecta”: an agent that has access to private data, is exposed to untrusted content and can communicate externally can be tricked into leaking data. MCP makes that combination easy to assemble by accident when users mix servers from different sources, according to his analysis. Microsoft listed cross-prompt injection, credential leakage and tool poisoning among the threats its Windows design is meant to contain, according to Microsoft.

Tokens and authorization

For remote servers, authorization in MCP is optional but standardised. Over HTTP it follows OAuth 2.1 with PKCE, while local stdio servers are expected to read credentials from their environment instead. Clients must name the server a token is intended for, and servers must reject tokens issued for anyone else, according to the authorization spec. The security guidance bans “token passthrough”, where a server forwards a user’s token straight to a downstream API. It also advises starting with minimal scopes and asking for more only when a sensitive action actually requires it, because a stolen token with broad scopes can unlock everything, according to the security best practices.

How founders and teams can use or build MCP servers

A practical path for startups:

1. Use before you build. Connect your team’s assistant or IDE to official servers from the vendors you already use, such as GitHub, cloud providers and databases. In company-managed VS Code setups, an administrator has to enable the “MCP servers in Copilot” policy first, because it is off by default, according to GitHub.
2. Ship a server for your product. If customers ask how to use your product from ChatGPT or Claude, an MCP server is the answer. Official SDKs exist for TypeScript, Python, C#, Go, Rust and Ruby (Tier 1), Java (Tier 2), and Swift, PHP and Kotlin (Tier 3), according to the MCP website.
3. Go remote for non-developers. A hosted Streamable HTTP server with OAuth lets anyone sign in and connect, not just engineers running local stdio servers.
4. Design small tools with tight scopes. Expose narrow, well-named tools, mark destructive ones, request the fewest OAuth scopes you can, and never forward user tokens downstream.
5. List it. Publish to the official MCP Registry so clients and sub-registries can find your server.

Agent-building teams want engineers who know tool design, OAuth and prompt-injection defences. Browse current AI and ML jobs, or roles at Anthropic and OpenAI, two of the companies behind the AAIF.

Bottom line

MCP won because it solved a boring, expensive integration problem and Anthropic gave it away early. For founders, an MCP server is becoming as standard as a public API. Security is the open question: the protocol sets consent and OAuth rules, but it cannot stop a model obeying a poisoned instruction. That falls to the teams building hosts and servers. Follow the latest AI infrastructure stories on our news page.

FAQ

Who created MCP and who owns it now?

Anthropic created it and open-sourced it in November 2024. In December 2025 it donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation.

Does ChatGPT support MCP?

Yes. OpenAI added MCP to its Agents SDK in March 2025, and the MCP website now lists ChatGPT among the clients that support it.

What is the difference between an MCP server and an API?

An API is product-specific. An MCP server exposes capabilities as standard tools, resources and prompts that any MCP client can use without custom code.

Is MCP safe to use?

It can be, with care. Install servers only from sources you trust, review tool permissions, avoid giving one agent private data, untrusted input and outbound access all at once, and use OAuth with narrow scopes.

What is the latest MCP spec version?

As of October 2026, the latest revision is 2026-07-28. It made the protocol stateless and deprecated the roots, sampling and logging features.

Sources

1. Anthropic, “Introducing the Model Context Protocol“, 2024-11-25
2. Model Context Protocol, “What is the Model Context Protocol (MCP)?“, 2026-10-04 (accessed)
3. Model Context Protocol, “Specification (revision 2026-07-28)“, 2026-07-28
4. Model Context Protocol, “Architecture (revision 2025-06-18)“, 2025-06-18
5. Model Context Protocol, “Transports (revision 2025-06-18)“, 2025-06-18
6. Model Context Protocol, “Key changes, revision 2025-03-26“, 2025-03-26
7. Model Context Protocol, “Key changes, revision 2025-06-18“, 2025-06-18
8. Model Context Protocol, “Key changes, revision 2025-11-25“, 2025-11-25
9. Model Context Protocol, “Key changes, revision 2026-07-28“, 2026-07-28
10. MCP Blog, “The 2026-07-28 Specification“, 2026-07-28
11. MCP Blog, “The New MCP Roadmap“, 2026-08-22
12. TechCrunch, “OpenAI adopts rival Anthropic's standard for connecting AI models to data“, 2025-03-26
13. InfoQ, “OpenAI DevDay 2025 announcements“, 2025-10-10
14. TechCrunch, “Google to embrace Anthropic's standard for connecting AI models to data“, 2025-04-09
15. Google Cloud, “Announcing official MCP support for Google services“, 2025-12-11
16. Microsoft Windows Experience Blog, “Securing the Model Context Protocol: building a safer agentic future on Windows“, 2025-05-19
17. GitHub Changelog, “Model Context Protocol (MCP) support in VS Code is generally available“, 2025-07-14
18. Cloudflare, “Build and deploy Remote Model Context Protocol (MCP) servers to Cloudflare“, 2025-03-25
19. AWS, “AWS announces a preview of the AWS MCP Server“, 2025-11-30
20. Anthropic, “Donating the Model Context Protocol and establishing the Agentic AI Foundation“, 2025-12-09
21. MCP Blog, “Introducing the MCP Registry“, 2025-09-08
22. Invariant Labs, “MCP Security Notification: Tool Poisoning Attacks“, 2025-04-01
23. Simon Willison, “The lethal trifecta for AI agents“, 2025-06-16
24. Model Context Protocol, “Authorization (revision 2025-11-25)“, 2025-11-25
25. Model Context Protocol, “Security Best Practices (revision 2025-11-25)“, 2025-11-25
26. Model Context Protocol, “SDKs“, 2026-10-04 (accessed)

Featured image: MCP's own docs compare the protocol to a USB-C port: one standard connector for many devices. · Photo: Fructibus / Wikimedia Commons, CC0 1.0

Related stories

In DepthBest Education Marketing Agency in India: Our #1 Pick and 6 SpecialistsIshaan VardhanOct 12, 202611 min read

In DepthWhat are AI agents? A 2026 guide for founders and teamsIshaan VardhanOct 11, 202611 min read

In DepthBest free AI tools in 2026: 14 free tiers that are worth usingIshaan VardhanOct 11, 202612 min read