# Model Context Protocol (MCP) explained: what it is and why it won - Link: https://100xfounder.com/model-context-protocol-mcp-explained/ - Published: 2026-10-04T14:32:47+05:30 - Author: Ishaan Vardhan [In Depth](https://100xfounder.com/category/in-depth/)Ishaan VardhanOct 4, 202612 min read The Model Context Protocol (MCP) is an open standard that lets an AI app such as Claude, ChatGPT, Gemini, Copilot or Cursor plug into outside tools and data through one shared interface, so nobody has to build a custom integration for every pairing of model and service. Anthropic released it in November 2024. Within about a year OpenAI, Google, Microsoft, AWS and GitHub had all adopted it, and in December 2025 Anthropic handed it to a Linux Foundation fund, which is why most AI tools now support it. ## Key takeaways * MCP is a client-server protocol that runs on JSON-RPC 2.0. AI apps act as hosts, and they connect to MCP servers that expose tools, resources and prompts. * It went from Anthropic’s launch on 25 November 2024 to adoption by OpenAI (March 2025), Google (April 2025), Microsoft, GitHub, AWS and Cloudflare. * Since December 2025 MCP has been governed under the Agentic AI Foundation, a directed fund of the Linux Foundation. The current spec revision is dated 28 July 2026 and makes the protocol stateless. * The main risks are prompt injection, tool poisoning and over-broad tokens. ## What MCP is, in plain terms The official docs compare MCP to a USB-C port for AI applications: one standard socket that lets any compliant app connect to any compliant data source or tool, [according to the Model Context Protocol website](https://modelcontextprotocol.io/docs/getting-started/intro). Instead of a custom connector for every chatbot-and-service pairing, a company builds one server and every MCP-capable assistant can use it. Anthropic launched the protocol on 25 November 2024 with three pieces: the specification and SDKs, support for local MCP servers in the Claude Desktop apps, and an open- source repository of ready-made servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer, [according to Anthropic](https://www.anthropic.com/news/model-context-protocol). At launch it named Block and Apollo as early adopters, along with developer-tool makers Zed, Replit, Codeium and Sourcegraph. ## How MCP works: hosts, clients and servers MCP has three roles. The **host** is the AI application the user sees, such as a chat app or an IDE. Inside it, the host runs one **client** per connection, and each client talks to exactly one **server**. A server is a small program or web service that exposes a particular capability, such as your files, a CRM or a payments API, [according to the MCP architecture spec](https://modelcontextprotocol.io/specification/2025-06-18/architecture). The design is deliberate. Servers should be easy to build and combine, but no server can read the whole conversation or see into other servers: the host keeps the chat history and enforces security boundaries. Each side declares its features, and only mutually agreed capabilities are used. All messages are JSON-RPC 2.0, a lightweight format for remote procedure calls, [according to the specification](https://modelcontextprotocol.io/specification/latest). ### The building blocks: tools, resources and prompts Servers can offer three kinds of feature: * **Tools:** functions the AI model can call, such as “create an issue” or “run this query”. * **Resources:** context and data that the user or the model can read. * **Prompts:** templated messages and workflows that users can start. Clients can offer features to servers in return. The main one today is **elicitation**, which lets a server ask the user for more information partway through a task. Elicitation was added in the 2025-06-18 revision, [according to the changelog](https://modelcontextprotocol.io/specification/2025-06-18/changelog). Two older client features, **sampling** (letting a server borrow the host’s model) and **roots** (telling a server which folders it may use), were deprecated in the 2026-07-28 revision along with logging. They keep working for at least 12 months, but new implementations should avoid them, [according to the 2026-07-28 changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog). ![Dense bundle of blue, grey, green, red and yellow Ethernet cables plugged into a network switch](https://100xfounder.com/wp-content/uploads/2026/10/dense-bundle- of-blue-grey-green-red-and-yellow-ethernet-cables-plugged.jpg) Each MCP client holds a dedicated one-to-one connection to a single server. · [Photo: Open Grid Scheduler / Grid Engine / Openverse (Flickr), CC0 1.0](https://www.flickr.com/photos/29155878@N03/16480450157) ### Transports: local stdio and remote Streamable HTTP With **stdio**, the client launches the server as a local subprocess and the two exchange messages over standard input and output, which suits tools that run on your own laptop. With **Streamable HTTP**, the server is an independent process that can serve many clients over HTTP POST and GET, optionally streaming responses with Server-Sent Events, [according to the transport spec](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports). The spec requires HTTP servers to validate the Origin header to block DNS-rebinding attacks, and it recommends that local servers bind only to localhost. Streamable HTTP replaced the original HTTP+SSE transport in the 2025-03-26 revision, which also added an authorization framework based on OAuth 2.1 and annotations that mark whether a tool is read-only or destructive, [according to the 2025-03-26 changelog](https://modelcontextprotocol.io/specification/2025-03-26/changelog). ## How the spec has changed since 2024 MCP ships dated revisions rather than version numbers. The main milestones, drawn from the official changelogs: | Revision | Headline changes | | 2024-11-05 | First public version, launched alongside Anthropic’s announcement | | 2025-03-26 | OAuth 2.1 authorization, Streamable HTTP, tool annotations | | 2025-06-18 | Elicitation, structured tool output, stricter OAuth token rules | | 2025-11-25 | Experimental tasks, simpler client registration, formal governance | | 2026-07-28 | Stateless protocol without sessions; tasks become an extension; roots, sampling and logging deprecated | The 2026-07-28 revision is the biggest rewrite so far. Every request now carries its own protocol version and client capabilities, so servers no longer need to hold per-connection state. That makes MCP servers easier to run behind ordinary load balancers, [according to the changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog). The release also formalised optional extensions, including Tasks, MCP Apps for interactive UI inside chats, and enterprise-managed authorization, [according to the MCP blog](https://blog.modelcontextprotocol.io/posts/2026-07-28/). The 2025-11-25 entries come from [the 2025-11-25 changelog](https://modelcontextprotocol.io/specification/2025-11-25/changelog). Next on the roadmap, published on 22 August 2026, are HTTP-only transport (including for local servers) and stronger agent identity for enterprises, [according to the MCP blog](https://blog.modelcontextprotocol.io/posts/mcp-roadmap/). ## Why every AI tool supports MCP Adoption came fast, and largely from Anthropic’s competitors: * **OpenAI** added MCP support to its Agents SDK in March 2025 and said support for the ChatGPT desktop app and the Responses API would follow, [according to TechCrunch](https://techcrunch.com/2025/03/26/openai-adopts-rival-anthropics-standard-for-connecting-ai-models-to-data/). At DevDay in October 2025 it previewed an Apps SDK that shares context through MCP, [according to InfoQ](https://www.infoq.com/news/2025/10/openai-dev-day). * **Google:** Google DeepMind CEO Demis Hassabis said in April 2025 that Gemini models and the Gemini SDK would support MCP, [according to TechCrunch](https://techcrunch.com/2025/04/09/google-says-itll-embrace-anthropics-standard-for-connecting-ai-models-to-data/). In December 2025 Google Cloud launched fully managed remote MCP servers for Google Maps, BigQuery, Compute Engine and Kubernetes Engine, [according to Google Cloud](https://cloud.google.com/blog/products/ai-machine-learning/announcing-official-mcp-support-for-google-services). * **Microsoft** set out plans at Build in May 2025 for MCP support in Windows 11, including a registry of vetted servers and least-privilege controls, [according to the Windows Experience Blog](https://blogs.windows.com/windowsexperience/2025/05/19/securing-the-model-context-protocol-building-a-safer-agentic-future-on-windows/). MCP support in VS Code became generally available in version 1.102 on 14 July 2025, [according to GitHub](https://github.blog/changelog/2025-07-14-model-context-protocol-mcp-support-in-vs-code-is-generally-available/). * **Cloudflare** launched tooling for hosting remote MCP servers with OAuth in March 2025, [according to Cloudflare](https://blog.cloudflare.com/remote-model-context-protocol-servers-mcp/). * **AWS** previewed a managed remote AWS MCP Server in November 2025. It can call more than 15,000 AWS APIs under IAM permissions, [according to AWS](https://aws.amazon.com/about-aws/whats-new/2025/11/aws-mcp-server). The logic is network effects: every new assistant needed MCP to reach existing servers, and every SaaS company could reach all assistants with one server. By December 2025 there were more than 10,000 active public MCP servers and over 97 million monthly SDK downloads across Python and TypeScript, [according to Anthropic](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation). By July 2026 the Tier 1 SDKs were close to half a billion downloads a month, and the TypeScript and Python SDKs had each passed one billion total downloads, [according to the MCP maintainers](https://blog.modelcontextprotocol.io/posts/2026-07-28/). These are the project’s own figures. ![Rows of telecom and server equipment racks in a brightly lit data centre](https:// 100xfounder.com/wp-content/uploads/2026/10/rows-of-telecom-and-server-equipment- racks-in-a-brightly-lit-data-cent.jpg) Cloud providers including AWS and Google Cloud now run managed remote MCP servers.· [Photo: Robert Scoble / Openverse (Flickr), CC BY 2.0](https://www.flickr.com/photos/35034363287@N01/2340202215) ## Who runs MCP now: the Agentic AI Foundation and the Registry On 9 December 2025 Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, [according to Anthropic](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation). Anthropic, Block and OpenAI co-founded the AAIF, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. Block’s Goose agent and OpenAI’s AGENTS.md joined as the other founding projects. Anthropic said MCP’s existing governance model would stay in place. Neutral ownership makes MCP easier for enterprises and rivals to bet on. Finding servers is the other half of the story. The official MCP Registry launched in preview on 8 September 2025 at registry.modelcontextprotocol.io as an open catalogue and API for public servers, [according to the MCP blog](https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/). Companies can build public or private “sub-registries” on top of it, and the community can flag spam, impersonation or malicious servers for removal. At launch the maintainers warned that the preview came with no guarantee that data would be preserved. ## Security risks: prompt injection, tool poisoning and token scope The specification itself warns that tools amount to arbitrary code execution and that hosts must get user consent before calling any tool, [according to the specification](https://modelcontextprotocol.io/specification/latest). ### Tool poisoning and rug pulls In April 2025, Invariant Labs showed that a malicious server can hide instructions in a tool’s description. The model reads them, but the user never sees them. In its demo against Cursor, a poisoned “add” tool tried to read the user’s SSH key and MCP config file, [according to Invariant Labs](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks). The researchers also described “rug pulls”, where a server changes its tool descriptions after the user has approved it, and “shadowing”, where one server’s description changes how the agent uses a trusted server. They recommend showing full tool descriptions, pinning server versions and isolating servers. ### Prompt injection and the lethal trifecta Developer Simon Willison describes a “lethal trifecta”: an agent that has access to private data, is exposed to untrusted content and can communicate externally can be tricked into leaking data. MCP makes that combination easy to assemble by accident when users mix servers from different sources, [according to his analysis](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/). Microsoft listed cross-prompt injection, credential leakage and tool poisoning among the threats its Windows design is meant to contain, [according to Microsoft](https://blogs.windows.com/windowsexperience/2025/05/19/securing-the-model-context-protocol-building-a-safer-agentic-future-on-windows/). ### Tokens and authorization For remote servers, authorization in MCP is optional but standardised. Over HTTP it follows OAuth 2.1 with PKCE, while local stdio servers are expected to read credentials from their environment instead. Clients must name the server a token is intended for, and servers must reject tokens issued for anyone else, [according to the authorization spec](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization). The security guidance bans “token passthrough”, where a server forwards a user’s token straight to a downstream API. It also advises starting with minimal scopes and asking for more only when a sensitive action actually requires it, because a stolen token with broad scopes can unlock everything, [according to the security best practices](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices). ![Glowing padlock icon over lines of program code on a blue circuit-style background]( https://100xfounder.com/wp-content/uploads/2026/10/glowing-padlock-icon-over-lines- of-program-code-on-a-blue-circuit-styl-1024x682.jpg) Tool poisoning and prompt injection are the main security risks when connecting agents to MCP servers. · [Photo: Yuri Samoilov / Wikimedia Commons, CC BY 3.0](https://commons.wikimedia.org/wiki/File:System_Lock_(66747475).jpeg) ## How founders and teams can use or build MCP servers A practical path for startups: 1. **Use before you build.** Connect your team’s assistant or IDE to official servers from the vendors you already use, such as GitHub, cloud providers and databases. In company-managed VS Code setups, an administrator has to enable the “MCP servers in Copilot” policy first, because it is off by default, [according to GitHub](https://github.blog/changelog/2025-07-14-model-context-protocol-mcp-support-in-vs-code-is-generally-available/). 2. **Ship a server for your product.** If customers ask how to use your product from ChatGPT or Claude, an MCP server is the answer. Official SDKs exist for TypeScript, Python, C#, Go, Rust and Ruby (Tier 1), Java (Tier 2), and Swift, PHP and Kotlin( Tier 3), [according to the MCP website](https://modelcontextprotocol.io/docs/sdk). 3. **Go remote for non-developers.** A hosted Streamable HTTP server with OAuth lets anyone sign in and connect, not just engineers running local stdio servers. 4. **Design small tools with tight scopes.** Expose narrow, well-named tools, mark destructive ones, request the fewest OAuth scopes you can, and never forward user tokens downstream. 5. **List it.** Publish to the official MCP Registry so clients and sub-registries can find your server. Agent-building teams want engineers who know tool design, OAuth and prompt-injection defences. Browse current [AI and ML jobs](https://100xfounder.com/jobs/ai-ml-jobs/), or roles at [Anthropic](https://100xfounder.com/jobs/company/anthropic/) and [OpenAI](https://100xfounder.com/jobs/company/openai/), two of the companies behind the AAIF. ![Person typing on a laptop showing a code editor and a terminal window](https:// 100xfounder.com/wp-content/uploads/2026/10/person-typing-on-a-laptop-showing-a-code- editor-and-a-terminal-window.jpg) Official SDKs in languages from TypeScript and Python to Go and Rust make building an MCP server a small project. · [Photo: gdsteam / Openverse (Flickr), CC BY 2.0](https://www.flickr.com/photos/93332172@N03/47994682357) ## Bottom line MCP won because it solved a boring, expensive integration problem and Anthropic gave it away early. For founders, an MCP server is becoming as standard as a public API. Security is the open question: the protocol sets consent and OAuth rules, but it cannot stop a model obeying a poisoned instruction. That falls to the teams building hosts and servers. Follow the latest AI infrastructure stories on our [news page](https://100xfounder.com/news/). ## FAQ ### Who created MCP and who owns it now? Anthropic created it and open-sourced it in November 2024. In December 2025 it donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation. ### Does ChatGPT support MCP? Yes. OpenAI added MCP to its Agents SDK in March 2025, and the MCP website now lists ChatGPT among the clients that support it. ### What is the difference between an MCP server and an API? An API is product-specific. An MCP server exposes capabilities as standard tools, resources and prompts that any MCP client can use without custom code. ### Is MCP safe to use? It can be, with care. Install servers only from sources you trust, review tool permissions, avoid giving one agent private data, untrusted input and outbound access all at once, and use OAuth with narrow scopes. ### What is the latest MCP spec version? As of October 2026, the latest revision is 2026-07-28. It made the protocol stateless and deprecated the roots, sampling and logging features. ## Sources 1. Anthropic, “[Introducing the Model Context Protocol](https://www.anthropic.com/news/model-context-protocol)“, 2024-11-25 2. Model Context Protocol, “[What is the Model Context Protocol (MCP)?](https://modelcontextprotocol.io/docs/getting-started/intro)“, 2026-10-04 (accessed) 3. Model Context Protocol, “[Specification (revision 2026-07-28)](https://modelcontextprotocol.io/specification/latest)“, 2026-07-28 4. Model Context Protocol, “[Architecture (revision 2025-06-18)](https://modelcontextprotocol.io/specification/2025-06-18/architecture)“, 2025-06-18 5. Model Context Protocol, “[Transports (revision 2025-06-18)](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports)“, 2025-06-18 6. Model Context Protocol, “[Key changes, revision 2025-03-26](https://modelcontextprotocol.io/specification/2025-03-26/changelog)“, 2025-03-26 7. Model Context Protocol, “[Key changes, revision 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/changelog)“, 2025-06-18 8. Model Context Protocol, “[Key changes, revision 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/changelog)“, 2025-11-25 9. Model Context Protocol, “[Key changes, revision 2026-07-28](https://modelcontextprotocol.io/specification/2026-07-28/changelog)“, 2026-07-28 10. MCP Blog, “[The 2026-07-28 Specification](https://blog.modelcontextprotocol.io/posts/2026-07-28/)“, 2026-07-28 11. MCP Blog, “[The New MCP Roadmap](https://blog.modelcontextprotocol.io/posts/mcp-roadmap/)“, 2026-08-22 12. TechCrunch, “[OpenAI adopts rival Anthropic's standard for connecting AI models to data](https://techcrunch.com/2025/03/26/openai-adopts-rival-anthropics-standard-for-connecting-ai-models-to-data/)“, 2025-03-26 13. InfoQ, “[OpenAI DevDay 2025 announcements](https://www.infoq.com/news/2025/10/openai-dev-day)“, 2025-10-10 14. TechCrunch, “[Google to embrace Anthropic's standard for connecting AI models to data](https://techcrunch.com/2025/04/09/google-says-itll-embrace-anthropics-standard-for-connecting-ai-models-to-data/)“, 2025-04-09 15. Google Cloud, “[Announcing official MCP support for Google services](https://cloud.google.com/blog/products/ai-machine-learning/announcing-official-mcp-support-for-google-services)“, 2025-12-11 16. Microsoft Windows Experience Blog, “[Securing the Model Context Protocol: building a safer agentic future on Windows](https://blogs.windows.com/windowsexperience/2025/05/19/securing-the-model-context-protocol-building-a-safer-agentic-future-on-windows/)“, 2025-05-19 17. GitHub Changelog, “[Model Context Protocol (MCP) support in VS Code is generally available](https://github.blog/changelog/2025-07-14-model-context-protocol-mcp-support-in-vs-code-is-generally-available/)“, 2025-07-14 18. Cloudflare, “[Build and deploy Remote Model Context Protocol (MCP) servers to Cloudflare](https://blog.cloudflare.com/remote-model-context-protocol-servers-mcp/)“, 2025-03-25 19. AWS, “[AWS announces a preview of the AWS MCP Server](https://aws.amazon.com/about-aws/whats-new/2025/11/aws-mcp-server)“, 2025-11-30 20. Anthropic, “[Donating the Model Context Protocol and establishing the Agentic AI Foundation](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation)“, 2025-12-09 21. MCP Blog, “[Introducing the MCP Registry](https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/)“, 2025-09-08 22. Invariant Labs, “[MCP Security Notification: Tool Poisoning Attacks](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks)“, 2025-04-01 23. Simon Willison, “[The lethal trifecta for AI agents](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/)“, 2025-06-16 24. Model Context Protocol, “[Authorization (revision 2025-11-25)](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization)“, 2025-11-25 25. Model Context Protocol, “[Security Best Practices (revision 2025-11-25)](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices)“, 2025-11-25 26. Model Context Protocol, “[SDKs](https://modelcontextprotocol.io/docs/sdk)“, 2026- 10-04 (accessed) Featured image: MCP's own docs compare the protocol to a USB-C port: one standard connector for many devices. · [Photo: Fructibus / Wikimedia Commons, CC0 1.0](https://commons.wikimedia.org/wiki/File:USB-C_cable_2017_A.jpg) ## Related stories [In DepthBest Education Marketing Agency in India: Our #1 Pick and 6 SpecialistsIshaan VardhanOct 12, 202611 min read](https://100xfounder.com/best-education-marketing-agency-india/) [⌊Close-up of colourful lines of code in a text editor on a laptop screen⌉⌊Close-up of colourful lines of code in a text editor on a laptop screen⌉In DepthWhat are AI agents? A 2026 guide for founders and teamsIshaan VardhanOct 11, 202611 min read](https://100xfounder.com/what-are-ai-agents-guide/) [⌊A smartphone showing the ChatGPT app resting in front of an open laptop⌉⌊A smartphone showing the ChatGPT app resting in front of an open laptop⌉In DepthBest free AI tools in 2026: 14 free tiers that are worth usingIshaan VardhanOct 11, 202612 min read](https://100xfounder.com/best-free-ai-tools/) ## Sources 1. [Anthropic](https://www.anthropic.com/news/model-context-protocol) 25 Nov 2024MCP launch, components (spec, SDKs, Claude Desktop local servers, server repo), pre- built servers and early adopters 2. [Model Context Protocol](https://modelcontextprotocol.io/docs/getting-started/intro) 4 Oct 2026USB-C analogy, example uses, client support (Claude, ChatGPT, VS Code, Cursor); page accessed 4 Oct 2026 3. [Model Context Protocol](https://modelcontextprotocol.io/specification/latest) 28 Jul 2026JSON-RPC 2.0, hosts/clients/servers, tools/resources/prompts, elicitation, extensions, LSP inspiration, security principles 4. [Model Context Protocol](https://modelcontextprotocol.io/specification/2025-06-18/architecture) 18 Jun 2025Host/client/server roles, 1:1 client-server, isolation design principles, capability negotiation 5. [Model Context Protocol](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports) 18 Jun 2025stdio and Streamable HTTP, Origin validation, bind to localhost 6. [Model Context Protocol](https://modelcontextprotocol.io/specification/2025-03-26/changelog) 26 Mar 2025OAuth 2.1 authorization framework, Streamable HTTP replacing HTTP+SSE, tool annotations 7. [Model Context Protocol](https://modelcontextprotocol.io/specification/2025-06-18/changelog) 18 Jun 2025Elicitation, structured tool output, servers as OAuth resource servers, RFC 8707 resource indicators 8. [Model Context Protocol](https://modelcontextprotocol.io/specification/2025-11-25/changelog) 25 Nov 2025Experimental tasks, Client ID Metadata Documents, incremental scope consent, formal governance 9. [Model Context Protocol](https://modelcontextprotocol.io/specification/2026-07-28/changelog) 28 Jul 2026Stateless protocol, no sessions, MRTR, tasks as extension, Roots/Sampling/ Logging deprecated, 12-month deprecation window 10. [MCP Blog](https://blog.modelcontextprotocol.io/posts/2026-07-28/) 28 Jul 2026Tier 1 SDKs near half a billion monthly downloads; TypeScript and Python SDKs past 1 billion total downloads; extensions incl. MCP Apps 11. [MCP Blog](https://blog.modelcontextprotocol.io/posts/mcp-roadmap/) 22 Aug 2026Five roadmap priorities incl. HTTP transport unification and agent identity 12. [TechCrunch](https://techcrunch.com/2025/03/26/openai-adopts-rival-anthropics-standard-for-connecting-ai-models-to-data/) 26 Mar 2025OpenAI Agents SDK MCP support; ChatGPT desktop and Responses API planned 13. [InfoQ](https://www.infoq.com/news/2025/10/openai-dev-day) 10 Oct 2025Apps SDK sharing context via MCP; AgentKit Connector Registry 14. [TechCrunch](https://techcrunch.com/2025/04/09/google-says-itll-embrace-anthropics-standard-for-connecting-ai-models-to-data/) 9 Apr 2025Hassabis: Gemini models and SDK to support MCP 15. [Google Cloud](https://cloud.google.com/blog/products/ai-machine-learning/announcing-official-mcp-support-for-google-services) 11 Dec 2025Managed remote MCP servers for Maps, BigQuery, GCE, GKE; Model Armor 16. [Microsoft Windows Experience Blog](https://blogs.windows.com/windowsexperience/2025/05/19/securing-the-model-context-protocol-building-a-safer-agentic-future-on-windows/) 19 May 2025Windows MCP plans, threat list, registry and least-privilege controls 17. [GitHub Changelog](https://github.blog/changelog/2025-07-14-model-context-protocol-mcp-support-in-vs-code-is-generally-available/) 14 Jul 2025MCP GA in VS Code 1.102; admin policy off by default 18. [Cloudflare](https://blog.cloudflare.com/remote-model-context-protocol-servers-mcp/) 25 Mar 2025Remote vs local servers; OAuth provider library, McpAgent, mcp-remote 19. [AWS](https://aws.amazon.com/about-aws/whats-new/2025/11/aws-mcp-server) 30 Nov 2025Managed remote MCP server; 15,000+ AWS APIs; IAM and CloudTrail 20. [Anthropic](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation) 9 Dec 2025Donation to AAIF under Linux Foundation; co-founders and supporters; 10,000+ public servers; 97M+ monthly SDK downloads 21. [MCP Blog](https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/) 8 Sep 2025Registry preview, open source, sub-registries, moderation, no durability guarantees 22. [Invariant Labs](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) 1 Apr 2025Tool poisoning, rug pulls, shadowing; Cursor demo; mitigations 23. [Simon Willison](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/) 16 Jun 2025Private data + untrusted content + external communication; MCP mixing risk 24. [Model Context Protocol](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization) 25 Nov 2025Authorization optional; HTTP transports; OAuth 2.1; PKCE; RFC 8707 audience binding; stdio uses environment credentials 25. [Model Context Protocol](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices) 25 Nov 2025Token passthrough forbidden, confused deputy, local server consent, scope minimization 26. [Model Context Protocol](https://modelcontextprotocol.io/docs/sdk) 4 Oct 2026Official SDK languages and tiers; page accessed 4 Oct 2026