Model Context Protocol (MCP)

From PRIMO.ai
Jump to navigation Jump to search

YouTube ... Quora ...Google search ...Google News ...Bing News

The Model Context Protocol (MCP) is an open standard for connecting AI applications with external information and tools. Anthropic introduced it in November 2024 to address the difficulty of building separate integrations for every combination of model, application, and external service, a problem it described as N times M. A common protocol allows compatible applications, such as Claude, ChatGPT, Gemini, Cursor, or Visual Studio Code, to discover and use capabilities exposed by participating systems: tools the model can call, resources it can read, and prompt templates a user can invoke. Instead of every AI vendor writing a custom connector for every database, SaaS product, and internal system, a service publishes one MCP server and every compatible client can use it, which is why the project's documentation at modelcontextprotocol.io compares MCP to a USB-C port for AI applications.

The first specification, released as open source on November 25, 2024, came with Python and TypeScript software development kits and a set of reference servers. Its creators, Anthropic engineers David Soria Parra and Justin Spahr-Summers, borrowed the message-flow ideas of the Language Server Protocol, which lets code editors support any programming language through one interface, and built MCP on JSON-RPC 2.0 messages. OpenAI adopted the protocol in March 2025, Google committed Gemini to it in April 2025, and Microsoft made it a first-class standard at its Build conference in May 2025. On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation (AAIF), a new directed fund of the Linux Foundation co-founded by Anthropic, Block, and OpenAI, so that no single company controls its future.

By late 2026, MCP had become the default way to plug tools into agents. The official MCP Registry, still in preview, listed more than 47,000 active servers in October 2026, the Tier 1 SDKs were being downloaded close to half a billion times a month, and Claude's connector directory alone offered nearly 1,000 integrations. The protocol has also kept changing: MCP Apps, launched in January 2026 as the first official extension, lets servers return interactive user interfaces, and the July 28, 2026 revision made the protocol stateless, deprecated several little-used features, and hardened authorization.

That success has made MCP one of the main attack surfaces of agentic AI. Because servers are often arbitrary programs and tool descriptions flow straight into a model's context, MCP has inherited the problems of software supply chains and prompt injection at once, and the National Vulnerability Database listed 382 CVE records mentioning MCP by October 2026, 324 of them published that year. The protocol defines how capabilities are described and called, while the host application, its users, and its administrators remain responsible for deciding which servers to trust and which actions to allow.


MCP is the common plug between AI models and the rest of software: it lets any agent use any tool through one interface, which is exactly why it has become both the backbone of agentic AI and one of its largest attack surfaces.


Mechanisms

MCP uses a client-server architecture and JSON-RPC 2.0 messaging. An MCP host manages the AI application, such as Claude Desktop, ChatGPT, an IDE, or a custom agent, along with one or more clients, each connected to a single server, while MCP servers expose tools, resources, and other supported capabilities. Implementations may use local communication, with the server running as a process on the user's machine over standard input and output (stdio), or supported remote transports, chiefly Streamable HTTP, which replaced the original HTTP with Server-Sent Events transport in March 2025.

The architecture supports several distinct concepts, each with a different party in control. Tools allow an AI system to request operations, resources expose information for use within an application, and prompts provide reusable interaction templates, so in practice the model chooses tools, the application chooses resources, and the user chooses prompts. The protocol defines how these capabilities are described and accessed, but the application remains responsible for deciding whether and when to permit particular operations. In more detail, the core server primitives are:

  • Tools: functions the model can decide to call, such as searching a database, creating a ticket, or sending a message, each described by a name, a natural-language description, a JSON Schema for its inputs, and, since June 2025, an optional schema for structured output
  • Resources: data the application can read and pass to the model, such as files, database records, or documents, identified by URIs
  • Prompts: reusable templates that users invoke explicitly, often as slash commands, to start a particular workflow

A typical exchange is simple. The client asks the server for its list of tools, the host passes those names and descriptions to the large language model along with the user's request, and when the model decides a tool is needed, the host has the client call it and feeds the result back into the conversation. Clients have historically offered capabilities in the other direction as well: sampling let a server ask the client's model for a completion, roots told a server which folders it could work in, and elicitation let a server ask the user for more information mid-task.

Remote servers are protected with OAuth. The March 2025 revision introduced an OAuth 2.1-based authorization framework, the June 2025 revision classified MCP servers as OAuth resource servers that require resource indicators, and the November 2025 revision added OpenID Connect discovery and Client ID Metadata Documents as the recommended way for clients to register. The July 2026 revision went further, requiring clients to validate the authorization server's issuer to prevent mix-up attacks, binding client credentials to their issuer, and deprecating Dynamic Client Registration, while the Enterprise-Managed Authorization extension, stable since June 2026, gives employees one sign-in for every MCP server an administrator approves.

The 2026-07-28 specification, which its maintainers called the largest revision since launch, changed MCP's core from a stateful, bidirectional protocol into a stateless request and response protocol. It removed the initialize handshake and the Mcp-Session-Id header, so every request now carries its protocol version, client identity, and capabilities, and any server instance behind an ordinary load balancer can answer it. Server-initiated requests were replaced by Multi Round-Trip Requests, in which a server that needs user input or other information returns an input-required result and the client retries with the answers, and Streamable HTTP requests must now name the method and tool in Mcp-Method and Mcp-Name headers so gateways and firewalls can route and meter traffic without parsing message bodies. List results can now be cached, and applications that need state between calls are told to have a tool issue an explicit handle that the model passes back.

The same revision formalized an extensions framework so that new capabilities can evolve outside the core. Official extensions include MCP Apps, which lets a tool point to a ui:// resource containing an HTML interface that the host renders in a sandboxed frame, Tasks, which handles long-running asynchronous operations, and Enterprise-Managed Authorization. Roots, sampling, and logging were deprecated, with a formal policy guaranteeing at least twelve months of support before any deprecated feature is removed.

The Physics

MCP makes connecting tools easy, but it cannot make those tools trustworthy, cheap to describe, or safe to run. Its practical limits come from how language models use context and from the fact that every connection extends what an agent can do. The main constraints are:

  • Context is finite: Every connected server's tool names, descriptions, and schemas take up room in the model's context window, so agents with many servers spend tokens before doing any work and can pick the wrong tool, a concern summed up by a 2026 AI Engineer Europe talk titled "MCP = Mega Context Problem." The 2026 revision's deterministic, cacheable list results help prompt caching, and Anthropic's Agent Skills standard lets agents load task instructions only when needed.
  • Descriptions are instructions: Tool descriptions and tool outputs enter the model's context as text the model tends to trust, so a malicious or compromised server can hide instructions in them, the technique researchers call tool poisoning.
  • Local servers are code execution: A stdio server is an executable the host launches with the user's privileges, so installing one, or opening a repository whose configuration names one in an IDE that auto-launches servers, can amount to running untrusted code. OX Security reported in April 2026 that the official SDKs execute stdio commands without sanitization, exposing an estimated 200,000 or more instances.
  • Permissions compound: An agent connected to several servers can combine their powers, reading private data with one tool and sending it out with another, so the safety of a session depends on its riskiest combination of servers.
  • Supply chain: Public registries and package managers make servers easy to find and easy to fake, and attackers have published backdoored and cloned servers, such as the postmark-mcp npm package in September 2025 and a trojanized copy of an Oura MCP project in February 2026.
  • Version churn: Five dated revisions in under two years, including a 2026 change that is not fully backward compatible, mean that clients, servers, and SDKs must be upgraded together or bridged with compatibility layers.

These limits explain the defensive patterns that have grown up around MCP. Organizations increasingly route traffic through MCP gateways, allow only approved servers, prefer remote servers with OAuth over local executables, scan tool descriptions and outputs, and keep a human approval step in front of destructive or outbound actions. None of these safeguards is part of the protocol itself, which is why security and platform vendors have treated MCP governance as an urgent priority.

Why This Matters

MCP's significance lies less in any single feature than in where it sits, between the models that reason and the systems where work actually happens. Few technical standards have spread across competing AI vendors so quickly. Its importance shows up in several ways:

  • A shared standard among rivals: Anthropic, OpenAI, Google, Microsoft, and Amazon compete fiercely on models, yet all ship MCP support, and neutral governance under the Linux Foundation lowers the risk that a team's integrations get stranded if it switches models.
  • From chat to action: MCP turned assistants into agents that work inside business systems. Salesforce reported 4.5 million MCP calls through its Headless 360 platform by late May 2026, and Android's AppFunctions, in beta since October 28, 2026, lets apps share capabilities with agents through MCP.
  • Apps inside assistants: MCP Apps, built jointly by Anthropic, OpenAI, and the creators of MCP-UI, gives software makers one way to ship interactive interfaces that run inside Claude, ChatGPT, VS Code, Goose, and other hosts.
  • Context as infrastructure: Rather than pasting documents into prompts, MCP lets models fetch fresh context on demand from live systems, complementing retrieval-augmented generation and frameworks such as LangChain and LlamaIndex.
  • A new security frontier: MCP's rise created a new class of vulnerabilities, from tool poisoning to agent hijacking through injected data, which the OWASP MCP Top 10 now catalogs, making MCP a central topic for cybersecurity and AI governance teams.

MCP is often compared with other protocols in the agent stack. Google's Agent2Agent (A2A) protocol, now also hosted by the AAIF, connects agents to other agents, while MCP connects agents to tools and data, and OpenAPI describes conventional APIs that MCP servers frequently wrap. For how MCP fits Anthropic's own products, see the Model Context Protocol section of the Claude page.

Building Blocks

Component What It Does Notes
Hosts and clients The AI application the user works in, which creates one client per connected server. Examples include Claude, ChatGPT, Gemini CLI, Cursor, VS Code, Copilot Studio, and goose.
Servers Programs or remote services that expose tools, resources, and prompts. Local servers run over stdio; remote servers use Streamable HTTP.
Tools Model-invoked functions with a name, description, JSON Schema inputs, and optional structured output. Tool annotations, added in 2025, hint at behavior such as read-only or destructive actions.
Resources Application-selected data identified by URIs, such as files, records, or documents. List results are cacheable under the 2026-07-28 revision.
Prompts User-invoked templates for common workflows, often exposed as slash commands. Return messages that the host inserts into the conversation.
Transports stdio for local processes and Streamable HTTP for remote servers. HTTP with Server-Sent Events is deprecated with a one-year offramp; Streamable HTTP requests carry Mcp-Method and Mcp-Name headers.
Authorization OAuth 2.1 resource-server model with issuer validation and Client ID Metadata Documents. Dynamic Client Registration is deprecated but still works for backward compatibility.
Multi Round-Trip Requests Lets a server ask for user input or other information mid-request by returning an input-required result that the client answers on retry. Replaces server-initiated elicitation, sampling, and roots requests.
server/discover Optional call that returns a server's capabilities up front. Replaces the retired initialize handshake.
MCP Apps extension Tools point to ui:// resources whose HTML interfaces render in sandboxed frames inside the host. First official extension, January 26, 2026; supported by Claude, ChatGPT, VS Code, Goose, Cursor, and others.
Tasks extension Long-running, asynchronous operations that clients poll or subscribe to. Moved from the experimental core into an official extension in 2026.
Enterprise-Managed Authorization One sign-in for every MCP server an administrator approves. Stable since June 18, 2026, with Okta as the first supported identity provider.
MCP Registry Official public catalog of servers with metadata and an API for discovery. Still in preview; more than 47,000 active servers in October 2026.
SDKs Official libraries for building clients and servers. Tier 1 SDKs are TypeScript, Python, Go, and C#; Rust supports the 2026 revision in beta, and SDKs also exist for Java, PHP, and Ruby.
Deprecated features Sampling, roots, logging, HTTP with Server-Sent Events, and Dynamic Client Registration. Supported for at least twelve months under the deprecation policy.

Specification Versions

MCP is versioned by date, and clients and servers work against the version they share. Five revisions have been published since launch, each adding or tightening capabilities. The table below summarizes them.

Version Status Headline Changes
2024-11-05 Final JSON-RPC 2.0 client-server architecture; tools, resources, and prompts; stdio and HTTP with Server-Sent Events transports
2025-03-26 Final OAuth 2.1 authorization framework; Streamable HTTP with session IDs; tool annotations, audio content, argument completions, and JSON-RPC batching
2025-06-18 Final Structured tool output, elicitation, and resource links; servers classified as OAuth resource servers with resource indicators; batching removed; security best practices page
2025-11-25 Final OpenID Connect discovery; incremental scope consent; icons; URL-mode elicitation; tool calling in sampling; Client ID Metadata Documents; experimental tasks; JSON Schema 2020-12 as default
2026-07-28 Current Stateless core without sessions or handshake; server/discover; Multi Round-Trip Requests; header-based routing; cacheable lists; authorization hardening; formal extensions framework; roots, sampling, and logging deprecated

Ecosystem and Governance

MCP expanded rapidly beyond Anthropic during 2025 and 2026, with adoption by AI application developers, tool vendors, and agent frameworks. In December 2025, Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block, and OpenAI with backing from Google, Microsoft, Amazon Web Services, Cloudflare, and Bloomberg. This provided a governance structure intended to support development as an industry standard rather than a specification controlled solely by one company. Day-to-day technical direction stayed with the protocol's maintainers, led by David Soria Parra and Den Delimarsky, and changes continue to move through numbered Specification Enhancement Proposals.

The foundation has grown quickly. It launched with 49 member organizations and had 286 by October 2026, its portfolio expanded from MCP, Block's goose, and OpenAI's AGENTS.md to six projects including Google's Agent2Agent protocol, agentgateway, and Agent Router, and it named Mazin Gilbert as its inaugural executive director. Its first MCP Dev Summit North America, held in New York City in April 2026, drew about 1,200 attendees across more than 95 sessions.

The standard's growing adoption is significant because models and applications increasingly rely on external tools. Shared interfaces can reduce integration costs and make it easier to move compatible capabilities between applications. However, interoperability remains limited by differences in authentication, supported features, authorization policies, and implementation quality.

MCP is especially relevant to LangChain, LlamaIndex, Agent Development Framework Comparison, and AI Tools & Infrastructure Navigator. The design also connects with Data Interoperability, databases, APIs, and AI Marketplace & Toolkit/Model Interoperability. It should be understood as an integration protocol, not an AI model or a complete agent architecture.

Security

Security has dogged MCP since its first year. In April 2025, Invariant Labs demonstrated tool poisoning, in which hidden instructions in a tool's description entered the agent's context as trusted content, including a proof of concept that used a poisoned calculator tool to exfiltrate a developer's SSH private key from Cursor. In May 2025, researchers showed that the official GitHub MCP server could be hijacked by instructions planted in the data it returned, proving that the poison need not be in the tool description at all. In September 2025, the postmark-mcp npm package became the first malicious MCP server found in the wild.

Vulnerabilities multiplied as adoption grew. Critical flaws were found in core tooling, including remote code execution in the official MCP Inspector (CVE-2025-49596) and in the widely used mcp-remote proxy (CVE-2025-6514, rated 9.6), and in 2026 researchers disclosed an exploit chain in Anthropic's own Git MCP server, a missing-authentication flaw rated 9.1 in Microsoft's Azure DevOps MCP server, and Amazon Q flaws that loaded a repository's MCP configuration without consent. OX Security's April 2026 disclosure that the official SDKs pass stdio commands to the operating system without sanitization led to more than ten downstream CVEs, including one in the Windsurf editor. By October 21, 2026, the National Vulnerability Database held 382 CVE records mentioning MCP, 79 of them rated critical.

Defenses have matured alongside the threats. The specification added a security best practices page in 2025 and hardened authorization in each revision, OWASP published an MCP Top 10 that lists tool poisoning among its core risks, and vendors now sell gateways and scanners that inspect tool descriptions and responses, pin server versions, and log every call. Even so, the 2026 revision did nothing to stop tool poisoning, supply-chain attacks, or unapproved shadow servers, which remain the responsibility of whoever deploys MCP. More broadly, MCP doesn't automatically guarantee secure access, reliable results, or correct tool selection. Authentication, least-privilege permissions, input validation, and monitoring remain essential.

Getting Started

There are two ways to start with MCP: connecting existing servers to an AI application you already use, or building a server that exposes your own data and tools. The steps below cover both, following the official documentation and security guidance. Start small, with read-only tools, before connecting anything that can change or send data.

  1. Pick a client: Use an MCP-capable host such as Claude, ChatGPT, Gemini CLI, Cursor, VS Code with GitHub Copilot, or goose, and check which transports and features it supports.
  2. Find a trustworthy server: Prefer official servers published by the service itself, look them up in the official MCP Registry or a vendor's connector directory, and check the publisher, source code, and requested permissions before installing.
  3. Connect a remote server: Add the server's URL in the client's connector or MCP settings and complete the OAuth sign-in, granting only the scopes the task needs.
  4. Or run a local server: Add the command that launches it to the client's MCP configuration file. Remember that it runs with your own privileges, so treat it like any other software you install.
  5. Review the tools: Look at the list of tools the server exposes, disable ones you do not need, and keep approval prompts on for anything that writes, deletes, or sends data.
  6. Build your own server: Use an official SDK, with TypeScript, Python, Go, and C# in Tier 1, or a framework such as FastMCP, define a few tools with clear names, descriptions, and input schemas, and return structured, concise results.
  7. Target the current spec: Build against the 2026-07-28 revision, avoid deprecated features such as sampling and roots, and keep any state in explicit handles that tools return instead of relying on sessions.
  8. Test with an inspector: Exercise every tool with the MCP Inspector or a similar tool before connecting a model, and keep the inspector itself updated, since an early version had a critical vulnerability.
  9. Secure a remote deployment: Implement OAuth as a resource server, validate tokens and issuers, apply least-privilege scopes, rate-limit using the Mcp-Method and Mcp-Name headers, and log every call.
  10. Publish if appropriate: List a public server in the MCP Registry with accurate metadata, and add an MCP Apps interface if users would benefit from interactive views rather than text.
  11. Govern at scale: Organizations can route agent traffic through an MCP gateway, maintain an allow list of approved servers, and use Enterprise-Managed Authorization so employees sign in once through the company's identity provider.

A few habits prevent most problems. Never connect more servers than a task needs, since every extra server adds context cost and attack surface. Treat tool descriptions and tool outputs from third parties as untrusted input, and keep a human in the loop for any action that moves money, deletes data, or sends information outside the organization.

Examples

MCP's uses range from coding assistants to consumer apps. The first example below walks through the basic pattern in general terms, while the others come from vendor announcements, documentation, and press coverage rather than invented scenarios. The sample requests at the end illustrate how a user might put connected servers to work.

Example: Connecting Claude to Business Data

Consider a user who wants Claude to analyze customer information stored in a business database. Without a standardized integration, a developer may need to build application-specific code to authenticate, query the database, and translate results into a model-readable form. An MCP server can expose approved queries and resources through a defined interface.

Claude can then discover available capabilities and request information needed for an authorized task. The hosting application controls permissions, while the server performs the relevant database operations. Similar patterns can support project management tools, file systems, development environments, and business applications.

Software Development

Coding was MCP's first stronghold. Integrated development environments, coding platforms such as Replit, and code intelligence tools such as Sourcegraph use MCP to give assistants live project context, and GitHub's official MCP server, which entered public preview in April 2025, had become one of the most starred MCP repositories by late 2026. Agentic coding tools such as Claude Code, Codex, Cursor, and Google Antigravity connect to issue trackers, databases, browsers, and cloud consoles through MCP servers, and Microsoft's Playwright MCP server lets agents drive a web browser to test what they build.

Business Data and Enterprise Systems

Enterprises use MCP to give agents governed access to their systems of record. Salesforce routes customer and agent interactions through MCP in its Headless 360 platform, Google offers more than 50 managed MCP servers for Google Cloud services, and low-code platforms such as AppSheet and Appsmith expose their apps to agents through MCP servers. A December 2025 survey of 300 companies by Stacklok, a vendor of MCP software, found 41% running MCP in production, with software companies most often connecting it to version control, documentation, issue tracking, and cloud platforms.

Assistants and Consumer Apps

MCP also reaches consumers through assistant connectors. Claude's directory offered 995 connectors by October 2026, OpenAI's Apps SDK for ChatGPT is built on MCP, and Google's Gemini Spark agent lets users add any service with an MCP server URL as a custom app. In late October 2026 alone, Suno released a beta MCP tool for making songs inside ChatGPT, Claude, and Gemini, and companies such as Quantum Metric and ClicData launched MCP servers for their analytics and customer experience data.

Interactive Apps in Chat

MCP Apps turned connectors into interactive software. When it launched on January 26, 2026, ten partners including Figma, Canva, Slack, and Asana shipped interfaces that render inside Claude, and ChatGPT, VS Code, and Goose added support within days. A tool can now return a chart, form, map, or dashboard as a sandboxed HTML view instead of a block of text, and the user can act on it without leaving the conversation.

Agents Building Software Through MCP

Some platforms now expose their builders, not just their data, through MCP. Appsmith's MCP Server, in beta since September 2026, lets agents in Claude Code or Cursor build and edit internal tools under a user's own permissions, with destructive steps requiring confirmation, and Google's AppSheet MCP Server preview lets agents read records, update them, and trigger automations within an app's guardrails. These designs show how MCP can let agents act inside governed platforms rather than writing raw code or database queries.

Sample Requests

The table below shows illustrative requests that depend on connected MCP servers, with the kind of server each uses and where a careful user should expect to approve. The exact wording matters less than naming the data, the action, and any limits. Approval points reflect common client behavior and security guidance rather than requirements of the protocol itself.

Request Servers Used Where You Approve
"Summarize the open issues labeled bug in our repository and draft a fix for the oldest one." GitHub server Before opening a pull request
"Find last quarter's top ten customers by revenue in the warehouse and chart the results." Database or analytics server, with an MCP Apps chart Usually none for read-only queries
"Check my calendar and my team's for a free hour next week and send the invite." Calendar and email servers Before sending the invite
"Open the staging site, walk through checkout, and tell me what breaks." Playwright browser server Before entering any real payment details
"Create a ticket for each failing test in today's CI run." CI and issue-tracker servers Before creating the tickets
"Turn this design brief into a draft layout." Figma or Canva MCP app Before publishing or sharing

Known Limitations

  • Security is left to implementers: The protocol does not prevent tool poisoning, prompt injection through tool outputs, malicious servers, or unapproved shadow servers.
  • Context overhead: Large numbers of tools consume context and degrade tool selection, which pushes builders toward fewer, better-described tools.
  • Breaking changes: The 2026-07-28 revision is not fully backward compatible, so older clients may need a compatibility layer to talk to new servers, and applications that relied on sessions face the largest migration.
  • Deprecated features: Sampling, roots, and logging are deprecated, and servers that need mid-request input must now use Multi Round-Trip Requests that clients must support.
  • Uneven client support: Hosts differ in which transports, authorization flows, extensions, and approval prompts they support, and regular ChatGPT conversations, for example, accept only OAuth or unauthenticated connectors, which rules out servers that require header-based keys.
  • Registry still in preview: The official MCP Registry has no general availability date, and a listing in any registry does not mean a server has been vetted.
  • Local server risk: stdio servers run as ordinary programs with the user's privileges, and some IDEs have auto-launched servers named in a repository's configuration.
  • Vulnerability volume: Hundreds of CVEs have been filed against MCP servers, clients, and SDKs, so operators must patch continuously.

History

Recent Developments

  • November 25, 2024: Anthropic introduced and open-sourced MCP with Python and TypeScript SDKs and reference servers.
  • March 2025: Microsoft added MCP support to Copilot Studio, OpenAI adopted MCP on March 26 starting with its Agents SDK, and the 2025-03-26 revision added OAuth 2.1 authorization and the Streamable HTTP transport.
  • April 2025: Google committed Gemini to MCP on April 9, GitHub's MCP server entered public preview, and Invariant Labs disclosed tool poisoning attacks.
  • May 2025: Claude added remote MCP servers on May 1, Microsoft made MCP a first-class standard at Build on May 19 and joined the steering committee with GitHub, and OpenAI added remote MCP servers to its Responses API on May 21.
  • June 2025: The 2025-06-18 revision added structured tool output and elicitation and classified servers as OAuth resource servers, and Google launched Gemini CLI with MCP support.
  • July 2025: MCP support became generally available in VS Code 1.102, and the critical mcp-remote vulnerability CVE-2025-6514 was published.
  • September 2025: The official MCP Registry launched in preview on September 8, OpenAI brought MCP support to ChatGPT's developer mode, and the postmark-mcp backdoor became the first malicious MCP server found in the wild.
  • October 6, 2025: OpenAI introduced its MCP-based Apps SDK for ChatGPT, citing more than 800 million users.
  • November 25, 2025: The one-year anniversary revision added OpenID Connect discovery, icons, Client ID Metadata Documents, and experimental tasks.
  • December 2025: Anthropic donated MCP to the new Agentic AI Foundation on December 9, alongside Block's goose and OpenAI's AGENTS.md, Google announced managed remote MCP servers for Google Cloud the next day, and Anthropic later published Agent Skills as a companion open standard.
  • January 26, 2026: MCP Apps shipped as the first official MCP extension, with support in Claude, VS Code, and Goose and ChatGPT following within days.
  • April 2026: The AAIF held its inaugural MCP Dev Summit North America in New York City on April 2 and 3 with about 1,200 attendees, OX Security disclosed the stdio command-execution flaw in the official SDKs, and Google reported more than 50 managed MCP servers at Cloud Next '26.
  • May 21, 2026: The maintainers published the release candidate for the 2026-07-28 specification.
  • June 18, 2026: Enterprise-Managed Authorization became stable, with Okta as the first supported identity provider.
  • July 28, 2026: The stateless 2026-07-28 specification became current, with all four Tier 1 SDKs supporting it the same day.
  • August 22, 2026: The maintainers published a new roadmap focused on agentic messaging, HTTP-native transports, agent identity and enterprise security, improved primitives, and SDK developer experience.
  • October 2026: The official registry passed 47,000 active servers, the AAIF reached 286 members, and Android's AppFunctions beta began letting apps share capabilities with agents through MCP on October 28.

Further Resources

Additional Viewing

Load video
YouTube

Building Agents with Model Context Protocol - Full Workshop with Mahesh Murag of Anthropic is a workshop of about an hour and 45 minutes recorded at the AI Engineer Summit, in which Murag of Anthropic's Applied AI team explains MCP's building blocks and demonstrates building agents with it. It is the best long-form introduction to the architecture and primitives in The Mechanism.

Load video
YouTube

MCP201: The Protocol in Depth is a keynote by MCP co-creator David Soria Parra at the first MCP Dev Summit in San Francisco on May 23, 2025. It walks through the prompts, resources, and tools primitives and the design choices behind them.

Load video
YouTube

The Future of MCP is a keynote by David Soria Parra of Anthropic laying out what he believes will be true for agents in 2026 and how MCP fits into that future. It provides background for the stateless 2026-07-28 revision and the roadmap described in Recent Developments.

Load video
YouTube

MCP Apps: Primitives, Discovery, and the Future of Software is a 2026 AI Engineer World's Fair talk by Pietro Zullo, co-founder of Manufact, on how MCP Apps work, how they are distributed and discovered, and why he believes they will shape how software is used. It complements the MCP Apps discussion in The Mechanism and Examples.

Load video
YouTube

The Lethal Trifecta: Prompt Injection & MCP Tool Poisoning explains why injection attacks keep succeeding against agents, tracing incidents from Invariant Labs' tool poisoning research to the mcp-remote vulnerability CVE-2025-6514. It is a useful companion to the Security section.

References

Retrieved from "https://primo.ai/w/index.php?title=Model_Context_Protocol_(MCP)&oldid=52084"