← Blog · September 3, 2026 · Mohamed Salama
What Is MCP? The Model Context Protocol, Explained
Listen

What Is MCP? The Model Context Protocol, Explained

Every AI assistant eventually hits the same wall: it knows a lot, but it can't touch anything. It can't read your ticket queue, query your database, or file the expense report. For the first two years of the chatbot era, the fix was a custom connector for every model-and-tool pair, and every team rebuilt the same glue. The Model Context Protocol (MCP) is the open standard that replaced that glue. This piece explains what it is, how it works, what changed in the latest specification, and where the hard problems still are.

The one-sentence version

MCP is a client-server protocol that lets an AI application discover and use external capabilities (tools, data, and prompt templates) through one common interface, so any compliant assistant can talk to any compliant service without a bespoke integration. Anthropic open-sourced it on November 25, 2024, framing the problem plainly: every new data source required its own implementation, which made connected systems hard to scale. The usual analogy is a USB-C port for AI. It is a fair one, as long as you remember that a port is only useful once enough devices adopt it.

How it works

Three roles carry the protocol.

  • The host is the AI application the person is using: a coding assistant, a chat product, an agent runtime. It runs the model and decides what the model may do.
  • The client lives inside the host and maintains the connection to one server. A host typically runs several clients at once.
  • The server is the thing being connected to: a wrapper around a database, a SaaS API, a file system, an internal service. It advertises what it offers and executes requests.

Servers expose three kinds of things. Tools are functions the model can call, each with a name, a natural-language description, and a JSON Schema for its inputs. Resources are read-only data the host can pull into context, such as a file or a record. Prompts are reusable templates a server can offer for common tasks. Since the June 2025 revision, servers can also ask the user for more information mid-task through elicitation, and tool results can carry structured JSON rather than only text.

Underneath, messages are JSON-RPC 2.0. Two transports are standard: stdio for a server running as a local process next to the host, and Streamable HTTP for a remote server behind a URL. That split matters in practice. Local servers are how a coding agent reaches your repository. Remote servers are how a product exposes itself to millions of assistants at once, and they are where authentication, scale, and abuse all become real.

How the spec has moved

MCP has shipped a dated revision roughly every four to eight months, and each one has been about making the protocol safe to run in production rather than adding novelty.

  • March 2025 introduced Streamable HTTP and an OAuth 2.1-based authorization framework, turning MCP from a local developer tool into something a remote service could host.
  • June 2025 classified MCP servers as OAuth resource servers, required resource indicators so tokens are bound to the server they were issued for, added elicitation and structured output, and published a dedicated security best practices page.
  • November 2025 added a Tasks primitive for long-running work, a formal extensions mechanism, and enterprise authorization options, including OAuth client credentials for machine-to-machine access and Client ID Metadata Documents in place of dynamic client registration.
  • July 2026 was the largest change since launch.

The 2026-07-28 specification makes the protocol core stateless. The initialize handshake and the session header are gone; each request carries its own protocol version, client identity, and capabilities, which means a server can sit behind an ordinary round-robin load balancer with no shared session store. Server-initiated requests that previously needed an open stream are replaced by Multi Round-Trip Requests: a server returns an "input required" result, the client gathers what is missing (a confirmation, a parameter) and retries. New HTTP headers name the method and tool being called so gateways and rate limiters can route on headers instead of parsing JSON. List results carry cache hints. Tasks moved out of the core into a formal extension alongside MCP Apps (server-rendered UI) and Enterprise Managed Authorization. Roots, sampling, and logging are deprecated with a twelve-month minimum offramp, as is the legacy HTTP+SSE transport. The direction is unambiguous: MCP is being reshaped to look like the rest of the web, so the rest of the web's infrastructure can run it.

Adoption: this one actually stuck

Standards proposals are cheap. What makes MCP different is that the companies that could have fought it adopted it instead. OpenAI shipped MCP support across its Agents SDK, Responses API, and ChatGPT in March 2025. Google followed in April 2025 across Gemini and Vertex AI. Microsoft built it into Copilot Studio, Visual Studio Code, and Windows 11. By Anthropic's own December 2025 count there were more than 10,000 active public servers and roughly 97 million monthly SDK downloads. By the July 2026 release the maintainers reported close to half a billion SDK downloads a month, with the TypeScript and Python SDKs each past one billion total. An official registry for discovering servers launched in preview in September 2025 and remains the reference directory, with support for private sub-registries that enterprises curate themselves.

Governance followed the adoption. On December 9, 2025, Anthropic donated MCP to the new Agentic AI Foundation, a directed fund under the Linux Foundation co-founded with Block and OpenAI and backed by Google, Microsoft, AWS, Cloudflare, and Bloomberg. MCP joined Block's goose agent and OpenAI's AGENTS.md as founding projects. Vendor-neutral stewardship is the boring milestone that tells you a protocol has stopped being one company's product. We wrote at the time that MCP was quietly becoming the default way apps talk to AI. Nine months on, the word "quietly" no longer applies.

The part that is not solved: security

Giving a language model the ability to act is exactly as dangerous as it sounds, and MCP concentrates that danger into a well-defined surface. That is good for defenders and good for attackers.

The central risk is that tool descriptions, resource contents, and tool results are all text the model reads. Anything the model reads can carry instructions. Tool poisoning hides directives in a tool's metadata; indirect prompt injection hides them in the data a tool returns. In May 2025, researchers showed that a malicious issue in a public GitHub repository could steer an agent using GitHub's MCP server into leaking private repository data. In January 2026, a published exploit chain against an official Git server combined three CVEs to reach remote code execution from a prompt alone. A large-scale analysis of the ecosystem found poisoned metadata in a meaningful fraction of public servers, and a 2026 scan of roughly 1,800 servers reported some security finding in two thirds of them. Most directories that list servers do little or no automated review before publishing.

None of this is unique to MCP. It is the standing problem of agentic AI, made visible. The protocol's own answers are the authorization hardening in every revision since June 2025, the shift to bound credentials and issuer validation in July 2026, and the human-confirmation loop that Multi Round-Trip Requests make cheap. The remaining answers belong to the people running servers: least-privilege scopes, allowlists rather than open discovery, pinning tool definitions so they cannot change silently, logging every call, and treating any content that flows through a tool as untrusted. The OWASP MCP Security Cheat Sheet is the best single checklist we know of.

What this means if you build products

Three practical conclusions.

First, exposing an MCP server is becoming a distribution channel. If assistants are where people increasingly start a task, a product that is reachable by those assistants gets used, and one that is not gets described from memory. This is the same logic that made an API and a mobile app table stakes in earlier eras. We hold this view strongly enough that FlowCP, our platform for conversational apps, treats MCP as the default way a product exposes what it already has.

Second, the protocol is now stable enough to build on. The July 2026 release came with a formal deprecation policy and four tier-one SDKs (TypeScript, Python, Go, and C#) updated on day one. The era of chasing breaking changes every quarter is ending.

Third, the design work has moved up a level. The protocol handles plumbing. What it cannot decide for you is which capabilities to expose, how narrowly to scope them, what needs a human confirmation, and how a user grants and revokes access. Those are product decisions, and they are the ones that determine whether an agent integration is trusted or switched off after the first incident.

MCP is not the whole story of how agents reach the world. A browser-native cousin, WebMCP, lets a web page itself register tools for an agent working alongside the user, and we cover it in a companion piece. For the broader landscape of agent protocols, including payments and agent-to-agent coordination, see our guide to the agentic economy. If you are working out what your own product should expose to agents, and how safely, tell us about it.

Sources