Model Context Protocol
The Model Context Protocol (MCP) is an open protocol that standardizes how AI applications connect to external tools, data sources, and services.
Released in November 2024, MCP uses a client-server architecture with JSON-RPC 2.0 messaging to establish stateful sessions between AI applications and context providers. The protocol was inspired by the Language Server Protocol (LSP), which standardized how development tools interact with programming languages.
MCP addresses the combinatorial complexity of integrating multiple LLMs with multiple tools, known as the "M×N problem," by providing a unified protocol that both LLM vendors and tool builders can follow. Rather than requiring custom adapter code for each integration, MCP converts the M×N problem into a more manageable M+N problem, where a single implementation on each side enables universal interoperability. The protocol focuses solely on context exchange and does not dictate how AI applications use LLMs or manage the provided context.
The protocol ecosystem includes the MCP specification, official SDKs for TypeScript, Python, Java, Kotlin, C#, Swift, Rust, and Dart, development tools such as the MCP Inspector, and reference server implementations. By March 2025, over one thousand community-built MCP servers and thousands of MCP-integrated applications had been deployed. [[OpenAI]] adopted MCP in March 2025, with CEO Sam Altman stating that "People love MCP, and we're excited to add support for it in our products." [[Google|Google DeepMind]] announced support for the standard in April 2025. At Google I/O in May 2026, the company announced that Gemini Spark, its flagship 24/7 personal AI agent, connects to third-party tools through MCP, and launched Antigravity 2.0 with first-party Google Workspace MCP servers for Gmail, Drive, Calendar, Chat, and People API — leading industry observers to declare the protocol debate effectively settled for the agent era. By December 2025, the ecosystem had grown to over 10,000 active public MCP servers and 97 million monthly SDK downloads, with the protocol accumulating over 37,000 GitHub stars in under eight months. By April 2026, monthly SDK downloads had reached 110 million — a milestone that took React three years to achieve. A Nerq census in Q1 2026 indexed 17,468 MCP servers, with remote server deployments growing 400% since May 2025 and 59% of servers using Streamable HTTP transport. By May 2026, over 13,000 MCP servers were registered on npm and GitHub alone, with 400% year-over-year growth in new server registrations. Enterprise production adoption reached 41% among surveyed organizations according to Stacklok's "State of MCP in Software 2026" report, and CrashBytes predicted at least 40% of Fortune 500 companies would have MCP in production by September 2026. TanStack released @tanstack/ai-mcp in June 2026, a host-side MCP client library that transforms any MCP server into typed tool arrays for use with any AI provider adapter, with edge-deployable Streamable HTTP as its primary transport. The mcp-hub CLI tool launched in June 2026 to address the server discovery gap, providing npm-based search and installation.
On December 9, 2025, Anthropic transferred stewardship of the protocol to the Agentic AI Foundation (AAIF) under the Linux Foundation, with founding members including Amazon, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI. The AAIF grew to 190 organizations through two expansion waves in 2026, becoming the fastest-growing foundation in Linux Foundation history — surpassing the CNCF's growth rate by reaching 170+ members in roughly three months compared to the CNCF's 13 months. CData joined the AAIF as a Silver member in July 2026, contributing its MCP-native data connectivity experience to the foundation's working groups covering Identity and Trust, Observability and Traceability, Security and Privacy, and Workflows and Process Integration. COOCON, a South Korean business data platform, joined the AAIF in June 2026 and in July 2026 launched 30 financial MCP products on its COOCON.NET platform — covering identity verification, real estate and vehicle information, and business verification — usable in Claude Desktop, Cursor, and VS Code, with plans to expand to over 100 products by year-end. Gold members added during the first half of 2026 included JPMorgan Chase, American Express, Red Hat, Stripe, F5, GoDaddy, and TRON alongside research institutions, government agencies, and South Korean and European AI engineering firms. The first half of 2026 saw MCP transition from a promising experiment to infrastructure through a series of milestones: MCP Apps shipped in January as the protocol's first official extension, co-developed by Anthropic and OpenAI with same-day support across Claude, ChatGPT, Goose, and VS Code; more than 30 MCP-related CVEs were filed in January and February, establishing tool poisoning as a mainstream security concern; the 2026 roadmap was published in March with enterprise readiness as its top priority; and the largest specification revision since launch locked as the 2026-07-28 release candidate in May, introducing a stateless protocol core with _meta-based client information, server/discover RPC, and a formal deprecation policy. In July 2026, the MCP team promoted the Enterprise-Managed Authorization (EMA) extension to stable, providing centralized identity-provider-based authorization for organizations. Agentgateway joined the AAIF as its fourth hosted project in June 2026, with contributors including AWS, Microsoft, Cisco, Adobe, and Apple. The first MCP Dev Summit was held in New York City in April 2026 with approximately 1,200 attendees. Uber presented its production deployment of 1,500+ internal agents running 60,000+ executions per week, with 90% of its engineering organization using AI weekly. AWS reported tens of thousands of builders using MCP as the most popular way to connect agents to internal systems. Two subsequent MCP Dev Summit India events in Bangalore and Mumbai (June 2026) drew approximately 170 registered organizations and strong developer attendance respectively, where the dominant conversation had shifted from building MCP servers to governing them at scale — enterprises managing 20+ servers and 50+ developers reported no central audit trail, credential sprawl, and critical governance gaps. Two flagship conferences — AGNTCon + MCPCon Europe in Amsterdam (September 17–18) and AGNTCon + MCPCon North America in San Jose, California (October 22–23) — anchor the 2026 calendar, alongside regional MCP Dev Summits in Seoul, Shanghai, Tokyo, Toronto, and Nairobi. Microsoft released a free nine-module "MCP for Beginners" open-source curriculum in early 2026 covering .NET, Java, TypeScript, JavaScript, Rust, and Python, signaling the protocol's transition from early adoption to mainstream developer education.
By early 2026, MCP entered a phase of broader scrutiny alongside its rapid growth. A benchmark found that when connecting to multiple servers, up to 72% of an agent's context window could be consumed by tool schema definitions alone. Mitigations emerged at the client layer — Claude Code implemented progressive tool discovery achieving approximately 85% token reductions, and Cloudflare introduced Code Mode, which collapsed all tool definitions into two search-and-execute tools for a 94% reduction in token overhead. The gateway pattern emerged as the dominant architectural approach for enterprise deployments, with organizations converging on a centralized gateway paired with a registry as the control plane for all agent interactions. By mid-2026, the MCP gateway market had grown to include at least 10 platforms — spanning open-source options such as Obot (MIT-licensed, self-hosted), Bifrost (Apache 2.0, reporting 11 microseconds overhead at 5,000 requests per second), and Lasso Security (security-focused), alongside commercial platforms including Amazon Bedrock AgentCore, Kong AI Gateway, IBM ContextForge, MintMCP (SOC 2, HIPAA-ready), and TrueFoundry. Citrix announced NetScaler MCP Gateway on July 9, 2026 — the first major commercial MCP gateway from a traditional infrastructure vendor, providing centralized authentication, session persistence, and tool-based rate limiting for MCP traffic. Virtual MCP Servers, tool aliasing, and semantic tool search emerged as key patterns for managing multi-server deployments at scale. A new primitive called Skills — domain knowledge bundled with MCP tools into shareable recipes — began to emerge as the next layer above the protocol for codifying workflows. Security researchers identified widespread vulnerabilities across the ecosystem: a systematic study of 67,057 MCP servers across six public registries found 833 servers with exploitable vulnerabilities, and an OWASP MCP Top 10 framework formalized ten critical risk categories. Independent surveys converged on 38-41% of MCP servers having no authentication whatsoever, with only 8.5% using OAuth. In April 2026, OX Security disclosed a systemic design flaw in the STDIO transport mechanism embedded in all official MCP SDKs, estimating 200,000 vulnerable server instances across 150 million package downloads. The Cloud Security Alliance published a formal research note in May 2026 documenting seven confirmed high- or critical-severity CVEs, the postmark-mcp supply chain attack, and the broader attack taxonomy including tool poisoning, rug pull attacks, and cross-server tool shadowing. Academic research published in July 2026 demonstrated that Unicode TAG block characters (U+E0000 to U+E007F) can conceal payloads in MCP tool descriptions, invisible to human reviewers during approval but surviving byte-for-byte into the model's tokenizer, with all eight tested techniques delivering attacker-controlled payloads into the model's context. In July 2026, Microsoft Incident Research identified tool description poisoning as a new class of attack where the natural-language metadata that tells an agent what a tool does can be manipulated to hijack agent behavior and exfiltrate data through approved tool calls without triggering security controls. The Cloud Security Alliance published a formal research note on July 11, 2026, detailing tool description poisoning as a systemic attack vector, with Microsoft's security team independently documenting the same pattern. Researchers demonstrated ShareLock, a multi-tool threshold poisoning technique that splits malicious instructions across benign-looking tool descriptions to evade detection while sustaining over 90% attack success, and Agentjacking via MCP and Sentry, achieving 85% success rate tricking coding agents through fake diagnostic events. In June 2026, an IETF Internet-Draft formally analyzed recurring MCP vulnerability classes and introduced Protocol Pivoting as a cross-protocol lateral-movement pattern. Academic research produced the first formal security analysis of MCP (arXiv:2601.17549), identifying three architectural vulnerabilities and demonstrating that the proposed MCPSec extension reduced successful attacks from 52.8% to 12.4%. The nginx-ui vulnerability (CVE-2026-33032, CVSS 9.8) became the most high-profile MCP-specific CVE, actively exploited in the wild within weeks of disclosure. [[concepts/security|The security page]] catalogs six documented real-world security incidents spanning 2025 to 2026, demonstrating that traditional security monitoring was not designed to detect MCP attack patterns. Academic research further demonstrated that LLMs cannot reliably self-enforce tool access control via prompts, with role escalation attacks achieving up to 96% unauthorized invocation, while a proxy-enforced attribute-based access control layer achieved 0% by filtering tools at discovery time. Enterprise security platforms emerged to provide content firewalls, immutable audit logging, and zero-trust identity management for MCP deployments. In July 2026, the OpenID Foundation's Artificial Intelligence Identity Management Community Group issued a call for participation in an interoperability event testing MCP security with OAuth 2.1, Client ID Metadata Documents, and Enterprise Managed Authorization, scheduled for demonstration at the Gartner IAM Summit. By mid-2026, MCP was transitioning through the Gartner Hype Cycle's trough of disillusionment, with critics citing token overhead, security concerns, and protocol complexity, while enterprise adoption continued to accelerate through centralized gateway architectures, OAuth 2.1 standardization, and the forthcoming specification update. Academic benchmarks published in 2026 — ComplexMCP (300+ tools, 7 stateful sandboxes), MCP-AgentBench (33 servers, 188 tools, 600 queries), and MCP-Atlas (36 real servers, 1,000 tasks) — each found that even top-tier models struggled with multi-step tool orchestration, with best scores ranging from 60% to 82%. In parallel, the MCP-AX Internet-Draft was published with the IETF in May 2026, specifying a hierarchical aggregation protocol that extends MCP to resource-constrained embedded devices through transport bridging and recursive namespace delegation.
MCP Apps, released in January 2026 and standardized under SEP-1865, extended the protocol to support interactive UI components through sandboxed iframes with bidirectional JSON-RPC over postMessage, and was adopted by Claude, ChatGPT, VS Code with GitHub Copilot, Goose, Postman, Microsoft 365 Copilot Chat, and Elastic within months. The MCP-Cosmos research framework (arXiv:2605.09131, May 2026) demonstrated that world model-augmented MCP agents raised tool call success rates from 77.7% to 100% and parameter accuracy from 31.3% to 61.0%. The 2026-07-28 specification update — the largest revision of the protocol since launch — introduced a stateless protocol core enabling horizontal scalability on plain HTTP infrastructure, a formal extensions framework under which MCP Apps and Tasks became the first official extensions, authorization hardening with OpenID Connect alignment and six Specification Enhancement Proposals, and a formal deprecation policy with Roots, Sampling, and Logging deprecated. The 2026 MCP roadmap shifted from milestone-based releases to priority-driven development across four areas: transport evolution and scalability, agent communication, governance maturation, and enterprise readiness. The first alpha of the MCP Python SDK v2 shipped on June 19, 2026, rewriting the SDK core for the stateless protocol, with v2.0.0a2 following on June 24 with full 2026-07-28 protocol types and version-gated wire validation, and ClientSession rewritten on the JSONRPCDispatcher receive path. SDK maintainers warned that 84% of the 10,000+ PyPI packages depending on mcp declared no upper bound on their dependency version and would automatically resolve to v2 on the day the stable release ships. On July 9, 2026, the MCP team released beta SDKs for all four Tier 1 languages implementing the 2026-07-28 stateless protocol — Python v2 (renaming FastMCP to MCPServer), TypeScript v2 (splitting the monolithic SDK into focused packages and adopting Standard Schema for tool definitions with Zod v4, Valibot, or ArkType), Go v1.7.0-pre.1 (with opt-in stateless mode via StreamableHTTPOptions), and C# v2.0.0-preview.1 (with [Obsolete] markers on deprecated capabilities). The MCP Go SDK v1.7.0-pre.1 shipped on June 22 with full 2026-07-28 support including the stateless model, server/discover RPC, multi-round-trip requests, and unified subscriptions. The mcp-deprecate static analysis tool launched on June 20, scanning MCP server code for features deprecated or removed by the 2026-07-28 specification to help developers migrate before the July 28 deadline. A comprehensive migration guide covering all seven breaking changes was published alongside the release candidate. Akamai's security analysis of the 2026-07-28 specification identified five new attack surfaces introduced by the stateless transition while noting three classes of eliminated vulnerabilities, concluding that security responsibility now shifts from the protocol itself to developers and platform operators.
Enterprise MCP adoption accelerated across multiple sectors. Slack launched the Slackbot MCP Client on June 18, 2026, making Slackbot an MCP host that automatically discovers and invokes tools from connected MCP servers based on user prompts in conversation. Apple released Safari Technology Preview 247 with an embedded MCP server providing AI agents with browser tools including DOM interaction, screenshots, and network analysis. Salesforce released the Data 360 MCP Server as an open-source developer preview, consolidating 200 REST API endpoints behind three facade tools. The Summer '26 release introduced Salesforce Hosted MCP Servers as a centerpiece of the Headless 360 initiative, offering both pre-built standard servers (SObject CRUD, SOQL, Data 360, Tableau) and custom servers built from Apex, Flows, REST endpoints, and Prompt Builder. [[Google|Google Cloud]] announced the general availability of the Remote MCP Server for AlloyDB as part of a rollout of over 50 Google-managed MCP servers. [[Smartsheet]] expanded its MCP Server from Claude-only to support ChatGPT, Microsoft Copilot, and Gemini Enterprise, reporting 22,000+ unique users, 3 million AI actions, and weekly tool calls growing from 42,000 to over 700,000 since launch. [[Pinterest]] built an internal MCP ecosystem with 66,000 monthly invocations and an estimated 7,000 hours saved per month, alongside an external advertiser-facing Pinterest MCP server in alpha. [[Workato]] expanded its Enterprise MCP catalog to 48 pre-built servers through its MCP Monday program, chaining with 12,000+ connectors and supporting Genies as MCP clients, after launching production-ready MCP servers in February 2026 with eight initial integrations and a 99.9% uptime SLA. [[HashiCorp]] released the Terraform MCP Server v1.0 for both HCP Terraform and Terraform Enterprise, and maintained a beta Vault MCP Server for secrets management with 10+ tools including PKI operations. [[Nexla]] launched MCP Studio for building governed, task-specific MCP servers across 600+ enterprise systems. [[NetBox Labs]] released its Platform MCP Server with nearly 100 infrastructure management tools and Agent Skills. [[Checkmarx]] released a native MCP Server for application security workflows with 16+ tools across five capability categories. [[Reprise]] introduced an MCP server giving AI assistants end-to-end control over enterprise demo creation with 100+ authoring tools, backed by $82.2 million in total funding from ICONIQ Growth, Bain Capital Ventures, Accomplice VC, and Glasswing Ventures. [[Predactiv]] launched an MCP server for audience intelligence enabling natural-language audience building and activation, emerging from ShareThis (founded 2007) and headquartered in Palo Alto. [[LucidLink]] launched an MCP server addressing multi-agent state management with shared, persistent file access across distributed environments. [[Prodoscore]] released the first MCP server from a workforce analytics provider, achieving 50% year-over-year growth in 2024 and introducing AI functionality in February 2025 that provides employees with personalized achievement summaries and coaching recommendations. [[Highspot]] made its MCP server available in both the OpenAI ChatGPT and Anthropic Claude App Stores. [[Truelist]] launched both a hosted MCP server and an npm package for email validation via AI assistants. [[CaliberMind]] launched an MCP server connecting AI assistants to a governed marketing analytics data platform with 170+ pre-built data connectors, providing read-only SQL queries against BigQuery with full audit trail. Solo.io launched Solo Enterprise for agentgateway and Solo Labs for MCP as enterprise-grade MCP gateway offerings, alongside the MCP Academy offering hands-on labs. Sectigo introduced the industry's first globally available MCP server for certificate lifecycle management. eXo Platform released an MCP server exposing 98 tools across 10 digital workplace capability domains. [[Solana|Solana Foundation]] published an official MCP portal for blockchain developer tooling. Xinhua Finance launched a comprehensive MCP service matrix with 30+ core services across six categories. [[Tencent Cloud]] built an extensive MCP ecosystem including 34+ cloud product MCP tools and an MCP Hub strategy. [[Valona Intelligence]] launched an MCP server for competitive and market intelligence across 200,000+ verified sources. [[Digital Realty]] launched ServiceFabric MCP, extending AI-native control surfaces to over 800 data centers. [[LoginRadius]] delivered enterprise-grade MCP authorization using OAuth 2.1 with PKCE. [[Lasso]] released the first open-source security-centric MCP gateway. [[Ambition]] launched an MCP integration for revenue performance teams. [[Sumsub]] became the first identity verification platform to enable AI agents to configure full compliance workflows from AML policy documents automatically. [[Valantic]] joined Anthropic's Claude Partner Network as a Select Partner in the Services Track, one of the first European consulting firms to deliver Claude Enterprise, and published a substantive MCP analysis. The MCP Java SDK reached version 2.0.0. China's Ministry of Industry and Information Technology opened public consultation on MCP application security requirements in March 2026. The Agent-to-Agent protocol reached v1.0, with Google's A2A and Anthropic's MCP positioned as complementary layers in an emerging multi-protocol agent stack. Enterprise MCP deployments from Block, Microsoft, Forbes, Cloudflare, Autodesk, and Uber confirmed MCP was operating at production scale.
New MCP server launches in July 2026 continued to expand the ecosystem across industries — see [[concepts/ecosystem-outlook|MCP Ecosystem Outlook]] for a detailed timeline of these announcements. On May 12, 2026[^c1], Thomson Reuters connected Claude to its CoCounsel Legal platform via MCP, reasoning across 1.9 billion legal documents, and rebuilt the next generation of CoCounsel on the Claude Agent SDK. Financial services adoption of MCP reached new maturity levels with three organizations deploying in production: Evergreen Wealth built a custom zero-trust MCP gateway for its AI advice engine; Bloomberg adopted MCP across three tiers spanning agentic systems, developer productivity, and external client exposure, analogizing MCP to HTTP for connecting agents to internal services; and Saxo Bank leveraged the C# SDK so .NET developers could build AI integrations without Python expertise. AWS launched an open-source MCP server for the Registry of Open Data (RODA) on July 15, 2026, enabling scientists and researchers to discover over 1,100 publicly available datasets through conversational AI tools. Navan launched an MCP server for travel and expense management on July 1, 2026, with its stock rising 5.86% on the announcement. [[Snap]] launched an MCP server for its advertising platform, becoming the fifth major social advertising platform — alongside Google, Amazon, Meta, and Pinterest — to expose campaign data and controls to third-party AI agents.[^c2] Salesforce released the Headless 360 MCP Server beta in early July, exposing the full Salesforce platform through four meta-tools backed by a continuously growing skill library.[^c3] Arbor v2.4.0 shipped as the first MCP server built for the 2026-07-28 protocol specification, implementing the stateless architecture, Tasks extension, and MCP Apps.[^c4] LiteLLM released an MCP Server acting as an LLM gateway unifying over 100 model APIs through a single MCP endpoint, demonstrating MCP's expanding role in LLM routing infrastructure. Academic research published at ACL 2026 introduced ProMCP, a profiling framework that decomposed MCP workflows into a six-stage communication pipeline and found that planning and schema injection account for 56–72% of token usage while actual tool execution is negligible. The EPS Research Astro-RAG MCP Server v2.3.0 demonstrated MCP's applicability to astrophysical research, providing FAISS-accelerated semantic search across 2,064 astronomical objects spanning the local universe to the high-redshift frontier, publicly deployed on HuggingFace Spaces.
The MCP monetization landscape remained nascent as of mid-2026, with fewer than 5% of the over 11,000 public servers generating revenue. Pricing models converged on hybrid subscription-with-overage as the dominant pattern, alongside per-call usage-based, per-session, and outcome-based models. Marketplaces such as Apify and MCPize offered 85% revenue share to developers, while payment gateways included x402 (USDC micro-payments on Base with sub-2-second settlement) and Stripe MPP for fiat session billing. Practitioner examples included 21st.dev achieving $10,000 monthly recurring revenue within six weeks on a $20/month freemium model.