MCP (Model Context Protocol)
Model Context Protocol: an open JSON-RPC standard connecting AI apps (hosts) to servers exposing tools, resources and prompts. Linux Foundation since Dec 2025.
The Model Context Protocol (MCP) is an open standard for plugging tools and data into AI applications — a bit like USB for AI. Instead of writing a custom integration for every pair of AI app and service, a service ships one MCP server, and any app that speaks MCP can use it.
A company can write one MCP server for its ticketing system and use it from a coding assistant, a desktop chat app and an internal AI agent without rewriting it. Anthropic released MCP in November 2024 and in December 2025 donated it to the Agentic AI Foundation, part of the Linux Foundation.
A standard power socket: any appliance with the right plug works in any building, so nobody wires each appliance into each house by hand.
Treating an MCP server as trusted because the protocol is standard. A third-party server's tool descriptions and results flow straight into the model's context and can carry instructions.
Roles. A host (the AI application) runs one client per connection to a server. Messages are JSON-RPC 2.0 over stdio (local servers) or Streamable HTTP (remote). Server features: tools (functions the model may call), resources (data addressed by URI, read by the app or model), prompts (user-invoked templates). Client features: sampling (the server asks the host's model for a completion), roots (the host tells the server which directories or URIs it may work in), and elicitation (the server asks the user for input mid-task, added 2025-06-18).
Versions are dated strings. 2024-11-05 was the first. 2025-03-26 added Streamable HTTP (replacing HTTP+SSE), an OAuth 2.1 authorization framework and tool annotations (read-only, destructive). 2025-06-18 added elicitation and structured tool output, made servers OAuth resource servers, required RFC 8707 resource indicators and dropped JSON-RPC batching. 2025-11-25 followed. As of Oct 2026 the current revision is 2026-07-28: stateless requests (no initialize handshake, server/discover instead), no protocol-level sessions, a multi-round-trip pattern replacing server-initiated requests, and roots, sampling and logging deprecated (≥12-month window). Governance: Anthropic donated MCP to the Linux Foundation's Agentic AI Foundation in Dec 2025, alongside Block's goose and OpenAI's AGENTS.md.
MCP standardises discovery and transport; it doesn't make a server safe. Tool descriptions and results are untrusted input (Prompt injection (indirect)); annotations are hints, not guarantees; and 50 connected tools can cost 10k+ tokens of definitions per request. Vet servers like dependencies and scope their credentials with Least privilege.
Pin the protocol revision your host supports and test against it. Local servers over stdio in a Code execution sandbox; remote servers over Streamable HTTP with OAuth and narrow scopes. Enable only the tools a workflow needs (10–20, not 100). Host-side confirmation for any tool annotated destructive or that writes externally. New servers: tools + resources + elicitation; don't build on roots or sampling (deprecated in 2026-07-28).
An SRE team writes one MCP server for its incident system: tools search_incidents (annotated read-only) and page_oncall (destructive), resource incident://2026-1042, and a prompt postmortem-draft. Run over stdio inside their IDE assistant and over Streamable HTTP (OAuth, scope incidents:read) for the chat app, the same server answers "what runbook covers DB failover?" in both. page_oncall sits behind a host-side confirmation because the destructive annotation alone enforces nothing.
Frame it as the M×N integration problem turned into M+N, then name both sides: server tools/resources/prompts, client sampling/roots/elicitation, and say which are deprecated as of the 2026-07-28 revision. Recommend MCP for tools you want reused across hosts; a direct function call is fine for one app's private tool.
Expect: "is MCP secure?" — the protocol defines OAuth for remote servers, but a malicious or compromised server can still inject instructions; trust is a vetting and permission decision.
| Revision | Notable changes |
|---|---|
| 2024-11-05 | First release: tools, resources, prompts, sampling, roots |
| 2025-03-26 | Streamable HTTP; OAuth 2.1 auth; tool annotations |
| 2025-06-18 | Elicitation; structured output; RFC 8707; no batching |
| 2025-11-25 | Further revision (URL-mode elicitation, experimental tasks) |
| 2026-07-28 | Stateless; server/discover; roots + sampling deprecated |
Numbers worth knowing
- Active public MCP servers
- >10,000Anthropic, Dec 2025
- Spec revisions
- 52024-11-05 → 2026-07-28 (current, Oct 2026)
- Deprecation window
- ≥12 monthsMCP feature lifecycle policy, 2026-07-28
- Definition overhead
- ≈10–25k tokens for 50 toolsat 200–500 tokens per tool; measure your own
How to decide
| When | Do this |
|---|---|
| A tool should work in several AI apps or for other teams | Ship it as an MCP server. |
| A tool is private to one app and one team | A native function tool is simpler; wrap it in MCP later if reuse appears. |
| A server needs a directory scope or LLM access | Pass paths as tool parameters or config and call the model API directly — roots and sampling are deprecated. |
| A third-party server can reach private data and the open web | Split read-private and write-external servers, or gate writes behind approval. |
Cost maths
Definition cost per request = Σ tool definition tokens × p_in. 60 tools × 350 tokens = 21k tokens; at $3 / M (illustrative, Oct 2026) = $0.063 per model call. An agent averaging 12 calls/run × 50k runs/month ≈ $37.8k/month of definitions. Trimming to the 12 tools a workflow uses (4.2k tokens) → $7.6k; caching the tool block (reads 0.1×) → ≈ $1k.
Operating it
- Tool definitions exceed ~15% of input tokens
- Tool-selection errors rise after adding a server
- More than one team asks to reuse the same integration (time to publish an MCP server)
- Tools enabled per host session (alert > 25)
- Calls to tools annotated destructive without a confirmation record (alert on any)
- Servers on unpinned or deprecated protocol versions (weekly report)
- Tool results containing instruction-like patterns flagged by a classifier (alert on spikes)
When it goes wrong
In May 2025 Invariant Labs showed an agent using the official GitHub MCP server leaking private-repository data into a public pull request.
Security research disclosure, reproduced end to end.
A malicious issue in a public repo carried instructions; the agent read it with a token that could also read private repos and write public ones — private data, untrusted content and an outbound channel in one session (Willison's "lethal trifecta").
Scope tokens per repository, one repo per session, and require confirmation for writes to public destinations; MCP itself can't fix this — it's a permissions decision.
Related terms
Where it shows up
Sources
- Model Context Protocol specification (2026-07-28) — MCP maintainers, 2026spec
- MCP 2025-03-26 key changes — MCP maintainers, 2025spec
- MCP 2026-07-28 key changes — MCP maintainers, 2026spec
- Donating the Model Context Protocol and establishing the Agentic AI Foundation — Anthropic, 2025blog
- GitHub MCP Exploited: Accessing private repositories via MCP — Invariant Labs, 2025postmortem
Check yourself
Three questions. Every option is explained once you answer.