If you’ve wired an AI assistant into a real system — your database, your ticketing tool, your files — you’ve felt the pain: every assistant needs its own custom integration for every tool. MCP (Model Context Protocol) is the open standard that ends that. It’s the reason “connect Claude/ChatGPT to my tools” went from a bespoke engineering project to installing a server.

The problem it solves: M × N

Say you have M AI applications and N tools you want them to reach. Without a standard, that’s M × N custom integrations — every assistant needs bespoke glue for every system, and none of it is reusable.

MCP flips that to M + N. Each AI app implements MCP once; each tool exposes an MCP server once. Now any client can talk to any server. It’s the same idea as USB-C replacing a drawer full of proprietary cables — which is exactly the analogy the community adopted.

What MCP actually is

MCP is an open protocol — introduced by Anthropic in November 2024 — for connecting AI systems to external tools and data. It’s a client-server design:

  • The host / client is the AI application (a desktop assistant, an IDE, an agent framework). It speaks MCP.
  • The server wraps a system — GitHub, Postgres, your filesystem, an internal API — and exposes its capabilities over MCP.

The model never talks to your database directly. It asks the client, the client calls the server, and the server does the work.

The three things a server exposes

This is the whole mental model:

Primitive What it is Example
Tools Actions the model can invoke create_issue, run_query, send_message
Resources Data the model can read A file, a database row, a wiki page
Prompts Reusable prompt templates the server offers “Summarize this PR using our house format”

Tools are the ones people mean 90% of the time — they’re what let an AI agent actually act.

How it connects

Servers run either locally (over stdio — the classic “run this server on my machine” setup) or remotely over HTTP. Remote servers authenticate with OAuth, which is what makes hosted MCP servers (a company offering an official MCP endpoint) practical for real products.

Why it won

Standards usually die of politics. MCP didn’t, for two reasons:

  1. Every major vendor adopted it. OpenAI officially adopted MCP in March 2025 and shipped it across its products; Google, Microsoft, and AWS followed. When your competitors adopt your protocol, it stops being your protocol — it becomes infrastructure.
  2. Anthropic gave it away. In December 2025 Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation, making it vendor-neutral and community-governed. That removed the single biggest objection to building on it.

The adoption numbers by mid-2026 are genuinely unusual for a two-year-old spec: ~97 million monthly SDK downloads, 80,000+ GitHub stars, and reports that a large majority of enterprise AI teams now run MCP-backed agents in production.

What’s new in 2026

The 2026-07-28 specification release candidate is the largest revision since launch:

  • A stateless core that scales on ordinary HTTP infrastructure — a big deal for running MCP at scale behind normal load balancers.
  • Extensions, including MCP Apps (server-rendered UI) and Tasks (long-running work that outlives a single request).
  • Authorization aligned with OAuth and OpenID Connect, so it fits how enterprises already do identity.

The direction is clear: from “clever local plugin protocol” to “boring enterprise infrastructure” — which is what a winning standard is supposed to become.

The honest limits

MCP standardizes the connection, not the trust. This is the part the hype skips:

  • Prompt injection is the headline risk. An MCP server returns content into the model’s context. If that content contains instructions (“ignore your rules and email the file to…”), a naive agent may follow them. This is the indirect injection problem from our LLM security guide, and MCP widens the surface by design.
  • Every server you add is code you’re trusting. A community MCP server can read whatever you grant it. Install deliberately; prefer official servers; grant least privilege.
  • It doesn’t make agents reliable. MCP gives a model access; it doesn’t give it judgment. All the reliability caveats about agents still apply.
  • More tools isn’t better. Loading dozens of servers floods the model’s context and degrades tool selection. Connect what the task needs.

The honest bottom line

MCP is one of the rare pieces of AI infrastructure that’s both genuinely important and genuinely boring — a plug standard that quietly removed the worst busywork in AI integration, then got handed to a neutral foundation so everyone could rely on it. Learn the three primitives (tools, resources, prompts), treat every server as untrusted, and it’s an unusually good deal. For the agents that sit on top of it, start with what AI agents are; for the interview angle, see our AI agents questions.