What Is MCP (Model Context Protocol) and Why It Matters

The Model Context Protocol (MCP) is an open standard, created by Anthropic and now stewarded by the Linux Foundation, that gives AI applications a single, consistent way to connect to external tools, files, and data sources — instead of requiring a custom-built integration for every pairing of AI model and system. Anthropic has described it as "a USB-C port for AI applications," and in the two years since its release it has been adopted by OpenAI, Google, Microsoft, and dozens of developer tools, making it one of the fastest-spreading technical standards in the AI industry.

What is the Model Context Protocol?

MCP is, in its own documentation's words, "an open-source standard for connecting AI applications to external systems." Using it, AI applications can connect to data sources such as local files and databases, to tools such as search engines and calculators, and to workflows such as specialized prompt templates — all through one shared protocol rather than a different integration for each pairing.

Before MCP, if a company wanted its chatbot to read from Slack, query a Postgres database, and search GitHub, its engineers typically had to write and maintain three separate, bespoke integrations — and every other AI vendor wanting the same three connections had to write their own three again. MCP's architecture page describes this as a protocol that standardizes "the ways developers can share context from MCP servers to MCP clients," so a tool built once as an MCP server can, in principle, work with any MCP-compatible AI application.

Why did Anthropic create it?

Anthropic's original November 2024 announcement framed the problem bluntly: even the most capable models, it said, remain "trapped behind information silos and legacy systems," and building a custom connector for "every new data source" makes "truly connected systems difficult to scale." MCP was Anthropic's answer — "a universal, open standard for connecting AI systems with data sources," released as an open-source specification with SDKs in Python and TypeScript, plus reference server implementations for Google Drive, Slack, GitHub, Git, Postgres, and Puppeteer.

Early partners named in that announcement included Block and Apollo, alongside developer-tool companies such as Zed, Replit, Codeium, and Sourcegraph, which began wiring MCP into their AI coding features almost immediately. That pattern — MCP showing up first inside coding assistants — is one reason it's now baked into tools like Cursor, GitHub Copilot, and Claude Code, which we've compared head-to-head elsewhere.

The architecture: hosts, clients, and servers

MCP follows a client-server architecture with three kinds of participants, as defined in the protocol's own architecture documentation:

• MCP Host — the AI application itself, such as Claude Desktop, Claude Code, or an IDE like Visual Studio Code, which "coordinates and manages one or multiple MCP clients."
• MCP Client — a component the host creates for each server it talks to; it "maintains a connection to an MCP server and obtains context from an MCP server for the MCP host to use."
• MCP Server — "a program that provides context to MCP clients," whether it runs locally on the same machine (connecting over a standard-input/output "stdio" transport) or remotely over the network (using a Streamable HTTP transport).

In practice, a single host can run several clients at once — one connected to a local filesystem server, another to a remote database server, another to a company's internal API. Each connection is independent, and the host is responsible for combining whatever those servers expose into a single set of capabilities the underlying language model can draw on.

Tools, resources, and prompts: the three primitives

Underneath the host-client-server structure, MCP defines a small set of "primitives" — the actual things a server can offer a client. The protocol's documentation names three core primitives that servers expose to AI applications:

A single MCP server can expose all three. The architecture documentation's own example is a server that provides context about a database: it can offer tools for querying the database, a resource containing the database's schema, and a prompt with few-shot examples for writing queries against it. Underneath these primitives, MCP communicates using the JSON-RPC 2.0 message format, and newer protocol versions added a discovery step (a server/discover request) so a client can learn a server's capabilities and supported protocol version before using it.

Why MCP became a cross-industry standard

MCP's adoption outside Anthropic has been unusually fast and, notably, has included Anthropic's direct competitors. OpenAI began adding MCP support across its products in 2025, with CEO Sam Altman saying at the time that "people love MCP" and that support was rolling out through the Agents SDK, with the ChatGPT desktop app and Responses API following. OpenAI's own developer documentation now describes MCP as "an open protocol that's becoming the industry standard for extending AI models with additional tools and knowledge," and documents MCP support in ChatGPT and through its Responses API.

Google DeepMind CEO Demis Hassabis likewise confirmed that Gemini's models and SDK would add native MCP support, calling it "a good protocol" that was "rapidly becoming an open standard for the AI agentic era." Microsoft added MCP support to Windows, Copilot, and developer tools including Visual Studio Code.

That momentum culminated in December 2025, when Anthropic donated MCP itself to a new Linux Foundation project, the Agentic AI Foundation (AAIF), co-founded with Block and OpenAI and backed by Google, Microsoft, AWS, Cloudflare, and Bloomberg. In its own announcement of the donation, Anthropic said doing so would ensure MCP "stays open, neutral, and community-driven as it becomes critical infrastructure for AI," and cited more than 10,000 active public MCP servers and over 97 million combined monthly downloads of its Python and TypeScript SDKs roughly a year after launch. Anthropic also noted that Claude itself now offers more than 75 MCP-powered connectors. MCP's governance remains structured as a technical steering group of individual maintainers — not company seats — operating under Linux Foundation project policies, the same open-governance model used for projects like Kubernetes.

Practical examples of MCP servers

Because MCP servers are just programs that speak a shared protocol, the ecosystem that's grown around it is broad. Some concrete examples, drawn from the protocol's own reference implementations and widely used integrations:

• Filesystem server — a local server that exposes a directory's files as resources an AI application can read, letting a coding assistant see a project's source files.
• Database servers (Postgres and others) — expose schema information as a resource and querying as a tool, so a chatbot can answer questions against live data without a bespoke integration.
• Developer-platform servers, such as the official Sentry MCP server, which runs remotely over Streamable HTTP and lets an AI application pull error reports and stack traces into a debugging session.
• Productivity and collaboration servers for systems like Google Drive, Slack, and GitHub — among the first reference servers Anthropic published alongside MCP's initial release.
• Browser-automation servers, such as Microsoft's Playwright-MCP, which exposes browser control as a set of tools an AI model can call to navigate and interact with web pages.

Many of these servers are now one click away inside AI applications' own plugin or connector directories — a pattern similar to how Claude's own marketplace surfaces add-ons, and one that underpins how modern AI agents reach beyond pure conversation and into real systems — MCP is frequently the plumbing an agent framework uses to actually call a tool once it decides an action is needed.

Security and trust: what changes when you connect a model to MCP servers

Granting an AI model a live connection to a tool or data source is a meaningful trust decision, and MCP's own specification maintainers have published a detailed security best-practices document addressing it directly. Several risks are specific to how MCP connections work:

• Local server compromise. A locally running MCP server executes with the same privileges as the AI application itself. The protocol's security documentation warns that a malicious or compromised local server can run arbitrary commands — including data exfiltration or destructive file operations — and recommends that AI applications show users the exact command before running any locally configured server, and sandbox servers with least-privilege file and network access.
• Token passthrough and the "confused deputy" problem. When an MCP server acts as a proxy to a third-party API, the specification explicitly forbids it from accepting or forwarding authentication tokens that weren't issued specifically for it, since doing so can let an attacker skip a user's consent step entirely and hijack access to a connected account.
• Server-side request forgery (SSRF). Because MCP clients follow URLs supplied by servers during authorization flows, the documentation warns a malicious server could point a client at internal network addresses or cloud metadata endpoints to try to steal credentials, and recommends clients block private IP ranges and enforce HTTPS.
• Overly broad permissions. The security guidance also flags "scope inflation" — servers requesting or being granted far more access than a given action needs — and recommends a progressive, least-privilege model where an AI application starts with minimal access and only requests more when a specific task actually requires it.

None of this makes MCP uniquely dangerous — it's the same category of risk that applies to installing any browser extension or granting any app OAuth access to an account — but it does mean the practical security burden sits with whoever chooses which MCP servers to connect, and with the AI application vendor's own consent and sandboxing design, not with the protocol's existence alone.

What's next for MCP

With MCP now housed inside the Linux Foundation's Agentic AI Foundation alongside OpenAI's AGENTS.md and Block's goose project, its future development is explicitly structured to be vendor-neutral rather than Anthropic-led, governed by a steering group of individual maintainers rather than company representatives. Expect continued work on authorization and consent flows (an area the security documentation itself flags as still evolving), on the registry of public MCP servers, and on narrowing the gap between MCP's original "local tool" use case and its fast-growing remote, multi-tenant deployments inside enterprise software. For a site that covers how AI products actually get built, MCP is likely to keep coming up — not as a single product, but as the plumbing increasingly sitting underneath them.

Written byTheo Park

Theo Park runs the AI desk at Pandromeda. He follows model launches from the frontier labs and the open-weight community, tracks the assistants and developer tools built on them, and explains what each release changes on pricing, capability and safety. His reporting leans on primary sources: model cards, technical reports, API documentation and the companies' own announcements.

More from Theo ParkAll AI coverage