Model Context Protocol

The Model Context Protocol (MCP) is an open standard that defines how AI agents connect to external tools, data sources, and services. Think of it as the USB-C of the AI world—a universal interface that lets any agent work with any tool, without custom integration for each combination.

Before MCP, connecting an AI agent to a database, API, or application required bespoke code for each integration. MCP standardizes this into a client-server architecture where tools expose their capabilities through a consistent protocol, and agents discover and use those capabilities dynamically. An MCP server might provide 25+ tools for interacting with a chess platform, or expose a content management system's full API, or give an agent access to browser automation.

Originally contributed by Anthropic, MCP has gained adoption across the AI ecosystem, and since December 2025 it has been governed by the Linux Foundation's Agentic AI Foundation (AAIF) rather than by any single vendor. It supports multiple transport mechanisms, handles authentication, and provides a structured way for agents to understand what tools are available and how to use them. The protocol is particularly important for multi-agent systems, where different agents need to discover and coordinate around shared tools.

MCP matters because it addresses a foundational challenge of the agentic web: interoperability. Without a common protocol, every agent-tool combination requires custom work. With MCP, building an agent that can interact with any MCP-compatible system becomes dramatically simpler—lowering the barrier for agentic engineering and accelerating the transition to AI-native workflows.

MCP is also becoming a foundational layer in a broader protocol stack. MIT's NANDA Protocol builds on MCP (alongside Google's A2A and Microsoft's NLWeb) to create the meta-layer for the Internet of Agents — providing cross-protocol agent discovery, identity verification, and decentralized routing. In this architecture, MCP handles the tool-connection layer while NANDA handles discovery and trust across protocols. The agent harness layer sits above both, managing the full lifecycle of agent execution including MCP tool orchestration.

The Chessmata project demonstrated MCP's practical power: a single MCP server exposed 25+ tools that allowed any AI agent to play chess, manage tournaments, and interact with leaderboards through a standardized interface. This pattern—exposing complex systems through MCP—is becoming the default architecture for agent-native software.

2026 Developments: The Stateless Specification

On July 28, 2026, MCP shipped its largest revision since launch, the 2026-07-28 specification, after a release candidate published on May 21. The MCP project summarizes it as "a stateless core that scales on ordinary HTTP infrastructure," new extensions, authorization "that aligns more closely with OAuth and OpenID Connect deployments," and "a formal deprecation policy so the protocol can evolve without breaking what you've built."

Stateless core

Earlier versions began every connection with an initialize/initialized handshake that created a session tracked by an Mcp-Session-Id header. That forced "sticky" routing, so every request from a client had to reach the same server instance. In the new spec each JSON-RPC request is self-contained, carrying client information in a _meta object, and clients discover a server's capabilities on demand through a new server/discover method. MCP servers can now sit behind ordinary round-robin load balancers like any other web API, which matters as remote, cloud-hosted MCP servers replace local ones.

Multi Round-Trip Requests, routing headers and caching

Removing sessions also removed the open stream a server used to ask the client for something in the middle of a call. The replacement is Multi Round-Trip Requests (MRTR): when a tool needs input, the server returns resultType: "input_required" along with the requests it needs answered, and the client retries the original call with the answers attached in inputResponses. According to the specification post, MRTR replaces the server-initiated elicitation/create, sampling/createMessage and roots/list requests, so a confirmation prompt becomes an ordinary request and response. A server that still needs state across calls is told to "mint an explicit handle from a tool and have the model pass it back as an argument."

Two smaller changes serve the same goal. Streamable HTTP requests must now carry Mcp-Method and Mcp-Name headers, so a gateway, rate limiter or web application firewall can route and meter traffic without parsing JSON bodies. Responses from tools/list, prompts/list, resources/list and resources/read carry ttlMs and cacheScope values that tell clients how long, and how widely, a result may be cached.

MCP Apps and Tasks

Two official extensions widen what servers can do. MCP Apps lets a server ship an interactive HTML interface, declared as a ui:// resource, that renders inside the conversation in a sandboxed iframe and talks back to the host over JSON-RPC. A tool can return a working form, chart or dashboard instead of only text. Tasks standardizes long-running work: a server returns a task ID, the client polls with tasks/get and can send more input with tasks/update, and tasks are designed to survive dropped connections. That fits the hours-long jobs that work agents now run.

Authorization

Authorization is now aligned with OAuth 2.1 and OpenID Connect, so MCP servers can sit behind the identity providers enterprises already use. According to AAIF's migration guide, the release adds an Enterprise-Managed Authorization extension for centrally provisioned access and incremental scope consent, and proposes deprecating Dynamic Client Registration.

The final specification post goes further on that last point: Dynamic Client Registration "is now formally deprecated in favor of" Client ID Metadata Documents (CIMD), though it continues to work for backward compatibility. The post also requires clients to validate the authorization server's issuer under RFC 9207 before redeeming a code, and binds client credentials to the issuer that granted them.

Deprecations

For the first time, MCP has a formal deprecation policy, with a minimum 12-month window before anything is removed. Four features are deprecated: Roots (a poor fit for remote servers; pass paths as tool parameters instead), Sampling (servers calling back into the client's model, which complicated trust boundaries), Logging (superseded by stderr or OpenTelemetry), and the original HTTP+SSE transport (superseded by Streamable HTTP). The earliest removal date is July 28, 2027.

SDK tiers

MCP's official SDKs are ranked by a tiering system that the project published on February 23, 2026, a month after its automated conformance tests became available. Tier 1 SDKs must pass 100% of applicable conformance tests, support new protocol features before a new specification version is released, triage issues within two business days and resolve critical bugs within seven days. Tier 2 SDKs must pass 80% and add new features within six months. Tier 3 covers experimental or partial implementations with no commitments. An SDK is relegated if conformance tests fail continuously for four weeks.

The specification post states that "all four Tier 1 SDKs speak 2026-07-28 as of today: TypeScript, Python, Go, and C#," with the Rust SDK supporting the new spec in beta. The C# SDK's place in that group puts .NET on the same footing as the two original SDKs. As of October 2026, the project's SDK page lists six SDKs at Tier 1 (TypeScript, Python, C#, Go, Rust and Ruby), Java at Tier 2, and Swift, PHP and Kotlin at Tier 3. Extensions such as Tasks and MCP Apps are not required for any tier, so a Tier 1 badge does not by itself mean an SDK implements them.

Scale, Governance and Marketplaces

MCP's adoption is now measured in SDK traffic: the project reports that its Tier 1 SDKs see "close to half-a-billion downloads a month," led by the TypeScript and Python SDKs. Governance has also changed. The Agentic AI Foundation now hosts MCP alongside AGENTS.md, goose, agentgateway and — since August 17, 2026 — Google's A2A protocol, and the migration guidance for the 2026-07-28 spec was published on AAIF's blog. MCP connects agents to tools; A2A connects agents to each other; both now sit under the same neutral foundation.

MCP has also become a commercial distribution layer. Anthropic's Claude Marketplace, launched September 23, 2026, offers more than 2,000 connectors and plugins plus partner agents from companies including CrowdStrike, Cursor, Harvey, Lovable and Snowflake, and is built on MCP and Agent Skills; customers can pay with committed Anthropic spend. Microsoft's Foundry "Toolboxes" likewise expose MCP alongside other tools and enterprise data through a single endpoint for agents. The broader reach brings a broader attack surface: tool descriptions and tool outputs are untrusted input, which makes prompt injection the main security concern for MCP deployments.