What Is MCP in 2026? Model Context Protocol Explained

MCP — the Model Context Protocol — is an open, JSON-RPC-based protocol that lets AI applications discover and call external tools, data sources and prompts through one shared interface. Anthropic open-sourced it in November 2024. In 2026 it is governed by the Linux Foundation's Agentic AI Foundation, shipped by OpenAI, Google and Microsoft, and counts roughly 10,000 active public servers with 97M+ SDK downloads a month. If you build agents, MCP is the plumbing your tools ride on — and on July 28, 2026 the spec makes its biggest change yet: it goes stateless.

The problem MCP solves: M × N → M + N

Before MCP, every AI app wrote custom glue for every tool it wanted to reach. Five apps times twenty tools meant a hundred bespoke integrations — each with its own auth, schema and failure modes. MCP collapses that M × N problem into M + N: each client implements the protocol once, each tool exposes an MCP server once, and any client can talk to any server. Tools are discovered at runtime via tools/list, so a server can add capabilities without a single client redeploy.

That is why the "USB-C of AI" analogy stuck. The port is standard; what you plug into it is up to you.

Who owns MCP in 2026? (Not Anthropic.)

The most misunderstood fact about MCP today: it is no longer an Anthropic project. On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded with Block and OpenAI, and supported by Google, Microsoft, AWS, Cloudflare and Bloomberg. Day-to-day governance didn't change — same maintainers, same SEP (Specification Enhancement Proposal) process — but the protocol is now vendor-neutral by charter.

Adoption came first, in one remarkable 2025 run: OpenAI adopted MCP in March, Google DeepMind followed in April ("rapidly becoming an open standard for the AI agentic era," per Demis Hassabis), and Microsoft made it native in Windows 11 at Build in May. By December 2025 the official count stood at ~10,000 active public servers and 97M+ monthly SDK downloads, with first-class support in ChatGPT, Claude, Cursor, Gemini, Copilot and VS Code.

MCP vs function calling (and OpenAPI)

These get conflated constantly, but they sit at different layers:

• Function calling is the model-side mechanism — tool schemas baked into one app's client code, evaluated inside the reasoning loop. Per-app and static: adding a tool means redeploying the client.
• MCP is the integration protocol — a shared wire format any client and any server speak, with runtime discovery. Cross-app and dynamic.
• OpenAPI describes REST services for humans and governance tooling; it doesn't handle model-facing discovery or sessions.

They compose rather than compete: function calling remains what runs inside the loop; MCP is how the loop finds and reaches tools that live outside it.

What changes on July 28, 2026: stateless MCP

The current stable spec is 2025-11-25 (experimental async Tasks, an extensions framework, and serious OAuth hardening — default scopes, machine-to-machine client credentials, URL-based client registration). The next revision, finalized July 28, 2026, is the biggest architectural shift since the protocol launched:

• Stateless-first core. The initialize handshake and Mcp-Session-Id header are gone — any request can hit any server instance. Horizontally scaling an MCP server stops requiring sticky sessions.
• MCP Apps. Servers can ship sandboxed-iframe UIs, not just tools.
• Tasks graduates to an official extension for long-running async work.
• Auth hardening (six SEPs, including mandatory RFC 9207 issuer validation) and a formal 12-month deprecation policy.

If you run stateful HTTP MCP servers in production, this is your migration window. And two housekeeping notes while you're there: SSE transport has been deprecated since March 2025 (Streamable HTTP replaced it), and the official registry — registry.modelcontextprotocol.io — is still in preview, not GA.

The security catch

MCP's superpower — agents ingesting tool descriptions from third-party servers — is also its attack surface. Tool poisoning (malicious instructions hidden in tool metadata) is real enough to be catalogued by OWASP and carry a CVE (CVE-2025-54136, the "rug pull" variant where a server swaps a vetted tool definition after approval). A command-injection flaw in the popular mcp-remote shim (CVE-2025-6514) let malicious servers execute code on clients. Asana's MCP server had a tenant-isolation bug in June 2025, and the Supabase/Cursor "lethal trifecta" demo showed an agent with broad database credentials executing SQL smuggled inside a support ticket.

The practical rules I follow: run only servers you trust and pin their tool definitions (tools like mcp-scan help), scope credentials to least privilege, keep read-only where possible, and gate anything state-changing behind human approval. Never combine private data, untrusted content and an exfiltration channel in one agent context.

How I use MCP

In my own agentic stack, MCP is how agents reach Postgres, internal APIs and operational tooling without bespoke glue per client. The pattern that has aged best: thin servers that expose a few well-scoped tools each, rather than one mega-server with god-mode credentials. Every server is code you must audit — treat a third-party MCP server with exactly the trust you'd give a dependency that can read your data and act on your behalf, because that is what it is.

FAQ

Is MCP an Anthropic product?

No. Anthropic created it (November 2024), but since December 9, 2025 MCP is governed by the Agentic AI Foundation under the Linux Foundation, co-funded by OpenAI and Block. It is vendor-neutral open infrastructure.

Does MCP replace function calling?

No — they compose. Function calling is the in-loop mechanism by which a model invokes a tool; MCP standardizes how tools are discovered, described and reached across applications.

What is the current MCP spec version?

Stable is 2025-11-25. The next revision lands July 28, 2026, making the core stateless (no session IDs), adding MCP Apps, and graduating Tasks to an official extension.

How many MCP servers exist?

The official figure is ~10,000 active public servers (December 2025). Community directories list more, but methodologies vary wildly — cite the official count.

Is MCP secure enough for production?

The protocol's auth story has matured fast (OAuth resource-server model, scopes, issuer validation). The real risk is which servers you run: tool poisoning and rug pulls are documented attack classes with CVEs. Least privilege, pinned tool definitions and human gates on state-changing actions are non-negotiable.

Building agents or MCP integrations for your product? Get in touch — I design and ship production agentic systems, from protocol plumbing to the retrieval and memory layers behind them. Related: why AI agents fail in production and agent memory on plain Postgres.