MCP Became the AI Tool Standard: Why This Protocol Won

Before November 2024, every AI tool that wanted to touch the real world had to have its own integration. If an email server was going to be used by twenty AI agents, that meant twenty integrations written by hand, twenty request formats, and twenty places for things to go wrong. MCP was born to end that, and within thirteen months it went from a proposal by one company to an industry standard.

The name is Model Context Protocol. Anthropic first released it on 25 November 2024 as a way to connect AI applications to data sources and tools outside them. The idea is simple: one common language for all tools, instead of one language per tool.

What makes MCP different is not the technical approach. What makes it important is who holds control over those tools, and who is accountable when a tool gets something wrong.

The architecture: host, client, and server

MCP has three parties, and telling them apart is the key to understanding its risks.

The protocol uses JSON-RPC 2.0, and there are two transports, which are stdio for local processes and Streamable HTTP for anything running as a service. On top of that sit three basic primitives. Resources are data and context that get read, like a file or a database row. Prompts are message templates that can be invoked. Tools are functions the model executes, and those are the most dangerous, because they can change the world.

There are two additional directions that often get missed. Elicitation lets a server ask the user something back, so a server does not have to guess at things it should not guess. Sampling lets a server ask the host to run a model inference, so a tool can use the model the user is already using without holding an API key of its own.

The protocol was inspired by the Language Server Protocol, which earlier managed to unify language support across editors. The difference is that LSP unified one domain, while MCP is trying to unify every domain at once.

Beyond the core, the 2026-07-28 specification carries several extensions. Tasks runs long operations asynchronously, with polling, mid-flight input, and durable handles. Skills over MCP brings structured workflow instructions that an agent can discover and use. MCP Apps renders interface elements inside the conversation, such as charts and forms, without leaving the chat window. All of it is optional, and all of it requires support on both sides before it is used.

From zero to industry standard in thirteen months

The journey was fast, and the numbers deserve careful reading.

On 9 December 2025, Anthropic handed MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation. The foundation was co-founded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, Cloudflare, and Bloomberg. MCP became one of three founding projects, alongside Block's goose and OpenAI's AGENTS.md.

Three numbers were quoted at the handover. More than 10,000 active public MCP servers. Adoption by ChatGPT, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code. And 97 million monthly SDK downloads for Python and TypeScript. The last one is the most interesting, because SDK downloads reflect real usage better than the number of registered servers.

On 14 September 2026, the Agentic AI Foundation launched the first official MCP certification. It is the foundation's first certification of any kind, and it covers five exam domains. MCP fundamentals, architecture and components, interactions and execution, security and governance, and use cases and ecosystem. Security and governance alone carries 24 percent of the weight, almost as much as interactions. That is an interesting choice, and it says something about what the community thinks matters.

The latest specification available as of October 2026 is version 2026-07-28.

What is still unresolved: MCP servers are a new supply chain

This is where the industry has an unsolved problem, and the problem is not technical.

Every MCP server is a third-party program running inside a host. It has access to the user's files, network, and processes. And its tool descriptions are free text that the model reads. Free text that a model reads is a legitimate prompt injection path, because the model cannot tell an instruction from a tool apart from an instruction disguised as one.

The patterns seen since 2025 and 2026 repeat themselves. Tool poisoning, where a tool description disguises itself as a system instruction. Rug pulls, where a tool's behaviour changes quietly after the first version ships. Confused deputy, where a server uses more permission than the user intended, because there is no clear line between a tool's permissions and the application's.

What makes this hard is that the list is not a problem with the protocol specifically. The protocol itself has a written security section, and its first principle is user consent and control. But principles only work when the implementation is right, and the implementation lives in thousands of servers written by thousands of people at wildly different levels of care.

Analysis: why this protocol won, and where the risk sits

There are three reasons MCP won, and none of them are about technical quality.

First, timing. The protocol arrived while demand was surging. Agents were becoming the main interface for a lot of software, and every bespoke integration is a cost that cannot be shared. The protocol that shows up first usually wins, not the best one.

Second, and this is often missed, MCP arrived to a market that already had the Language Server Protocol as a precedent. LSP worked because editors never repeated the same work. MCP works because agents never repeat the same work. The lesson from LSP about neutral governance, and from the foundation formed in December 2025, is that neutral governance can work in an industry that usually does not allow it.

Third, there was a party that brought half the market with it. OpenAI donated AGENTS.md to the same foundation on the same day. Two companies that usually compete became founding projects in the same foundation, and that changes the dynamics. Ketika dua pesaing terbesar ada di ruangan yang sama, protokolnya berhenti jadi milik satu perusahaan.

But there are risks, and they are not small. A neutral protocol with its governance in a shared foundation has one weakness in particular. There is no single party accountable when a server turns out to be malicious. The code in that server belongs to the community, but the people carrying the risk are the host and the user.

There is a second, subtler risk. MCP gives AI agents access to tools, and access to tools always means access to permission. A protocol that makes access easier also makes abuse easier. If ten tools are connected to one host and one of them has full access to your files, then compromising that tool is the same as compromising the entire host.

One thing deserves honesty. The figures of 10,000 servers and 97 million SDK downloads come from the party that announced them, and nobody can audit them. The direction is clear regardless. The number of servers will keep rising, and the quality of those servers will keep falling, because adding a server is far cheaper than auditing one. That is the same pattern every open source market has ever followed, and the outcome is always the same. The trustworthy ones will always cost more to build than the untrustworthy ones.

What you can do

If you are building agents in 2026, there are four decisions to make early. All four are cheap to get right and expensive to fix later.

First, use the narrowest permissions you can, per tool rather than per server. A single server with ten tools should have ten different permission scopes, not one loose scope covering all of them.

Second, pin the version of every server you use, and read the changelog before every update. Rug pulls work precisely because people update without reading.

Third, treat tool descriptions as code that needs review, not as documentation that needs reading. If there is an instruction inside one that makes no sense for what the tool does, it is not documentation.

Fourth, separate your credentials. Each server should have its own key, with a clear limit. It takes a few minutes, and the pattern is exactly the same one we looked at in the OpenCode incident in October 2026. An API key is an asset, not a routine technical credential.

And if you are a user rather than a builder, one thing matters most. Adding an MCP server to an agent means granting permission, and that permission does not disappear when you close the app. Read what the server can reach before you connect it.