The Model Context Protocol (MCP) is an open standard that lets AI applications and agents connect tools, data and templates in a uniform way. Instead of writing a separate integration for every database, ticketing system and API, the agent talks to an MCP server that describes and runs these capabilities. Anthropic released MCP in November 2024 and handed it to the Linux Foundation's Agentic AI Foundation in December 2025. This article explains how MCP is built, what changed with the July 2026 specification and what to watch for on security.
Fact sheet (as of October 2026)
| Attribute | Detail |
|---|---|
| Steward | Agentic AI Foundation (Linux Foundation), founding project since December 2025 |
| Current version | 2026-07-28 (versions carry the date of the last incompatible change) |
| Basis | JSON-RPC 2.0 |
| Transport | stdio for local servers, Streamable HTTP for remote servers |
| Official SDKs | Tier 1: TypeScript, Python, C#, Go, Rust, Ruby; Tier 2: Java; Tier 3: Swift, PHP, Kotlin |
| Adoption | more than 10,000 published MCP servers according to the Linux Foundation (December 2025), supported by Claude, ChatGPT, Gemini, Microsoft Copilot, Cursor and VS Code, among others |
What problem MCP solves
An agent is only as useful as the tools it can call. Without a standard, every framework and platform builds its own connectors: one GitHub tool for LangChain, a second for CrewAI, a third for Copilot Studio. MCP separates the two. Anyone who wants to connect a system writes one MCP server. Every application that speaks MCP can then use it.
How MCP works
Host, client and server
MCP has three roles:
| Role | Meaning | Example |
|---|---|---|
| Host | The AI application someone works with | Claude Desktop, VS Code, your own agent |
| Client | Component inside the host that holds exactly one connection to a server | The host creates one client for each connected server |
| Server | Program that provides tools, data or templates | File system, database, GitHub, Sentry |
A local server runs on the same machine and is reached over stdio, that is standard input and output. A remote server runs at the provider and is reached over Streamable HTTP. For signing in to remote servers, MCP recommends OAuth.
The three building blocks of a server
| Building block | What it provides | Who decides | Example |
|---|---|---|---|
| Tools | Functions that do something, such as write, search or send | The model | Search flights, create a calendar event |
| Resources | Read-only data as context, each with its own URI | The application | File content, database schema, documentation |
| Prompts | Templates for recurring tasks, with parameters | The person using the agent | "Plan a vacation", "Summarize my meetings" |
Every tool describes its inputs as JSON Schema. The client asks which tools exist with tools/list and calls one with tools/call. A tool description looks like this:
{
"name": "searchFlights",
"description": "Search for available flights",
"inputSchema": {
"type": "object",
"properties": {
"origin": { "type": "string", "description": "Departure city" },
"destination": { "type": "string", "description": "Arrival city" },
"date": { "type": "string", "format": "date", "description": "Travel date" }
},
"required": ["origin", "destination", "date"]
}
}
In the other direction, a server can ask the person for input through elicitation, for example to get a confirmation before an action.
What changed with version 2026-07-28
With the specification of 28 July 2026, MCP turns from a stateful into a stateless protocol, according to the project blog. If you run older MCP servers, these are the points to know:
- No handshake and no sessions: The previous
initializestep is gone, and so is the session ID header. Every request carries its version, client and capabilities. Withserver/discover, a client can ask for a server's capabilities up front. Servers can therefore run behind ordinary HTTP load balancers. - New headers for gateways: Requests over Streamable HTTP name the method and name in a header, so gateways can route and meter them without reading the body.
- Extensions instead of core: Long-running tasks (Tasks) and MCP Apps with their own interface are now extensions.
- Deprecated: Sampling, Roots and Logging, the old HTTP+SSE transport and Dynamic Client Registration. Deprecated features remain available for at least twelve months.
The Tier 1 SDKs for TypeScript, Python, Go and C# supported the new version on release day.
MCP and A2A
MCP connects an agent to tools and data. The A2A protocol connects agents with each other, including across vendor and company boundaries. Many systems use both: an agent calls a specialist agent over A2A, and that agent connects its own tools over MCP.
Who supports MCP
In our directory, these systems among others list MCP support:
- Frameworks: OpenAI Agents SDK, Claude Agent SDK, Microsoft Agent Framework, Haystack, AgentScope, BeeAI Framework, Dapr Agents
- Low-code and no-code: Langflow (flows can be served as MCP servers), Make AI Agents, Notion Custom Agents
- Enterprise platforms: Microsoft Foundry Agent Service, SAP Joule Studio, ServiceNow AI Agents, Oracle AI Agent Studio
- Customer service: Cognigy, Infobip AI Agents
Product pages rarely say which version they speak. Before connecting, check whether both server and client support version 2026-07-28 or whether one of them still expects the older version with a handshake.
When MCP is worth it
MCP makes sense when
- one tool should be used by several agents or applications,
- you want to make your own product available to AI assistants such as Claude, ChatGPT or Copilot,
- teams want to provide their tools centrally and manage permissions in one place.
MCP is not needed when
- an agent only calls one or two fixed functions that you can define directly in the framework,
- agents should hand tasks to each other. That is what A2A or your framework's own mechanism is for.
Security and limitations
An MCP server acts with the permissions you give it. The security guidance in the specification names these risks, among others:
- Local servers are executable code: A local server runs with the same permissions as the application. A tampered start command can exfiltrate or delete data. Clients must show the exact command before setup and ask for confirmation.
- Do not pass through foreign tokens: A server may only accept tokens issued for it and must not forward them unchecked to other services.
- Keep permissions small: Broad scopes such as
admin:*increase the damage if a token falls into the wrong hands. Start with few permissions and extend them when needed. - Check servers from third parties: The official MCP Registry is still a preview. It verifies who owns a namespace but does not scan the servers' code itself.
There is also a practical point: every connected tool ends up in the model's context with its description. For clients with many servers, the documentation therefore recommends loading tools progressively instead of all at once. Only connect what the agent really needs.
Frequently asked questions
Is MCP only for Claude?
No. MCP comes from Anthropic, but it has been with the Agentic AI Foundation since December 2025. Its platinum members include AWS, Google, Microsoft and OpenAI alongside Anthropic.
Do I need my own MCP server?
For common services such as GitHub, Slack or databases, servers usually exist already. You need your own for internal systems. Official SDKs are available for ten languages, including Python, TypeScript, C# and Java.
Do older MCP servers still work?
Yes, as long as client and server share a version. The specification describes how new clients work with servers on version 2025-11-25 and earlier. Deprecated features remain available for at least twelve months.
Where can I find MCP servers?
The official MCP Registry collects metadata of public servers. It is mainly meant as a source for marketplaces and other directories that curate and rate the entries.