Model Context Protocol (MCP)

Anthropic published MCP in November 2024 as an answer to the M×N integration problem: M AI applications each needing bespoke connectors to N tools. Its design borrows openly from the Language Server Protocol, which solved the same problem for editors and language tooling. Three roles are defined. The host is the user-facing application (an IDE, chat client or agent runtime); it instantiates one client per server connection; each server exposes capabilities. All messages are JSON-RPC 2.0 requests, results, errors and notifications, carried over stdio for local servers or Streamable HTTP for remote ones. Servers offer tools, resources and prompts; clients have historically offered roots, sampling (letting a server ask the host's model for a completion) and elicitation (letting a server ask the user for input).

The specification is versioned by date, and each revision has changed security-relevant behaviour. 2024-11-05 was the initial release. 2025-03-26 added an OAuth 2.1-based authorization framework, replaced the original HTTP+SSE transport with Streamable HTTP, and introduced tool annotations. 2025-06-18 removed JSON-RPC batching, added structured tool output and elicitation, classified MCP servers as OAuth resource servers with protected-resource metadata, and required clients to send RFC 8707 resource indicators so that a token minted for one server cannot be replayed at another. 2025-11-25 added OAuth Client ID Metadata Documents, experimental tasks for long-running requests, URL-mode elicitation and tool use inside sampling. The 2026-07-28 revision, the largest so far, made the core stateless: no initialize handshake or protocol sessions, protocol version and client capabilities sent in every request's _meta, a mandatory server/discover method, a multi-round-trip pattern that replaces server-initiated requests, tasks moved into an official extension, and a formal lifecycle policy with at least twelve months' notice before removal. Roots, sampling and logging were deprecated in the same revision, and Dynamic Client Registration was deprecated in favour of Client ID Metadata Documents.

Governance moved on 9 December 2025, when Anthropic donated MCP to the newly formed Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI; changes now go through a public Specification Enhancement Proposal (SEP) process with working groups and tiered SDKs. At the time of the donation Anthropic reported more than 10,000 active public MCP servers.

MCP standardises the interface, not the trust decision. The protocol cannot stop a host from exposing a malicious server's tool descriptions to the model, and the specification's consent and tool-safety principles are largely obligations on host implementers. Compared with vendor-specific function-calling APIs, MCP moves tool definitions out of the application and into independently deployed servers; compared with the Agent2Agent protocol, it connects an agent to capabilities rather than to peer agents with their own reasoning.