MCP is not a plugin format. It's vendor-neutral infrastructure — governed by the Linux Foundation, adopted across the industry, and the actual mechanism behind composable AI workflows.
The Model Context Protocol is an open standard, introduced by Anthropic in November 2024, that gives an AI model a universal way to connect to external tools, data, and services. One protocol instead of a custom integration per tool. It has since become the de facto standard across the industry, adopted by OpenAI, Google DeepMind, and Microsoft, with the Python and TypeScript SDKs alone seeing roughly 97 million monthly downloads.
In December 2025, Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation, with OpenAI and Block joining as co-founders and AWS, Google, Microsoft, Cloudflare, GitHub, and Bloomberg as supporting members. That governance shift matters practically: MCP is no longer a single vendor’s protocol that others adopted. It is genuinely neutral infrastructure. That is part of why it is safe to build real workflows around, rather than treating it as a single-vendor bet.
Before MCP, every AI product that wanted to integrate with GitHub had to build and maintain its own GitHub integration. Every tool, its own connector. The result was n different tools each maintaining n different connectors to the same services — a quadratic problem getting worse as both sides of the market grew. MCP flips the model: a server built for GitHub works with Claude, ChatGPT, Cursor, VS Code, or any other MCP-compatible host, with no additional integration work on the server side.
The MCP Registry, launched September 2025, reached nearly 2,000 server entries within months — tools for databases, design systems, code repositories, project management, monitoring, payments, and dozens of other categories. The practical implication: before writing a custom integration for anything, check the registry. The odds a maintained MCP server already exists are genuinely high.
OAuth 2.0, TLS, sandboxing, and explicit consent flows are part of the protocol specification, not something each integration has to invent. As of the June 2025 spec, MCP servers are formally classified as OAuth Resource Servers with mandated Resource Indicators (RFC 8707) — a protocol-level fix for token misuse, not a best-practice suggestion left to each implementer. The July 2026 revision hardened this further with RFC 9207 issuer validation and a shift from Dynamic Client Registration to Client ID Metadata Documents specifically to prevent credential reuse across authorisation servers.
Most casual MCP usage stays at Layer 1: connect a tool, call a function, get a result. The leverage that compounds is in Layers 2 and 3.
Standard tool calling — the layer everyone knows. One server, one tool call, one result. Useful, and also the minimum. The actual advantage of MCP is not that it makes individual tool calls easier; it is that it makes chaining them across unrelated services possible without custom glue code.
Because every MCP server speaks the same protocol, a single agent session can chain calls across genuinely unrelated tools without custom integration work. Pull data from Figma, cross-reference it against a Supabase table, open a GitHub issue, post a summary to Slack — all inside one coherent task, because each is just another server the same client already knows how to talk to. The value compounds with the number of connected servers, not linearly. This is the actual argument for connecting more tools than you think you need on any single task.
MCP Apps (SEP-1865, stabilised January 2026) is the single biggest expansion of what MCP can do beyond data retrieval. Previously, an MCP server could only return text or structured JSON for the model to summarise back in prose. MCP Apps lets a server return an actual interactive interface — a dashboard, a chart, a configuration wizard, a form — rendered inline in the chat, with real bidirectional interaction. Servers declare UI resources via a ui:// URI scheme; all content runs in sandboxed iframes; all UI-to-host communication is loggable JSON-RPC. Supported in Claude web and desktop, VS Code Insiders, Goose, and Postman as of early 2026.
The November 2025 spec release added server-side agent loops as a formal capability — meaning an MCP server itself can run genuinely agentic behaviour: reasoning, multi-step tool use, sampling calls to the client’s model. Combined with the Tasks extension for long-running, poll-based work, this is what makes MCP a real substrate for agentic workflow patterns rather than a plain tool-calling layer underneath them.
Two primitives — sampling and elicitation — exist specifically so a server can request something from the user or model without ever seeing raw credentials or bypassing user control. Sampling lets a server ask the client’s own model to generate text as part of a task, but the client controls model selection, can review and edit the prompt, and can deny the request outright. The server never sees the API key. This is a materially different trust model from a plugin that just gets handed a key and runs unsupervised.
Server requests that the client's model generate text as part of a task. Client controls model selection, reviews the prompt, and can deny. Server has no access to the underlying API key.
Server requests specific information from the user via the client interface, rather than having unrestricted access to ask for anything. Keeps the server operating within a defined permission scope.
Long-running, asynchronous work with poll-based status rather than a blocking request-response. Required for any workflow that takes more than a few seconds — code generation, data processing, multi-step research.
The pace of the MCP specification has been unusually fast for a protocol that is supposed to be stable infrastructure. The July 2026 release — described by its own authors as the largest revision since launch — restructured the core to be stateless: a remote MCP server that previously needed sticky sessions and a shared session store can now run behind a plain round-robin load balancer. That is an infrastructure-level change that makes MCP viable as real production infrastructure for multi-user products, not just developer tooling.
The formal 12-month minimum deprecation policy, introduced alongside the July 2026 revision, is worth noting for anything production-facing. Deprecated features — including Roots, the original Sampling specification, and Logging as previously specified — are on a 12-month removal clock. If you are building on older patterns, particularly Dynamic Client Registration, the migration to Client ID Metadata Documents is the correct path now rather than a forced one later.
Having many connectors available and using them one at a time is not the advantage. The advantage is chaining them inside one coherent task. The Figma-to-Supabase-to-GitHub-to-Slack sequence is the shape of the leverage, not just having all four connected.
Anywhere a text summary of data needs to become a real chart, a real form, or a real picker — a metrics dashboard, a configuration step, a booking flow — that is an MCP Apps use case specifically, not a generic tool call.
These primitives exist so you stay in control of what a server can do on your behalf. A server or workflow that tries to bypass explicit consent for anything touching credentials is a red flag regardless of how convenient it looks.
Dynamic Client Registration is formally deprecated and on a 12-month removal clock. Building on CIMD now avoids a forced migration later.
At nearly 2,000 server entries and growing fast, the odds a tool you need already has a maintained MCP server are genuinely high. Check before writing bespoke integration code.
MCP is an actively evolving standard — the July 2026 release is the largest revision since launch. Confirm current spec version and host support against modelcontextprotocol.io before building anything you depend on long-term. The 12-month deprecation policy is the new protection against surprise breaking changes, but it only applies forward from July 2026.
The protocol is the interoperability layer — which means the capability you build today travels across whatever AI tooling you use next, rather than being locked into a single product’s plugin ecosystem.
Anthropic · anthropic.com
The canonical specification and developer guide for MCP — covers the full message schema, transport options, and tool definition format.
Schick et al. · arXiv 2023
The research that established tool use as a first-class capability for language models, directly preceding the protocol standardization effort.
Brenda Jin, Saurabh Sahni & Amir Shevat · O'Reilly Media
Practical patterns for API design that translate cleanly to the server-side of MCP implementations — schema design, versioning, error handling.
Continue the conversation
If this changed how you think about it — or you think I'm wrong — I want to know.
Corrections, disagreements, and applications all welcome. Replies go directly to Chris.
Get in touch →ONE PROTOCOL
~6-8 min1× · Two speakers · tap to play