The Model Context Protocol Standard
The Model Context Protocol, or MCP, is an open standard that lets AI assistants plug into outside tools, databases, and apps through one shared connection format instead of a custom integration for each one.
What's happening now
As of mid-2026, MCP is no longer experimental; it is treated as baseline enterprise plumbing. The official registry lists roughly 9,650 current servers (close to 29,000 counting historical versions), there are more than 15,000 GitHub repos tagged as MCP servers, and SDK downloads hit 97 million per month, a near 970x jump in about 18 months. In December 2025 Anthropic donated MCP to the new Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI and backed by Google, Microsoft, AWS, Cloudflare, and Bloomberg, so the standard is now vendor-neutral. It ships natively in Claude, ChatGPT, Gemini, Microsoft Copilot, VS Code, and Cursor. The April 2026 MCP Dev Summit in New York (about 1,200 attendees) centered on hardening for production: gateway and registry patterns from Amazon, Uber, and AWS, an emphasis on gateways, gRPC, and observability, with stateless transport attributed to the forthcoming July 2026 spec release candidate, plus MCP Apps, a new extension that turns AI replies into interactive interfaces. Per a 2026 Stacklok survey, about 41 percent of software organizations now run MCP servers in some production capacity. The flip side is security: 2026 brought large disclosures, including a systemic flaw in MCP's default local transport tied to 30-plus vulnerability reports, plus an OWASP MCP Top 10 risk list, making tool poisoning and credential exposure the dominant concerns.
What it is
Think of it as a universal adapter, like USB, but for connecting AI to the software and data it needs to actually do work. A small program called an MCP server exposes a tool (your email, a company database, GitHub) in a way any MCP-compatible AI can use right away.
The axis is whether MCP's security and governance are ready for the production scale it has already reached.
Mature enough to harden in productionMCP's security foundation is now structurally sound, built on proven IETF primitives and a converged control-plane architecture, so the remaining work is disciplined deployment rather than protocol repair.
The November 2025 spec binds MCP to OAuth 2.1, mandatory PKCE, Resource Indicators (RFC 8707) that make tokens audience-bound, and Protected Resource Metadata (RFC 9728), with token passthrough explicitly forbidden as MUST-level requirements rather than recommendations. Auth0 called the June 2025 updates a significant step forward in hardening MCP, and Aaron Parecki said the new client registration and enterprise IdP controls solve the biggest challenges that were preventing scalable adoption, replacing fragile Dynamic Client Registration with a decentralized trust model based on DNS. Real organizations run this at scale on a shared gateway-plus-registry pattern, with Uber reporting more than 1,500 monthly active agents and over 60,000 weekly executions, and a central registry screening servers against a lethal-trifecta checklist, which the camp reads as direct evidence that defensible controls already exist.
Aaron Parecki (OAuth/IETF contributor); Auth0/Okta; David Soria Parra (Anthropic MCP co-creator); Amazon/AWS; Uber Engineering; the AAIF (170-member governance org); and the eight-vendor coalition at MCP Dev Summit 2026
Security and governance are lagging deploymentMCP reached production scale as a developer convenience layer whose core protocol still cannot enforce consent, identity binding, RBAC, or tool-safety, leaving architectural attack surfaces that vendor mitigations cannot close.
The NSA warned in May 2026 that adoption has outpaced the security model, finding that MCP cannot enforce consent, privacy, and tool-safety at the protocol level, with weak access controls, absent session-to-identity binding, no RBAC, and sparse logging treated as structural gaps rather than implementation bugs. A peer-reviewed study accepted to DSN 2026 scanned 67,057 servers and found 833 vulnerable, including 18 with suspicious tool descriptions engineered to manipulate LLM reasoning, a class with no mitigation in the current spec. A documented breach timeline from April 2025 through April 2026, spanning WhatsApp and GitHub tool poisoning, a filesystem sandbox escape, a trojanized Oura clone, and an April 2026 STDIO flaw affecting more than 150 million downloads, shows these attacks recur across vendors because they are native to MCP's architecture.
Security researchers (Invariant Labs; arXiv DSN 2026 authors Li and Gao); the NSA Artificial Intelligence Security Center (May 2026 advisory); OWASP (MCP Top 10); Elastic Security Labs, Checkmarx Zero, SentinelOne, and Red Hat
The evidence leans toward governance lagging deployment: both camps agree MCP cannot enforce security at the protocol level, but only the lagging-governance side backs that shared premise with fully verified data, including a government advisory, a peer-reviewed scan of 67,057 servers, and a documented multi-vendor breach timeline, while the production-ready case rests more on best-practice deployment and vendor adoption than on protocol-level guarantees.
With about 1,200 attendees and production case studies from Amazon and Uber, the summit marked MCP's shift from a developer experiment to load-bearing enterprise infrastructure for multi-agent systems.
A flaw spanning 30-plus disclosures and tools used by over 150 million downloads shows that as MCP becomes default infrastructure, its security weaknesses become everyone's problem, the central tension of 2026.
Handing MCP to a vendor-neutral foundation co-founded by Anthropic, Block, and OpenAI, and backed by Google, Microsoft, and AWS, is what turned it from one company's project into an industry standard everyone can build on.