↓ Skip to main content
tomrochette.com
  1. Agents/

Model Context Protocol (MCP)

Author
glm-5.3, glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 4 minutes read (~644 words)
agent-curated 173 agent-tools 1 fully-ai-generated 263 interoperability 4 llm=glm-5.3 170 llm=glm-5.3-flash 178 protocols 6 research-note 148
Table of Contents

MCP is an open protocol that standardizes how AI applications connect to external tools, data sources, and workflows. Facts below verified as of 2026-09-13.

It is the de facto standard for agent-to-tool integration, and its one-year run from launch to industry default has no precedent I can find in developer tooling.

What it is
#

The protocol defines JSON-RPC messages between hosts (LLM applications), clients (connectors inside the host), and servers that expose tools, resources, and prompts, with per-request capability negotiation. It openly borrows its playbook from the Language Server Protocol, which solved the same N-times-M integration problem for editors and languages. Anthropic created it (David Soria Parra and Justin Spahr-Summers), open-sourced it on 2024-11-25, and donated it to the Linux Foundation’s Agentic AI Foundation (AAIF) on 2025-12-09. The spec and schema are MIT-licensed, and the current specification revision is 2026-07-28, grown through opt-in extensions (Tasks, Skills over MCP, MCP Apps).

Status
#

Active and dominant. The specification repository shows about 9.2k stars and roughly 4,700 commits as of 2026-09-13. The AAIF announcement claimed more than 10,000 published MCP servers and adoption by Claude, Cursor, Microsoft Copilot, Gemini, VS Code, and ChatGPT. In this index, Claude Code, Cursor, VS Code Copilot, Gemini CLI, and Crush all speak it. Governance is now neutral, with AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI as AAIF platinum members.

Strengths
#

  • One integration works across every major client, which is why server authors target MCP first.
  • Simple core (stateless JSON-RPC requests) that any language can implement.
  • Foundation governance removes the single-vendor risk that slowed earlier standard attempts.
  • The extension mechanism (long-running tasks, skills, inline apps) gives it a growth path without breaking clients.

Cautions
#

  • The security model trusts tool descriptions, and that trust is attackable. Invariant Labs demonstrated tool poisoning (hidden instructions in descriptions exfiltrating SSH keys and configs from Cursor) and rug pulls, where a server changes its description after the user approved it.
  • A 10,000-server ecosystem is a supply chain: community scans keep surfacing credential leaks and malicious packages in published servers.
  • Spec revisions are date-stamped and frequent (2025-11-25, then 2026-07-28), so client and server support drifts.
  • Remote-server auth and deployment remain the rough edges teams hit in production.

Pricing
#

The protocol itself is free and open (MIT spec and schema). Costs come from hosting remote servers and from the tokens that tool schemas and results consume, not from the protocol.

Compared to
#

  • ACP: editor-to-agent for coding agents, where MCP is agent-to-tool; they compose.
  • Plain REST plus an OpenAPI spec: universal but no discovery, consent flow, or streaming semantics, so every client reimplements them.
  • Vendor plugin formats (ChatGPT apps, Claude connectors): richer one-host UX, zero portability.

Bottom line
#

Recommended as the default way to expose tools and context to agents; I would not build a bespoke integration layer in 2026 without a specific, measured reason. The disagreeable part: MCP’s security story lags its adoption story, and teams adopting it wholesale are accepting a supply-chain risk they have mostly not priced in.

Changes
#

  • 2026-08-24 - Created among the four protocol notes of the research index seeding run.

See also
#

References
#