Model Context Protocol (MCP) is an open, vendor-neutral standard that gives AI models a universal way to connect to external tools, databases, and APIs. Released by Anthropic in November 2024 and now governed by the Linux Foundation, MCP replaces the fragile web of custom integrations that previously defined AI agent development with a single, reusable client-server protocol.
By March 2026, MCP recorded 97 million monthly SDK downloads across Python and TypeScript alone, with over 10,000 active servers running in production (Anthropic, via WorkOS, March 2026). Every major AI vendor, including OpenAI, Google DeepMind, and Microsoft, supports it. If your team is building AI-powered applications or automation workflows today, understanding MCP is no longer optional.
This guide explains what MCP is, how it works, where it applies in real product builds, what security risks it introduces, and how to get started. No academic abstractions. Pure builder context.
What Changed in 2026
MCP moved from a single-vendor experiment to the de facto AI connectivity standard in under 18 months. These are the events that define where the protocol stands today, and why builders need to factor them into architectural decisions now.
| Date | Development |
| Nov 2024 | Anthropic releases MCP as open source. Reference servers ship for GitHub, Slack, Google Drive, PostgreSQL, and Puppeteer. |
| Mar 2025 | OpenAI adopts MCP across Agents SDK and ChatGPT desktop. Monthly SDK downloads reach 22 million. |
| Apr 2025 | Google DeepMind integrates MCP into Gemini. Invariant Labs publicly demonstrates tool poisoning attacks against live MCP servers. |
| Jul 2025 | Microsoft adds MCP to Copilot Studio. Downloads hit 45 million per month. |
| Sep 2025 | First malicious MCP package appears in public registries. Supply-chain attacks confirmed as an active threat vector. |
| Nov 2025 | MCP spec updated: Streamable HTTP replaces legacy SSE transport. OAuth 2.1 becomes the authentication standard for remote servers. |
| Dec 2025 | Anthropic donates MCP to the Agentic AI Foundation (AAIF) under the Linux Foundation. Co-founded by Anthropic, Block, and OpenAI. Supported by Google, Microsoft, AWS, Cloudflare, and Bloomberg. MCP becomes vendor-neutral, community-governed infrastructure. |
| Mar 2026 | 97 million monthly SDK downloads. 10,000+ active MCP servers in production. All major AI providers on board. |
What Is Model Context Protocol (MCP)?
Model Context Protocol is an open standard that defines how AI models communicate with external systems. It uses JSON-RPC 2.0 as its communication foundation and establishes a client-server architecture that allows any MCP-compatible AI application to discover and invoke capabilities from any MCP server at runtime (modelcontextprotocol.io, 2026).
The USB-C Analogy
Before USB-C, every hardware manufacturer shipped proprietary charging connectors. A laptop, a phone, a tablet, and a camera each needed different cables. The proliferation was wasteful, fragile, and expensive. USB-C ended that by replacing hundreds of proprietary connectors with one universal standard.
The AI integration landscape before MCP was no different. Every combination of language model and external tool, whether a CRM, a database, a file store, or a communication platform, required a custom integration. Change the AI model and the connectors needed to be rewritten. Add a new tool and a new adapter had to be built. Multiply the connectors required across ten models and fifty tools and you arrive at the N x M problem.
What MCP Is Not
Three clarifications that prevent the most common misconceptions:
- MCP does not replace REST APIs. Your existing REST and GraphQL APIs continue to serve human clients and traditional software. MCP is an orchestration layer that wraps those APIs and exposes them to AI agents.
- MCP is not an LLM framework like LangChain or LangGraph. It is a transport and discovery protocol, not an agent orchestration system.
- MCP is not proprietary to Anthropic. Since December 2025, it has been governed by the Linux Foundation under the Agentic AI Foundation, with co-founders Anthropic, Block, and OpenAI.
- MCP is not limited to Claude. OpenAI, Google, and Microsoft all support it natively across their flagship AI products and developer tooling.
How MCP Works: The Architecture
MCP defines three architectural roles and three server primitives. Understanding both is the foundation of any practical MCP implementation.
The Three Roles
| Role | What It Is | Real-World Example |
| MCP Host | The AI application the user interacts with. Contains orchestration logic and manages MCP clients. | Claude Desktop, VS Code with AI Copilot, a custom agent app built on Ailoitte’s AI Velocity Pod |
| MCP Client | Lives inside the host. Maintains a 1:1 connection with one specific MCP server. Mediates all communication. | The connector module inside your app that talks exclusively to your GitHub MCP server |
| MCP Server | An external program exposing tools, resources, and prompts via a standardized interface. Local or remote. | A GitHub server exposing create_pull_request(), list_issues(), fetch_file_content() as callable tools |
The Three Server Primitives
Every MCP server exposes capabilities through exactly three building blocks, each serving a distinct function.
- Tools (Model-Controlled)
Functions the LLM can invoke to perform actions with side effects. The AI decides when and whether to call them based on user intent. Tools are the AI’s hands: they let it act on the world, not just reason about it.
- Examples: send_email(), create_support_ticket(), execute_trade(), deploy_build(), update_patient_record()
- Resources (Application-Controlled)
Data sources the application exposes to the AI for reading. They operate like GET endpoints in a REST API and carry no side effects. Resources give the AI eyes: structured context it can reason on without taking action.
- Examples: user_profile, order_history, patient_records, product_catalogue, portfolio_data
- Prompts (User-Controlled)
Pre-defined, reusable templates that standardize how the AI uses tools and resources in specific workflows. Surfaced explicitly to users, these give teams a way to codify and share high-value AI workflows.
- Examples: ‘Summarise this patient record and flag risk indicators’, ‘Analyse this portfolio for regulatory exposure’, ‘Review this pull request and suggest improvements’
The Connection Lifecycle
Every MCP interaction follows four steps:
- Initialization. The host starts and creates MCP clients. Each client performs a capability and version handshake with its assigned server.
- Discovery. The client asks each server: ‘What capabilities do you offer?’ The server responds with its complete list of tools, resources, and prompts.
- Invocation. When the LLM determines it needs a tool based on the user’s request, the host directs the appropriate client to send an invocation request to the server.
- Execution and Response. The server runs its underlying logic, which may include an external API call, a database query, or a file operation, and returns structured results. The client feeds these results back into the AI’s context loop.
Transport Layer
MCP supports two transport modes. Standard I/O handles local inter-process communication and is the default for tools like Claude Desktop. Streamable HTTP, introduced in the November 2025 spec update, enables remote cloud-hosted MCP servers and replaces legacy Server-Sent Events (SSE). Remote servers use OAuth 2.1 for authentication, which became the standard with the June 2025 spec release (modelcontextprotocol.io, 2026).
Traditional REST APIs are stateless: each request arrives without memory of the previous one. MCP sessions are stateful: the server tracks what happened earlier, enabling multi-step agent workflows. A stateless integration answers a single question. A stateful MCP integration runs a 10-step workflow where each step uses the results of the previous one.
MCP vs. Traditional APIs: What Actually Changes for Builders
MCP and traditional REST APIs share a goal: connecting software systems. They diverge significantly in how they achieve it, and for whom they are designed.
| Dimension | Traditional REST API | MCP (2026) |
| Session model | Stateless: each request is fully independent | Stateful: sessions persist across multi-step workflows |
| Tool discovery | Hardcoded endpoints; developer must know all routes in advance | Dynamic runtime discovery: AI queries capabilities at startup |
| Intended consumer | Human developers writing deterministic application code | AI agents making autonomous decisions at runtime |
| Integration effort | Custom connector per LLM-tool pair (N x M problem) | Build once per tool; every MCP client connects automatically |
| Context handling | Developer manages session state manually | Built-in session history and context management in the protocol |
| Error semantics | HTTP status codes; generic patterns | Structured, semantic feedback optimized for LLM reasoning |
| Auth model | API keys or custom OAuth implementation | OAuth 2.1 standardized across all remote servers (Jun 2025 spec) |
| Streaming | Custom SSE or WebSocket implementation required | Native streaming semantics in the protocol |
The Critical Nuance: MCP Wraps APIs, It Does Not Replace Them
This is the most important thing to get right when evaluating MCP. Your existing REST and GraphQL APIs continue to serve human clients, traditional software, and third-party integrations. MCP is the orchestration layer that wraps those APIs and makes them accessible to AI agents.
Think of it this way: your REST API is the plumbing. MCP is the smart valve system that lets an AI agent decide which pipes to open, when, and in what sequence. The plumbing does not change. The AI gains the ability to control it intelligently.
When to Use Which
- Use MCP when building AI agent workflows that need to discover and invoke tools dynamically at runtime.
- Use MCP when multi-step, stateful AI tasks span multiple backend systems.
- Use MCP when future-proofing against new AI models matters: a new model connects to all your MCP servers automatically.
- Use REST when building fixed, deterministic integrations between software systems that do not involve AI agents.
- Use both in production: REST for service-to-service communication, MCP as a lightweight wrapper that makes those services accessible to AI.
For a detailed performance data comparison between MCP and traditional API connectors, see our companion analysis: MCP vs Traditional API Connectors.
The MCP Ecosystem in 2026
MCP is the fastest-adopted developer connectivity protocol in recent AI infrastructure history. The numbers illustrate the scale of this standardisation event:
| 97M+ | 10,000+ | 500+ | 5 |
| Monthly SDK Downloads (Mar 2026) | Active Production MCP Servers | Public Server Implementations | Official SDK Languages |
Official SDKs exist for TypeScript/JavaScript, Python, Java, C#/.NET, and Swift. Major platforms with available MCP servers include GitHub, Slack, Google Drive, PostgreSQL, Notion, Jira, and Salesforce, among hundreds of others.
Governance: Why the Linux Foundation Matters
In December 2025, Anthropic donated MCP to the Agentic AI Foundation (AAIF) under the Linux Foundation. The AAIF was co-founded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, Cloudflare, and Bloomberg. This governance transfer has one practical consequence for builders: MCP is no longer a bet on a single vendor. It is a community-governed standard with the same institutional backing as Linux, Kubernetes, and Node.js.
MCP and A2A: Two Complementary Protocols
MCP defines how individual agents interact with tools. Google’s Agent-to-Agent protocol (A2A), released in April 2025 and also contributed to the AAIF, defines how agents communicate with each other. In production multi-agent systems, the two work together: MCP handles tool and data connectivity for each individual agent; A2A handles task delegation and result sharing between agents.
Real-World Use Cases by Industry
MCP’s value changes shape by industry, but the structural benefit is constant: AI agents that previously needed a custom connector per tool can now access any MCP-compliant system through a single protocol. The following use cases illustrate what that means in practice.
Fintech and Financial Services
AI in financial services requires simultaneous access to real-time market data, risk models, regulatory filings, and customer portfolios. Previously, each data source required a custom connector, rebuilt every time the underlying AI model changed.
Block, the fintech company behind Square and Cash App, built an internal AI agent called Goose that runs on MCP, connecting AI assistants to internal tools and financial databases with standard access controls (Block Engineering Blog, 2025 ). For product builders in the fintech space, MCP enables AI systems to interact with live portfolio data as Resources and execute compliance reports or trades as Tools, all within a single stateful session governed by OAuth 2.1.
Healthcare and Clinical Systems
Healthcare is where MCP’s permissioned architecture matters most. A physician reviewing a patient before an appointment needs AI that can access lab results, clinical history, prescribed medications, and appointment records simultaneously, without any data leaving the approved environment.
MCP’s Resource primitive enables read-only access to patient data with no side effects. Its Tool primitive enables write operations, such as flagging a risk or scheduling a follow-up, under explicit permission controls. Every invocation is loggable and auditable. For healthtech builders, this aligns directly with HIPAA’s minimum necessary access standard.
Ailoitte delivers healthcare applications under HIPAA Ready deployment patterns. Our MCP integration work for healthtech clients applies tool permission controls as an architectural baseline, not a post-deployment addition.
E-Commerce and Retail
An AI agent serving an e-commerce platform needs to check inventory, update pricing dynamically, process return requests, and personalise recommendations, often within a single customer interaction. Before MCP, each of those four operations required a separate connector built per AI model.
With MCP, a single agent session connects to inventory, order management, pricing, and returns MCP servers simultaneously. The AI can read stock levels as Resources and act on them via Tools: adjusting prices, triggering restocking, or initiating return workflows automatically.
Enterprise Developer Tooling
AI coding assistants that need access to GitHub, Jira, Slack, PostgreSQL, and Notion represent the highest-volume MCP use case as of 2026. One documented production migration reduced integration surface from 47 custom API adapters to 6 MCP servers, with new tool deployment time dropping from three days to eleven minutes (Essa Mamdani, 2026 — ).
This result is reproducible. Every custom adapter that gets replaced by an MCP server is a maintenance obligation that disappears.
Mobile App Development: The Builder’s Perspective
This is the use case most directly relevant to teams working with Ailoitte. Modern mobile apps increasingly ship with AI-powered features: smart recommendations, context-aware assistants, dynamic pricing, predictive onboarding, real-time support escalation. Each of those features needs to reach backend systems. Before MCP, each feature required a custom backend integration.
With MCP-native architecture:
- Backend intelligence becomes reusable. MCP servers exposing your app’s business logic, user history, purchase records, and in-app behavior serve every AI feature in the application, not just the one they were built for.
- Feature delivery accelerates. New AI features inherit the existing MCP capability surface automatically. No new connector, no new adapter, no new sprint ticket for integration work.
- Cross-platform context becomes achievable. MCP Resources shared across iOS, Android, and web surfaces allow users to start an AI workflow on mobile and continue it on desktop without losing their session state.
- Model changes stop being rebuilds. Switching or upgrading the underlying AI model does not require rewriting integrations. The MCP servers stay. Only the host application’s model reference changes.
Security: What Builders Cannot Ignore
MCP’s specification states explicitly that the protocol cannot enforce security principles at the protocol level. Security is entirely the builder’s responsibility. Most teams deploying MCP in early 2025 treated this as a secondary concern. The consequences were documented quickly.
The OWASP MCP Top 10
OWASP published the first formal classification of MCP attack vectors in 2025. Key categories include prompt injection via malicious tool outputs, excessive tool permissions enabling privilege escalation, insecure tool descriptions enabling tool poisoning, missing audit logging preventing forensic response, and supply-chain compromise via unvetted third-party servers (OWASP, 2025).
The Production Security Baseline
| Control | What to Implement | Why It Matters |
| Authentication | OAuth 2.1 on all remote MCP servers. Never deploy unauthenticated to any non-local environment. | Prevents unauthorized tool invocations. CVE-2025-49596 resulted from missing auth. |
| Tool Allowlisting | Define explicit allowlists. Reject any tool invocation not on the pre-approved list. | Blocks tool poisoning attacks and permission escalation. |
| Input/Output Validation | Validate all parameters entering MCP tools. Sanitise all results returned. | Stops prompt injection from propagating through the context loop. |
| Audit Logging | Log every tool invocation: tool name, parameters, caller identity, timestamp. | Enables forensics, compliance reporting, and anomaly detection. |
| Server Vetting | Use only first-party or verified community servers. Pin versions explicitly. | Prevents silent dependency replacement via typosquatted packages. |
| Minimal Permissions | Each MCP server holds credentials only for the systems its tools explicitly require. | Limits blast radius of any server compromise to the minimum necessary scope. |
Getting Started: A Practical Builder’s Roadmap
MCP has official SDKs in five languages as of 2026: TypeScript/JavaScript, Python, Java, C#/.NET, and Swift. TypeScript has the broadest community ecosystem and the most reference server implementations. Python is the second most active, particularly for data-intensive server builds.
The Architecture Decision Before Day One
Before installing any SDK, design your capability surface. Answer three questions:
- Which backend systems or data sources need to be Resources (read-only context for the AI to reason on)?
- Which operations need to be Tools (actions the AI can take, with real-world consequences)?
- Which recurring workflows should be standardized as Prompts (reusable templates for specific AI tasks)?
This mapping, done carefully before any code is written, eliminates the single most common source of MCP rework: discovering mid-sprint that a capability was designed incorrectly for its actual use.
A Practical 7-Day Start
| Days | Task | Expected Outcome |
| 1-2 | Install the MCP SDK for your primary language. Connect Claude Desktop or a test host to one reference server (GitHub or PostgreSQL). Study the discovery and invocation flow. | Working understanding of host-client-server communication and the capability surface response. |
| 3-5 | Build a minimal custom MCP server for one internal system: your product database, a CRM, or one internal API. Expose two Resources and two Tools. | First live integration between an AI host and your own production system. |
| 6 | Add a second MCP server. Write a Prompt that sequences tool invocations from both servers. | Experience of multi-server, multi-step workflows and context chaining across systems. |
| 7 | Security review: add OAuth 2.1 on the server, implement tool allowlisting, and add invocation audit logging. | Production-ready security baseline that meets the minimum requirements for any non-local deployment. |
Common Mistakes to Avoid
- Building MCP servers before mapping the capability surface. Design first, code second.
- Deploying remote MCP servers without OAuth 2.1 authentication. CVE-2025-49596 exists because teams skipped this step.
- Using MCP for stateless, single-call operations where REST is the correct tool.
- Using unvetted third-party MCP servers in production without version pinning or independent security review.
- Treating an MCP server as a replacement for your existing API layer rather than a wrapper around it.
For teams building MCP-native products from scratch, Ailoitte’s AI Velocity Pods include MCP-native architecture as a standard delivery pattern, with capability surface design, security baseline, and cross-system integration delivered as a single fixed-price outcome.
The Road Ahead: MCP in 2026 and Beyond
The official 2026 MCP roadmap, published by lead maintainer David Soria Parra in March 2026, identifies four priorities: transport scalability (stateless session management for horizontal scaling), agent communication (MCP and A2A composability), governance maturation (enterprise registry, namespace trust, tool-safety review), and enterprise readiness (OAuth flows, hosted server reliability, observability tooling) (modelcontextprotocol.io Blog, March 2026).
Stateless Operation: The Scaling Unlock
The biggest scaling bottleneck in current MCP deployments is session state. Today, each MCP server must maintain session state, which prevents horizontal scaling behind load balancers. The forthcoming spec update standardizes session creation, resumption, and migration, making server restarts and scale-out events transparent to connected clients. For builders deploying MCP in cloud-native environments, this removes the last major scaling constraint for high-volume AI agent workloads.
Enterprise Registry and Governance
Enterprise teams adopting MCP at scale are demanding centralized, auditable registries: curated repositories of approved, vetted MCP servers with namespace trust, version management, and tool-safety review before write access is granted. This is the same governance maturity that Kubernetes and npm eventually had to build. MCP is building it now, proactively.
The Long-Range View
By 2027, ‘Does it have an MCP server?’ is expected to become a standard enterprise procurement question before any SaaS software purchase. By 2028, MCP servers are projected to ship inside software products themselves, requiring no separate installation.
For builders, this trajectory has one clear implication: products that ship with MCP servers today have a structural advantage that compounds over time. The teams that design for MCP-native architecture now will be the ones whose products are AI-agent-accessible when the market expects it as standard.
Ailoitte’s AI Transformation team monitors each MCP spec release and updates architecture recommendations accordingly. If you are evaluating how MCP fits into your existing stack or planning a new AI-native product build, our team is the right starting point.
How Ailoitte Builds MCP-Native Products
Ailoitte’s AI development services and mobile app development teams treat MCP as a standard architectural component for any product where AI needs to interact with more than two data systems or business logic layers. Here is how that works in practice.
Capability Surface Before Code
Before any integration code is written, we map the complete set of Resources, Tools, and Prompts the AI will need across every backend system in scope. This prevents the most common MCP rework scenario: discovering mid-sprint that a capability was architected as a Tool when it should have been a Resource, or that a business-critical workflow was never codified as a Prompt.
Security by Architecture
OAuth 2.1, tool allowlisting, and invocation audit logging are delivery requirements on every MCP deployment, not post-launch checkboxes. Our ISO 27001, SOC 2 Type II, and HIPAA Ready certifications reflect the standards we hold ourselves to on every project, regardless of client size or industry.
MCP-Native AI Velocity Pods
Our AI Velocity Pods operate on fixed-price, outcome-based delivery. For agentic product builds, MCP-native architecture is now part of the standard delivery pattern. When each new tool is one server connection rather than a custom connector, pods deliver faster, with less integration rework per sprint. This is the structural reason why our pods ship at 5x the velocity of traditional agency engagements.
Cross-Platform Context Design
For mobile products, we design MCP Resources to persist session context across iOS, Android, and web surfaces. A user who starts an AI workflow on mobile and continues it on desktop does not lose their session or their context. This is not a post-launch feature; it is an architectural decision made in the first sprint.
Across more than 300 products delivered in 21 countries, the AI integration decisions made in the first two sprints determine total cost of ownership for the next three years. Teams that build MCP-native from the start spend those three years shipping features. Teams that retrofit it spend those years re-architecting.
Conclusion
Model Context Protocol is infrastructure, not a trend. The adoption curve from 2 million monthly downloads in November 2024 to 97 million in March 2026, backed by every major AI vendor and governed by the Linux Foundation, represents one of the fastest standardisation events in developer tooling history.
For builders, the practical implication is direct. AI agents that cannot access real-world tools and data are chatbots. MCP is the protocol that closes the gap between reasoning and action. Teams that design for MCP-native architecture from the ground up will spend the next three years shipping features. Teams that keep building custom connectors will spend those years maintaining glue code.
The window to build MCP-native from the start remains open, but it is closing as the ecosystem hardens around this standard. If you are planning an AI-powered product, retrofitting AI into an existing application, or evaluating whether your current integration architecture will scale with your AI roadmap, the architecture decisions you make in the next sprint matter more than any decision you make in the next quarter.
Ready to build MCP-native? Ailoitte’s AI Velocity Pods deliver production-ready AI products with MCP-native architecture.
FAQs
What is Model Context Protocol in simple terms?
MCP is an open standard that gives AI models a universal way to connect to external tools, databases, and services. Instead of writing custom integration code for every AI model-tool combination, developers expose capabilities through MCP servers once. Any MCP-compatible AI application connects to them automatically, without additional integration work per new model.
Who created MCP, and who governs it now?
Anthropic created and open-sourced MCP in November 2024. In December 2025, Anthropic donated it to the Agentic AI Foundation (AAIF) under the Linux Foundation. The AAIF is co-founded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, Cloudflare, and Bloomberg. MCP is now a vendor-neutral, community-governed protocol with long-term institutional backing.
Is MCP only for Claude and Anthropic products?
No. OpenAI adopted MCP in March 2025 across its Agents SDK and ChatGPT desktop application. Google DeepMind integrated it into Gemini in April 2025. Microsoft added MCP to Copilot Studio in July 2025. Any application implementing the MCP client specification, regardless of the underlying AI model, can connect to any MCP server.
Does MCP replace REST APIs?
No. REST APIs continue to serve human clients and traditional software. MCP is an orchestration layer that wraps existing APIs and makes them accessible to AI agents. In most production architectures, both coexist: REST for service-to-service communication, MCP as the interface layer for AI agent tool access
Is MCP secure enough for regulated industries like healthcare and finance?
MCP does not enforce security at the protocol level. Security is the builder’s responsibility. With proper implementation including OAuth 2.1 authentication, tool allowlisting, input and output validation, audit logging, and minimal permission design, MCP can meet enterprise and regulated-industry requirements. Ailoitte deploys MCP under ISO 27001, SOC 2 Type II, and HIPAA Ready standards for all applicable client engagements.
Discover how Ailoitte AI keeps you ahead of risk
Brijesh Kumar
Brijesh is a Marketing Strategist specializing in future-ready growth frameworks, product positioning, and data-driven acquisition strategies for startups and fast-growing tech brands.
Stephan is the sports journalist for the Maple Grove Report.
