MCP — How One Company's Connector Became the Industry's Standard

MCP (Model Context Protocol) is an open standard for connecting AI applications to external tools and data sources. Anthropic released it on 25 November 2024 in three parts at once: the specification and SDKs, local server support in the Claude Desktop app, and a set of ready-made connector servers. The definition and technical outline are in the glossary entry for MCP. This page covers how a single company's protocol became shared infrastructure for the industry, competitors included, in little more than a year, and what that changed.

If you want a one-line answer to "what is MCP", it is a common socket for AI. Anthropic's announcement started from the problem that every new data source required its own custom implementation, which made connected systems hard to scale. With MCP, whoever owns a tool or a data store provides an "MCP server", and any compatible AI application can connect to it the same way.

The release of 25 November 2024

At launch Anthropic shipped servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer. It named the payments company Block and the sales-data company Apollo as early adopters, and said the developer-tool makers Zed, Replit, Codeium and Sourcegraph were working with it. The announcement quoted Block's CTO, Dhanji Prasanna: "Open technologies like the Model Context Protocol are the bridges that connect AI to real-world applications."

In the specification, MCP messages follow JSON-RPC 2.0, and servers expose resources (data), prompts and tools (operations the AI can run). The 18 June 2025 revision of the specification also defines an authorization framework for connections over HTTP.

The year competitors adopted it

The turning point was adoption by the largest competitor, OpenAI. According to TechCrunch, Sam Altman wrote on 26 March 2025 that "People love MCP and we are excited to add support across our products", making it available that day in the Agents SDK with support for the ChatGPT desktop app and the Responses API to follow. Two weeks later Demis Hassabis wrote that "MCP is a good protocol and it's rapidly becoming an open standard for the AI agentic era", and said Google's Gemini would support it. Microsoft took it into the operating system, announcing MCP as a foundation for agent communication in Windows 11.

Donation to the Agentic AI Foundation

On 9 December 2025 Anthropic donated MCP to the Agentic AI Foundation (AAIF), newly formed under the Linux Foundation. AAIF was co-founded by Anthropic, Block and OpenAI. Block's agent framework goose and AGENTS.md, a format contributed by OpenAI for giving coding agents project-specific instructions, joined as founding projects. The platinum members were AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI.

At the time of the donation Anthropic counted more than 10,000 active public MCP servers and over 97 million monthly downloads of the Python and TypeScript SDKs, and named ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code among the products that had adopted it. These are Anthropic's figures.

Moving a single company's protocol into a neutral foundation meant competitors no longer had to make their main products depend on a standard controlled by a rival. In the announcement, the Linux Foundation's Jim Zemlin pointed to the transparency and stability that open governance brings.

The danger of more tools

The further MCP spread, the clearer the risk of handing agents many tools and permissions became. On 26 May 2025 the security firm Invariant Labs showed how instructions planted in an issue on a public repository could hijack an agent connected to GitHub's MCP server and make it copy the contents of the user's private repositories into a pull request on the public one. Invariant wrote: "This is not a flaw in the GitHub MCP server code itself." The fix, it said, had to come at the level of the agent system.

In June 2025 the developer Simon Willison described a "lethal trifecta": access to private data, exposure to untrusted content and the ability to communicate externally. He noted that MCP, by encouraging users to mix and match tools from different sources, makes it easy to assemble all three without realising it. Microsoft, announcing MCP for Windows, listed cross-prompt injection (instructions hidden in documents or on-screen content), tool poisoning and credential leakage as threats, and set out mandatory code signing and per-tool user approval as countermeasures.

What changed

With MCP in place, an AI product's value came to be measured not only by how capable its model is but by how many tools and data sources it can reach. A company with internal systems can publish one MCP server and use it from several AI products. The flip side is that the responsibility for deciding what an AI may touch shifted to the people who connect it.

The best-known tools built on the protocol are Claude Code and OpenAI Codex, and a real case of misuse through MCP is on the GTG-1002 page. For the origins of the AI-agent idea see Auto-GPT, and for the wider context the AI timeline and the open-source timeline.