Start a project
Practice Reviewed 24 Sep 2026 · 18 sources

Model Context Protocol

MCP /ˈmɑ.dəl ˈkɑnˌtɛkst ˈproʊ.təˌkɔl/ noun
Definition

An open standard that defines how AI applications connect to outside tools, data and services, so one connector built as a server works with any compatible application.

Examples
  • A filesystem server that lets Claude Desktop read local files
  • The Sentry server, which brings error reports into Visual Studio Code
  • A Figma server that hands a design to Claude Code
  • A database server a company chatbot queries in plain language
An AI assistant connects through one standard socket to three servers labeled calendar, database and code. A dashed tangle of custom cables beside it is crossed out.
Inkling · One standard plug in place of a custom cable for each toolFig. M1
Coined by
Anthropic
Built by engineers David Soria Parra and Justin Spahr-Summers.
Earliest AI use
2024
Anthropic open-sources the protocol on 25 November, with SDKs.
Current meaning
2025
An industry standard, donated to a Linux Foundation fund in December.
§01

In plain words

The Model Context Protocol (MCP) is an open standard, launched by Anthropic in 2024, that lets AI applications connect to outside tools and data.

A large language model can only work with what is put in front of it. To read a calendar, open a file or query a database, the application around the model needs a connector to each system. Before MCP, each connector was custom work, and every new data source needed its own.1

MCP replaces those one-off connectors with shared rules. A company wraps its system once as an MCP server, and any application that follows the protocol can use it. The official documentation compares MCP to a USB-C port: one kind of socket for many devices.2

Anthropic released MCP as open source in November 2024. Within about a year, rival products had adopted it. By December 2025 Anthropic counted more than 10,000 active public servers, with support in ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code.3 That month Anthropic handed the protocol to a foundation run under the Linux Foundation.

The protocol matters most for AI agents, systems that take actions for a person. It gives an agent a standard way to reach business data and act on it. Security researchers have shown how that access can be abused.

MCP is often confused with tool use, also called function calling. Tool use is the model’s ability to ask for a function to be run. MCP is the standard way for an application to find those functions on other systems and pass the requests along.

§02

How it works

MCP defines three roles. The host is the application a person uses, such as a chat app or a code editor. Inside it, a client keeps one connection to each server. A server is a program that offers capabilities to the host. Clients and servers exchange messages in JSON-RPC 2.0, a simple text format for requests and replies. The design borrows from the Language Server Protocol, which lets code editors support many programming languages.4

A server can offer tools the model can run, resources such as files or records, and prompts, which are reusable message templates. The host gathers the names and descriptions of the tools from its servers and shows them to the model. When the model asks for a tool, the host sends the request to the right server and passes the result back.

Servers can run on the user’s own computer or on the internet. Since the July 2026 revision, each request carries its own protocol version and capabilities, so any copy of a remote server can answer it.

Safety is left to the software that implements the protocol. The specification says the host must ask the user before running any tool, but MCP cannot enforce this itself.5 Because the model reads each tool’s description, a hostile server can hide instructions there, a form of prompt injection. Simon Willison calls one dangerous mix the “lethal trifecta”: private data, untrusted content and a way to send data out.6

§03

Origin and first known use

The name joins three ordinary words. Model means a language model, context is the information the model is given, and protocol is a set of rules for exchanging messages. Anthropic engineers David Soria Parra and Justin Spahr-Summers built the protocol in 2024. Anthropic introduced the name and the abbreviation MCP on 25 November 2024. Its design borrows from the Language Server Protocol, a standard that lets code editors support many programming languages.

  1. 2024 Anthropic engineer David Soria Parra, tired of copying text between Claude Desktop and his code editor, pitches a protocol; he builds it with Justin Spahr-Summers.
    Gergely Orosz, “MCP Protocol: a new AI dev tools building block”, The Pragmatic Engineer, 8 Apr 2025 newsletter.pragmaticengineer.com →: source for 2024
  2. 2024 Anthropic open-sources MCP with a specification, SDKs, local server support in Claude Desktop and a repository of ready-made servers.
    Anthropic, “Introducing the Model Context Protocol”, 25 Nov 2024 anthropic.com →: source for 2024
  3. 2025 OpenAI adds MCP to its Agents SDK in March, then support for remote MCP servers to its Responses API in May, and joins the MCP steering committee.
    OpenAI, “New tools and features in the Responses API”, 21 May 2025 openai.com →: source for 2025
  4. 2025 Invariant Labs shows “tool poisoning”: in a test, instructions hidden in an MCP tool’s description make Cursor’s agent send a user’s SSH keys to an attacker.
    Luca Beurer-Kellner and Marc Fischer, “MCP Security Notification: Tool Poisoning Attacks”, Invariant Labs, 1 Apr 2025 invariantlabs.ai →: source for 2025
  5. 2025 At its Build conference, Microsoft announces native MCP support in Windows 11, with a registry of servers that agents can use.
    Microsoft, “Advancing Windows for AI development: New platform capabilities and tools introduced at Build 2025”, Windows Developer Blog, 19 May 2025 blogs.windows.com →: source for 2025
  6. 2025 Anthropic donates MCP to the new Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI.
    Linux Foundation, “Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF)…”, press release, 9 Dec 2025 linuxfoundation.org →: source for 2025
  7. 2026 Specification revision 2026-07-28 makes the protocol stateless: the opening handshake is retired and every request describes itself.
    David Soria Parra and Den Delimarsky, “The 2026-07-28 Specification”, MCP blog, 28 Jul 2026 blog.modelcontextprotocol.io →: source for 2026
  8. 2026 The Agent2Agent protocol, which Google launched in 2025 for agents that find and delegate work to other agents, joins MCP in the Agentic AI Foundation.
    Agentic AI Foundation, “A2A joins AAIF’s open agentic stack”, 17 Aug 2026 aaif.io →: source for 2026
§04

In the wild

10 sightings · 2024–2026 · oldest first
  1. Blog25 Nov 2024

    “Today, we’re open-sourcing the Model Context Protocol (MCP), a new standard for connecting AI assistants to the systems where data lives…”

    Anthropic, product announcement anthropic.com →: Anthropic, product announcement, 25 Nov 2024Archived →: copy of Anthropic, product announcement, 25 Nov 2024
  2. Headline26 Mar 2025

    “OpenAI adopts rival Anthropic’s standard for connecting AI models to data”

    TechCrunch techcrunch.com →: TechCrunch, 26 Mar 2025Archived →: copy of TechCrunch, 26 Mar 2025
  3. Paper30 Mar 2025

    “The Model Context Protocol (MCP) is an emerging open standard that defines a unified, bi-directional communication and dynamic discovery protocol…”

    Hou et al., arXiv arXiv 2503.23278 →: Hou et al., arXiv, 30 Mar 2025Archived →: copy of Hou et al., arXiv, 30 Mar 2025
  4. Blog1 Apr 2025

    “The attack is not limited to Cursor… it can be replicated with any MCP client that does not properly validate or display tool descriptions.”

    Luca Beurer-Kellner and Marc Fischer, Invariant Labs blog invariantlabs.ai →: Luca Beurer-Kellner and Marc Fischer, Invariant Labs blog, 1 Apr 2025Archived →: copy of Luca Beurer-Kellner and Marc Fischer, Invariant Labs blog, 1 Apr 2025
  5. Blog9 Apr 2025

    “A2A is an open protocol that complements Anthropic’s Model Context Protocol (MCP), which provides helpful tools and context to agents.”

    Google, Agent2Agent announcement developers.googleblog.com →: Google, Agent2Agent announcement, 9 Apr 2025Archived →: copy of Google, Agent2Agent announcement, 9 Apr 2025
  6. Blog9 Apr 2025

    “The big challenge here is that these vulnerabilities are not inherent to the MCP protocol itself…”

    Simon Willison, on his blog simonwillison.net →: Simon Willison, on his blog, 9 Apr 2025Archived →: copy of Simon Willison, on his blog, 9 Apr 2025
  7. Blog19 May 2025

    “MCP integration with Windows will offer a standardized framework for AI agents to connect with native Windows apps…”

    Microsoft, Windows Developer Blog blogs.windows.com →: Microsoft, Windows Developer Blog, 19 May 2025Archived →: copy of Microsoft, Windows Developer Blog, 19 May 2025
  8. Blog21 May 2025

    “In order to best support the ecosystem and contribute to this developing standard, OpenAI has also joined the steering committee for MCP.”

    OpenAI, product announcement openai.com →: OpenAI, product announcement, 21 May 2025Archived →: copy of OpenAI, product announcement, 21 May 2025
  9. Docs28 Jul 2026

    “Model Context Protocol (MCP) is an open protocol that enables seamless integration between LLM applications and external data sources and tools.”

    MCP specification, revision 2026-07-28 modelcontextprotocol.io →: MCP specification, revision 2026-07-28, 28 Jul 2026Archived →: copy of MCP specification, revision 2026-07-28, 28 Jul 2026
  10. Headline28 Jul 2026

    “MCP just got its biggest update ever — here’s what changes for AI agents”

    VentureBeat venturebeat.com →: VentureBeat, 28 Jul 2026
§05

Not to be confused with

  • Tool use

    Tool use, or function calling, is a model’s ability to ask for a described function to run. MCP is the protocol for finding and calling such functions on separate servers. A model can use tools without MCP.

    See tool use →

  • An ordinary API

    An API is one service’s own interface, so each application needs a custom connector for it. An MCP server wraps a service once in a shared format that any compatible AI application can use.

  • Agent2Agent (A2A)

    A2A, launched by Google in 2025, standardizes how independent agents discover each other and hand off tasks. MCP standardizes how one agent reaches tools and data. Google presented the two as complementary.

  • ChatGPT plugins

    OpenAI’s 2023 plugins were built for one product: a developer described a web API in an OpenAPI file so ChatGPT could call it. MCP is an open protocol that many applications and model makers support.

§06

Questions

  • What is an MCP server?

    An MCP server is a program that offers tools, data and prompt templates to AI applications in the format the protocol defines. It can run on the user’s own computer, as the first servers for Claude Desktop did. It can also run remotely on the internet, like the servers that OpenAI’s Responses API connects to. Once a service is wrapped as a server, any compatible application can use it.

  • Who owns the Model Context Protocol?

    Anthropic created MCP and released it as open source in November 2024. In December 2025 it donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. OpenAI, Google and Microsoft all support MCP in their products. The current revision of the specification is dated 28 July 2026.

  • Is MCP safe to use?

    Its safety depends on the servers a person installs and on the host application. The specification says the host must ask the user before running any tool, but the protocol cannot enforce that. Researchers have shown a malicious server hiding instructions in a tool description to steal SSH keys. Simon Willison argues the weakness is not inherent to MCP itself. He warns against agents that combine private data, untrusted content and a way to send data out.

  • What is the difference between MCP and function calling?

    Function calling, also called tool use, is a model’s ability to ask the surrounding application to run a named function with specific inputs. MCP works one layer out. It standardizes how the application finds functions offered by separate servers and passes each call to the right one. A model can call tools without MCP, but MCP lets one set of tools serve many applications.

  • How is MCP different from Google’s A2A protocol?

    Google’s Agent2Agent protocol, announced in April 2025, is for agents that need to find other agents and delegate work to them. MCP connects a single agent or application to tools, data and services. Google described A2A as complementing MCP, and in August 2026 A2A joined MCP in the Agentic AI Foundation, the Linux Foundation fund that hosts both.

§07

Watch

§09

Cite this entry

“Model Context Protocol.” SUPERR_dictionary, Superrduperr, 24 Sept. 2026, superrduperr.com/dictionary/model-context-protocol.

First published 24 Sep 2026 · Last reviewed 24 Sep 2026 · Report an error →