Anthropic launched the Model Context Protocol in November 2024 with a straightforward pitch: give AI models a standard way to connect to external tools and data sources. No bespoke integrations for every new app. One open protocol, universal connectors.
Sixteen months later, MCP is sitting at 97 million monthly SDK downloads across Python and TypeScript. It is running inside ChatGPT, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code. OpenAI, Google, Microsoft, AWS, and Cloudflare are all shipping MCP-compatible tooling. The Linux Foundation is now governing it through something called the Agentic AI Foundation, co-founded by Anthropic, OpenAI, and Block.
One company proposed a standard. The whole industry fell in line. That doesn’t happen often, and when it does, it’s worth paying attention to why.
What MCP Actually Does
The protocol itself is not glamorous. MCP defines a client/server architecture where AI applications (clients) connect to tool providers (servers) through a standardized interface. The server exposes tools, data, and prompts in a structured format. The client, which is the AI model, reads those definitions and uses them to take action.
Before MCP, every AI application that wanted to connect to, say, a GitHub repo or a database needed its own custom integration layer. Multiply that by every tool a developer wants to use, and you end up with an explosion of one-off glue code that nobody wants to maintain. Google Cloud’s own documentation compares MCP to USB-C: one port, everything plugs in.
That framing is a little too clean, but it captures the core value. Standardization reduces friction. Friction reduction accelerates adoption.
How Fast This Moved
The growth curve here is genuinely unusual. SDK downloads were roughly 100,000 in November 2024. By April 2025, that number had crossed 8 million. By March 2026, it hit 97 million. That’s not organic curiosity driving numbers. That’s a sequence of deliberate decisions by the people who control AI infrastructure.
OpenAI adopted MCP in March 2025, integrating it across the Agents SDK, Responses API, and ChatGPT desktop. Google DeepMind confirmed Gemini support in April 2025. Microsoft followed in July 2025. AWS in November 2025. And then in December 2025, Anthropic handed governance to the Linux Foundation through the newly formed Agentic AI Foundation.
When you look at that sequence, it reads less like organic adoption and more like a coordinated recognition that the protocol wars were settled. Everyone picked a side and it was Anthropic’s side.
Today the ecosystem has more than 10,000 public MCP servers, over 300 MCP clients, and 72% of developers who have adopted it say they plan to expand usage. Claude alone offers 75+ connectors powered by MCP.
The Lock-in Question Nobody Wants to Answer Directly
Here’s the tension that everyone in this space is careful to talk around. Anthropic invented MCP. Anthropic’s products run on MCP. When the entire industry builds on a standard one company created, that company carries structural advantages even after handing the project to a foundation.
To be fair to Anthropic, donating to the Linux Foundation was a real move. Linux Foundation governance is not theater. MCP joins a credible track record of neutral open-source stewardship. The AAIF’s co-founders include OpenAI and Block, with Google, Microsoft, AWS, Cloudflare, and Bloomberg all supporting. That’s a genuine multi-stakeholder structure.
But StackOne’s production analysis raises a more practical concern: MCP still has real gaps. Multi-tenancy, admin controls, context-aware discovery, real-time notifications. These are not edge cases. They’re enterprise blockers. The argument from practitioners is that foundation governance could slow down exactly the kind of iterative work needed to close those gaps.
The companies building on MCP are betting that a Anthropic-adjacent standard, now held by a neutral body, will evolve faster and more safely than any alternative they could build internally. That’s probably the right bet. But it’s still a bet.
The Security Problem Nobody Solved Before Shipping
Ninety-seven million installs spread fast enough that the attack surface expanded before anyone could properly think through what they were exposing. The security research tells a messy story.
Simon Willison documented prompt injection vulnerabilities in MCP as early as April 2025, noting that the protocol’s core architecture creates a category of attack where malicious instructions embedded in tool metadata can be read by the AI model but not visible to the user.
The incidents that followed were not theoretical. Invariant Labs demonstrated that a malicious MCP server could silently pull a user’s entire WhatsApp message history by poisoning tool definitions. JFrog disclosed CVE-2025-6514, a critical command injection vulnerability in mcp-remote, a widely used OAuth proxy with over 437,000 downloads. The official GitHub MCP server was shown to be vulnerable to attacks where a malicious public GitHub issue could hijack an agent and exfiltrate data from private repositories.
The underlying structural problem, as Red Hat’s security team describes it, is that MCP servers hold authentication tokens for multiple services. Compromise one, and you potentially have access to everything it connects to. And because MCP tooling can be built by anyone without security review, the community-built ecosystem expands the attack surface faster than security teams can track it.
This is not a reason to avoid MCP. It’s a reason to watch it closely and not treat 97 million installs as validation that the hard problems are solved.
Why It Won
The honest answer is that MCP won because the problem it solved was real and the timing was right. Every company shipping AI agents in 2025 needed a way to connect those agents to tools and data. Building custom integrations for every connection is expensive. Using a standard that the whole ecosystem supports is cheap.
Anthropic released MCP open-source with SDKs for Python and TypeScript, which meant developers could start building immediately without waiting for anyone’s permission. By the time OpenAI and Google adopted it, there was already enough ecosystem momentum that rejecting MCP would have cost more than joining it.
The New Stack’s analysis frames it this way: MCP succeeded because it solved a coordination problem at exactly the moment when coordination was more valuable than differentiation.
That’s a structural explanation, not a technical one. MCP won the protocol war not because it’s the theoretically optimal solution but because it got to critical mass before any alternative did.
Whether the gaps get closed, whether the security posture matures, whether foundation governance accelerates or stalls development, those are the actual questions for 2026. The protocol question is settled.
Who’s Building on This and Whether They Should Be Worried
The 10,000+ MCP servers and 300+ clients that now exist are not abstractions. They are companies. Startups. Developer tools. People building their businesses on top of a protocol that is 16 months old and just got its first real governance structure.
Some of them are doing genuinely interesting work. qBraid built a distributed quantum compiler on MCP. StackOne is running MCP in production for enterprise integrations and publishing the most honest criticism of what’s missing. Invariant Labs is stress-testing the security model by demonstrating what happens when you don’t.
These are the people who will determine whether MCP becomes a reliable standard or a liability at scale. They are also the people whose work is not getting covered. The press cycle around MCP has been dominated by Anthropic, OpenAI, and Google adoption announcements. The builders in the middle, the ones actually pushing the protocol’s limits and finding the breaks, are the story that matters now. The protocol war is over. The infrastructure war just started.