The Model Context Protocol (MCP) is an open standard describing how applications built around large language models exchange context, data and executable capabilities with external systems. Anthropic introduced it on 25 November 2024, publishing the specification and software development kits, adding local MCP server support to its Claude desktop application, and releasing a repository of ready-made connector servers for services including Google Drive, Slack, GitHub, Git, Postgres and Puppeteer [5]. Its stated aim is to replace bespoke per-integration glue code with a single interface that any conforming client and server can speak [1][5].
MCP draws on the Language Server Protocol, which decoupled programming-language support from individual code editors; MCP applies the same separation between AI applications and their integrations [1]. Messages are encoded as JSON-RPC 2.0 and exchanged between three roles: hosts, the LLM applications that initiate connections; clients, connectors running inside a host; and servers, the services that supply context and capabilities [1].
Within a host, each client maintains an isolated connection with exactly one server. The design keeps servers composable while preventing them from observing one another or reading the host's full conversation history, with the host enforcing those boundaries and handling user authorisation [2]. Available features are negotiated rather than assumed: clients and servers declare their capabilities during initialisation, and functionality such as resource subscriptions, tool invocation or sampling becomes usable only once the relevant party has advertised support for it [2].
Under the 2025-06-18 revision, servers may expose three kinds of primitive: resources, carrying context and data for the user or the model; prompts, templated messages and workflows aimed at users; and tools, functions the model can execute [1]. Clients may in turn offer capabilities back to servers: sampling, letting a server request a model completion; roots, communicating the filesystem or URI boundaries a server may operate within; and elicitation, letting a server ask the user for further information [1]. Supporting utilities cover progress tracking, cancellation, logging and error reporting [1].
Two transports are standardised. Under stdio, the client launches the server as a subprocess and the two exchange newline-delimited JSON-RPC messages over standard input and output, with standard error reserved for optional logging [3]. Under Streamable HTTP, the server runs as an independent process serving multiple clients from a single endpoint that accepts both POST and GET, optionally using Server-Sent Events to stream several messages back; this replaced the earlier HTTP+SSE transport of the 2024-11-05 revision [3]. Clients using HTTP identify the revision they are speaking through an MCP-Protocol-Version header carrying a dated version string such as 2025-06-18, and custom transports are permitted provided they preserve the JSON-RPC message format and lifecycle requirements [3].
The specification acknowledges that MCP opens paths to arbitrary data access and code execution, and places responsibility for safeguards on implementers, since the wire protocol cannot enforce them [1]. It sets out that users must consent to data access and to each tool invocation, that tool descriptions and annotations should be treated as untrusted unless obtained from a trusted server, that hosts should not transmit resource data elsewhere without consent, and that the protocol deliberately limits how much of a prompt a server can see when requesting sampling [1]. For HTTP deployments, servers are required to validate the Origin header to frustrate DNS rebinding attacks and are advised to bind only to localhost when running locally [3].
Protocol revisions are named for the date of their release, and a revision published on 28 July 2026 reworked the protocol considerably [4]. It removed the initialisation handshake and session identifiers in favour of a stateless request/response core, so that requests can be handled by any server instance behind a load balancer without shared storage; replaced server-initiated requests over held-open streams with multi round-trip requests, in which a server signals that further input is required and the client retries supplying it; added Mcp-Method and Mcp-Name HTTP headers so gateways can route and authorise without parsing message bodies; made list results cacheable through time-to-live and cache-scope fields; hardened authorisation by requiring RFC 9207 issuer validation and shifting from dynamic client registration towards client ID metadata documents; and formalised an extensions framework. The same revision set a minimum twelve-month window for deprecations and deprecated the roots, sampling and logging features [4].
In December 2025 the Linux Foundation announced the Agentic AI Foundation, a neutral governance body for agentic AI software. MCP was contributed by Anthropic as one of three founding projects, alongside Block's goose agent framework and OpenAI's AGENTS.md convention for AI coding agents. AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI were listed among platinum members, and the announcement reported that more than 10,000 MCP servers had been published [6].