What MCP is — the standard for plugging tools into AI, and why it gets compared to USB-C
MCP stands for Model Context Protocol, an open standard that defines how a large language model reaches external tools, files and services. It was introduced in 2024. Before it existed, every pairing of model and tool required its own integration, so adding one tool meant repeating the work once per model. MCP has both sides speak one protocol, turning that multiplication into addition. OpenAI adopted it for its agent framework in March 2025 and Google applied it to Gemini agent architecture in April 2025. In December 2025 it was transferred to the Agentic AI Foundation under the Linux Foundation
The three lines
- Definition — An open standard for how language models reach external tools, files and services
- Effect — M models times N tools becomes M plus N. That is where the USB-C comparison comes from
- Status — Adopted by OpenAI and Google; moved to a Linux Foundation body in December 2025
Key questions
- What is MCP?
- **Model Context Protocol — an open standard defining how a language model reaches external tools, files and services.** It was first published in 2024. It has three parts: an **MCP server** that exposes tools, an **MCP client** on the model side that calls them, and the **protocol** itself, the message format the two use. One clarification prevents most confusion: **MCP is not an AI model and not a product.** It is a specification, so on its own it does nothing — in the way that a plug standard does not generate electricity. The value is that once the shape is fixed, **any conforming device fits any conforming socket**, regardless of who made either one.
- Why the USB-C comparison?
- **Because it converts the number of integrations from multiplication into addition.** Before MCP, each **combination** of model and tool needed its own connector code. Three models and ten desired tools meant 3 × 10 = **30 integrations** to write and then to maintain. Adding an eleventh tool meant three more. With MCP, the model side implements a client **once** and the tool side implements a server **once**: 3 + 10 = **13**. The maintenance difference is larger than the build difference — thirty bespoke integrations have to be re-tested every time a model changes; thirteen do not. This is the same shape as the shift from device-specific charging connectors to a single standard, which is where the analogy comes from.
- Who actually uses it?
- **Both model providers and developer tools.** The timeline: **March 26, 2025**, OpenAI formally adopted MCP for its agent framework; **April 9, 2025**, Google applied it to Gemini agent architecture. Those two adoptions effectively made it the industry default, because a standard that direct competitors both implement stops being one vendor's format. On the tooling side, AI coding environments including Cursor and Cline use it. One further development matters: in **December 2025, Anthropic joined with OpenAI to establish the Agentic AI Foundation (AAIF) under the Linux Foundation and transferred MCP to it.** A standard owned by one company is one that rivals hesitate to adopt, since it could be changed to that owner's advantage. Moving it to a neutral foundation is the conventional fix.
- Does MCP let an AI read all my files?
- **Only within whatever the server permits, and this is the most practical risk area in MCP.** An MCP server defines the tools it exposes and the scope it grants. A filesystem server decides which directories are visible and whether access is read-only or read-write. So **the model sees exactly as far as the server allows and no further.** The real problem is users attaching servers without reviewing that configuration, and third-party servers of uncertain provenance are the sharpest version of it — the server's code is doing the work, and most users never read it. Academic work has concentrated on precisely this, including risk assessment frameworks for open-source MCP servers and analyses of data-flow risk in the ecosystem. In practice: **grant the narrowest scope that works**, **treat write access as a separate decision from read access**, and **do not attach servers whose origin you cannot verify.**
MCP stands for Model Context Protocol.
It is an open standard defining how a language model reaches external tools, files and services, first published in 2024.
Starting with what it is not makes the rest easier: MCP is not an AI model and not a product. It is a specification, so on its own it does nothing at all.
1. Three parts
| Part | Role |
|---|---|
| MCP server | Exposes tools — file access, search, database queries |
| MCP client | On the model side, calls those tools |
| Protocol | The message format the two share |
A plug standard does not generate electricity. The value is that once the shape is fixed, any conforming device fits any conforming socket — no matter who built either one.
2. Where the USB-C comparison comes from
Before MCP, each combination of model and tool needed its own connector code.
| Before MCP | With MCP | |
|---|---|---|
| 3 models × 10 tools | 30 integrations | 13 implementations (3 + 10) |
| Add one tool | +3 (one per model) | +1 |
| Add one model | +10 (one per tool) | +1 |
The model side implements a client once; the tool side implements a server once. After that, neither has to know about the other.
The maintenance difference is bigger than the build difference. Thirty bespoke integrations have to be re-tested every time a model updates. Thirteen do not.
3. Adoption
| Date | Event |
|---|---|
| 2024 | MCP first published |
| March 26, 2025 | OpenAI formally adopts it for its agent framework |
| April 9, 2025 | Google applies it to Gemini agent architecture |
| December 2025 | Transferred to the Agentic AI Foundation (AAIF) under the Linux Foundation |
| July 28, 2026 | Specification revised — stateless core |
The two 2025 adoptions were decisive. When direct competitors implement the same specification, it stops being one vendor's format and becomes the default.
On the tooling side, AI coding environments including Cursor and Cline use it.
4. Why it moved to a foundation
In December 2025, Anthropic joined with OpenAI to establish the Agentic AI Foundation under the Linux Foundation and transferred MCP to it.
This addresses a long-standing problem with standards.
| Ownership | Problem |
|---|---|
| Held by one company | Rivals hesitate to adopt — the spec could change to the owner's advantage |
| Held by a neutral foundation | No single party can change it unilaterally. The adoption objection disappears |
Moving to a neutral body is the conventional fix. The originator gives up control in exchange for reach.
5. The July 2026 revision — dropping state
The core of the July 28, 2026 specification change is the removal of session state.
| Before | After | |
|---|---|---|
| Connection | Maintains session state | Stateless core |
| Scaling | Must return to the same server | Horizontal scaling |
| Routing | Needed special handling | Standard HTTP routing |
Holding state means a client must keep reaching the same server. Dropping it means any request can go to any server, and adding servers directly adds throughput.
Read it as the change that takes MCP from individual developer tooling to large-scale service infrastructure.
6. Where the risk sits
MCP's most practical risk is not performance. It is permissions.
An MCP server defines its own exposed tools and access scope. A filesystem server decides which directories are visible and whether access is read-only or read-write.
So the model sees exactly as far as the server allows — no further.
The problem is attaching servers without reviewing that configuration.
| Risk | Detail |
|---|---|
| Servers of unknown origin | The server's code does the work, and users rarely read it |
| Over-broad scope | Opened wide for convenience, then forgotten |
| Write access | Unlike reads, enables actions that cannot be undone |
Three working principles:
- Grant the narrowest scope that works
- Treat write access as a separate decision from read access
- Do not attach servers whose origin you cannot verify
Academic work has concentrated here, including risk assessment frameworks for open-source MCP servers and analyses of bidirectional data-flow risk across the ecosystem.
7. Why this became urgent — agents
A chatbot does not particularly need tools. It answers questions.
An agent does. It has to read files, execute code and call external services to accomplish anything. This publication covered that distinction in "What an AI agent is — what changes when you hand it tools."
If handing over tools is the premise of an agent, then how to hand them over becomes the immediate next problem. MCP is an answer to that question.
8. Related coverage
- "What an AI agent is — what changes when you hand it tools" — agents versus chatbots
- "What Claude Code is — how it differs from asking a chatbot" — a tool-using AI in practice
- "What OpenRouter is — one key to 400 AI models" — standardization on the model side
- "What an open-source AI model is — grades of openness and how to read MoE"
9. What we could not confirm
- Adoption dates — March 26, 2025 and April 9, 2025 come from wiki-style sources, not company announcements.
- The foundation — the December 2025 AAIF founding and transfer rest on one source; exact name and participants were not confirmed.
- Compatibility — the impact of the stateless transition on existing implementations.
- Ecosystem size — the number of implementing tools and public MCP servers.
- Security guidance — the principles above reflect accepted practice, not one organization's published standard.
Sources
- Model Context Protocol — Specification (2026-07-28)
- Google Developers Blog — Scaling AI Agent Infrastructure with the MCP Stateless updates
- Namuwiki — Model Context Protocol
- S2W — What is MCP? The new future of AI agent automation
- arXiv — MCP-in-SoS: Risk assessment framework for open-source MCP servers
- arXiv — MCP-Zero: Active Tool Discovery for Autonomous LLM Agents
- arXiv — Unsafe by Flow: Uncovering Bidirectional Data-Flow Risks in MCP Ecosystem