What Is MCP? The Model Context Protocol Explained for Enterprise Teams

MCP (Model Context Protocol) is an open standard that lets AI applications connect to outside tools and data through one common interface. You wrap a system once as an MCP server. Any app that speaks MCP, such as ChatGPT, Claude, Cursor, or VS Code, can then discover its tools and call them.

Anthropic launched MCP in 2024, and the Linux Foundation hosts it now. The current spec, the 2026-07-28 revision, changed how it works on the wire. If an explainer describes an initialize handshake or an Mcp-Session-Id header, it describes the older protocol.

What is MCP, in plain terms?

Anthropic introduced MCP in November 2024 to fix a specific problem. Its launch post said models were “constrained by their isolation from data” and that “every new data source requires its own custom implementation.”

That is an N x M problem. Here is an illustration, not a measurement. Five AI apps and ten internal systems need up to 50 custom connectors if each pair is built separately. With a shared protocol, you build ten servers and five clients: 15 components. Each new system then adds one server instead of five connectors.

The 2026-07-28 specification says MCP takes inspiration from the Language Server Protocol, which standardized how code editors support programming languages. MCP does the same for tools and context. The architecture overview is just as clear about the limits. MCP “focuses solely on the protocol for context exchange” and “does not dictate how AI applications use LLMs or manage the provided context.”

So MCP is not a model, an agent framework, or a security product. It is a contract for how an app asks a system “what can you do?” and then asks it to do one of those things. The model, the prompts, the approval rules, and the business logic stay with you. MCP removes connector work. It does not decide what an agent may touch or who approves risky actions.

How does the Model Context Protocol work?

MCP has three participants. The host is the AI application, such as Claude Desktop or VS Code. The host creates one client per connection, and each client talks to one server, the program that exposes a system. (See the MCP server glossary entry.) A VS Code window connected to a local filesystem server and the remote Sentry server runs two client objects.

Two layers sit underneath. The data layer is JSON-RPC 2.0 messages: discovery, the primitives, and notifications. The transport layer moves those messages. MCP defines two transports. stdio runs a local server as a subprocess on the same machine. Streamable HTTP serves remote servers, using HTTP POST with optional Server-Sent Events for streaming.

What each side can offer is defined by primitives:

Three client features from earlier revisions are now deprecated: Sampling (a server borrowing the host’s model), Logging, and Roots. They still work, but the 2026-07-28 changelog says new implementations should not adopt them. It suggests direct LLM provider APIs instead of Sampling, stderr or OpenTelemetry instead of Logging, and tool parameters instead of Roots.

My rule for new servers: if the model should decide when to act, make it a tool. If the user or app should decide what context to load, make it a resource. Most first servers only need tools.

What does one MCP request look like in 2026?

The 2026-07-28 release notes describe the change plainly: MCP is moving “from a bidirectional stateful protocol into a request/response stateless protocol.” Before, a client opened with an initialize handshake, and an HTTP server could assign a session ID that every later request carried. Both are gone.

Now each request describes itself. Its _meta field carries the protocol version and client capabilities, and clients should also identify themselves there. Over HTTP, the method and the tool name also travel in headers, so a gateway can route without parsing the body. Here is a tool call as the Streamable HTTP spec shows it, with the Accept header the spec requires added:

POST /mcp HTTP/1.1
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: get_weather

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_weather",
    "arguments": { "location": "Seattle, WA" },
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": { "name": "ExampleClient", "version": "1.0.0" },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

Four more changes matter to server operators. Every server must implement server/discover, but clients may skip it. tools/list results carry ttlMs and cacheScope cache hints. To ask the user something mid-call, a server returns resultType: "input_required" and the client retries with the answers (Multi Round-Trip Requests). And state lives in handles: “mint an explicit handle from a tool and have the model pass it back as an argument.” The payoff, per the release notes: any request “can now land on any server instance behind a plain round-robin load balancer without needing shared storage.”

The failure mode is version skew. The versioning page says a legacy client calling a modern-only server fails, and so does a modern-only client calling a legacy server. In its words: “Legacy clients have no fall-forward mechanism.” A dual-era server speaks both. Detect skew early by logging the MCP-Protocol-Version header per request. The full revision timeline and an 11-test upgrade checklist live in the MCP roadmap and upgrade guide.

Who owns and governs MCP now?

On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation (AAIF), “a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, Amazon Web Services (AWS), Cloudflare, and Bloomberg.” MCP joined Block’s goose and OpenAI’s AGENTS.md as founding projects. The AAIF project list now also includes Agent2Agent (A2A), agentgateway, and Agent Router.

Design decisions did not move to a vendor committee. Per MCP’s governance page, the project is organized as a Series of LF Projects, LLC. Lead Maintainers, currently David Soria Parra and Den Delimarsky, hold final authority. Core Maintainers steer the spec and meet every two weeks to vote on proposals. Membership “is for individuals, not companies,” with “no seats reserved for specific companies.”

Licensing follows the same page. Code and specification contributions are made under Apache 2.0, and documentation other than the spec is under CC BY 4.0. Before you ship an SDK inside a product, check the license file of the exact package version you depend on.

My read for buyers: neutral governance lowers lock-in risk at the protocol layer. Your real lock-in sits one level up, in the hosts, gateways, and hosted connectors you choose.

Who supports MCP, and how widely is it used?

Adoption numbers come from the project and Anthropic, not independent audits. In December 2025, Anthropic reported more than 10,000 active public MCP servers and 97M+ monthly SDK downloads across Python and TypeScript. It named ChatGPT, Cursor, Gemini, Microsoft Copilot, and VS Code as adopters. At the July 2026 release, the maintainers said Tier 1 SDKs see “close to half-a-billion downloads a month,” and that the TypeScript and Python SDKs each passed 1 billion total downloads. Downloads include CI runs and dependency installs, so I read them as developer activity, not production deployments.

The official SDK list ranks SDKs by feature completeness, protocol support, and maintenance commitment. Tier 1: TypeScript, Python, C#, Go, Rust, and Ruby. Tier 2: Java. Tier 3: Swift, PHP, and Kotlin. For production work, my recommendation is a Tier 1 SDK. The release notes say all four SDKs that were Tier 1 in July (TypeScript, Python, Go, and C#) supported 2026-07-28 on release day.

Host support differs in the details. OpenAI’s MCP tool in the Responses API works with remote servers that support Streamable HTTP or the older HTTP/SSE transport. By default it requests approval “before any data is shared with a connector or remote MCP server.” You pay only for tokens, with no per-call fee. For servers behind a firewall, it offers Secure MCP Tunnel.

Decision rule: before you build a server for a specific host, check which protocol versions that host sends. If any host you must support still opens with initialize, your server has to be dual-era.

MCP vs tool calling, RAG, and A2A: what is the difference?

The confusion is about layers. The model never speaks MCP. Per the architecture overview, the host gathers tools from every connected server into “a unified tool registry that the language model can access.” When the model asks for a tool, “the AI application intercepts the tool call, routes it to the appropriate MCP server,” and returns the result. Tool calling is the model’s ability to request a function. MCP standardizes how those functions are described, discovered, and reached across process and network boundaries.

That gives a practical way to decide what to build:

The first two rows are my judgment. For bulk data and service-to-service calls with no model involved, plain APIs still win; see MCP vs. traditional API integration.

What does MCP cost you?

MCP adds three costs to plan for: context, trust, and upgrades.

Context. Every tool definition a host loads goes into the model’s context. Anthropic’s advanced tool use post measured a five-server setup: GitHub (35 tools, about 26K tokens), Slack (11 tools, about 21K), Sentry and Grafana (5 tools and about 3K each), and Splunk (2 tools, about 2K). That is 58 tools and about 55K tokens “before the conversation even starts.” Anthropic says it has seen tool definitions reach 134K tokens before optimization, and that the most common failures are “wrong tool selection and incorrect parameters.”

Here is a hypothetical worked example. An agent connected to those five servers makes 20 model calls per task. If the host sends every definition on every call, that is 55,000 x 20 = 1.1 million input tokens per task for tool definitions alone. With on-demand tool search at the sizes Anthropic quotes (about 500 tokens for the search tool plus about 3K for three to five relevant tools), it is about 3,500 x 20 = 70,000 tokens, roughly 94% fewer. Two caveats. Prompt caching lowers the price of repeated definitions but not the context they occupy. And on a long task, discovered tools can pile up.

Decision rule: Anthropic’s guidance is to use tool search when definitions exceed 10K tokens or you expose 10 or more tools. In its internal tests on large tool libraries, Claude Opus 4 accuracy on MCP evaluations rose from 49% to 74% with it.

Trust. The spec says tools “represent arbitrary code execution and must be treated with appropriate caution,” that annotations such as read-only hints “should be considered untrusted, unless obtained from a trusted server,” and it states: “Hosts must obtain explicit user consent before invoking any tool.” OpenAI’s guide is blunter: “A malicious server can exfiltrate sensitive data from anything that enters the model’s context.” The security best practices add two server rules: servers “MUST NOT accept any tokens that were not explicitly issued for the MCP server,” and “MUST NOT treat possession of a state handle as authentication.” Controls are in the MCP security guide. Past a handful of servers across teams, read when you need an MCP gateway.

Upgrades. The changelog adopts a minimum twelve-month deprecation window. That gives you time, not a pass, so track deprecation warnings in CI.

How should an enterprise team start with MCP?

Prove the pattern on low-risk data before anything can change a record. Here is the sequence I would use.

1. Pick one read-only system that several teams already ask the AI about. Read-only keeps the consent question simple while you learn how hosts behave.
2. Build on a Tier 1 SDK and target 2026-07-28. Start with stdio for a single-user pilot. Move to Streamable HTTP when a second person needs access. The MCP server build guide walks through a first server.
3. Decide the era before launch. If you do not control every client that will call the server, run it dual-era from day one.
4. Put OAuth in front before the second user. Validate that every token was issued for your server, bind handles to the authenticated user, and log every tools/call with the user, tool name, and outcome.
5. Measure two numbers from week one: tool-definition tokens per model call and the rate of wrong tool picks. If either climbs, add tool search or split the server.

Add write actions after that, one tool at a time, with confirmation through elicitation.

Bottom Line

MCP is the standard way to give AI apps access to tools and data, and it now has a stateless core.

Build each system once as a server, keep authorization in your hands, and watch the token cost of tool definitions.

Next step: pick one read-only system and ship a 2026-07-28 server for it this quarter.

FAQ

What does MCP stand for?

MCP stands for Model Context Protocol. David Soria Parra and Justin Spahr-Summers created it at Anthropic, which open-sourced it on November 25, 2024. The Agentic AI Foundation under the Linux Foundation has hosted it since December 2025.

Does MCP still use sessions?

No. The 2026-07-28 revision removed the initialize handshake and the Mcp-Session-Id header. One long-lived stream remains: a client can open subscriptions/listen to receive change notifications, such as a changed tool list. Any state your app needs across calls goes in explicit handles.

Can MCP servers run on-premises or behind a firewall?

Yes. A stdio server runs on the user’s machine, and a Streamable HTTP server can run inside your network. OpenAI’s Secure MCP Tunnel connects a private server to supported OpenAI products without exposing it to the public internet.

Does MCP work with any AI model?

MCP is implemented by the host application, not the model. A host can pair MCP tools with any model that supports tool calling, because the host presents server tools to the model through the model’s own tool interface and routes the calls itself.

Is MCP the same as A2A?

No. MCP connects an AI application to tools and data. A2A lets agents exchange tasks with other agents. Both are AAIF projects, and one agent can use both: A2A to receive a task, MCP to reach the systems it needs.

---

Three Ways to Work With TMA

Need an agent built? We deploy production AI agents in your infrastructure. Working pilot. Real data. Measurable ROI. → Schedule Demo

Want to co-build a product? We’re not a dev agency. We’re co-builders. Shared cost. Shared upside. → Partner with Us

Want to join the Guild? Ship pilots, earn bounties, share profit. Community + equity + path to exit. → Become an AI Architect