Model Context Protocol Explained: How MCP Works and Who It Hurts

Anthropic's Model Context Protocol (MCP), open-sourced in November 2024, is now the agreed-upon standard for connecting AI agents to external tools. OpenAI added support in March 2025, Google DeepMind followed in April 2025, and by December 2025 governance passed to the Linux Foundation with OpenAI, Google, and Microsoft as co-sponsors. That rapid consensus is good news for developers shipping agents, but it is quietly collapsing the business case for a generation of startups that built their entire pitch around normalizing SaaS integrations.

What happened

Fact	Detail
MCP open-sourced	November 2024 by Anthropic
OpenAI support	Agents SDK, Responses API, ChatGPT desktop app (March 2025)
Google DeepMind support	Gemini confirmed (April 2025)
Governance transfer	Linux Foundation, December 2025; co-sponsors: OpenAI, Google, Microsoft
Public MCP servers (Q1 2026)	17,468 (Nerq census), up from ~10,000 at donation
Security findings	43% command injection vulnerable; 36.7% of 7,000+ servers open to SSRF (Practical DevSecOps, 2026)
NSA guidance published	June 2026, MCP security design

Anthropic described MCP at launch as a USB-C port for AI applications: one standard connector instead of a custom cable per device. That analogy has held up better than most. Before MCP, every AI agent that needed to touch a third-party tool required a bespoke integration, custom auth flows, custom schemas, custom error handling. MCP replaces all of that with a shared spec.

How does MCP actually work?

Strip away the acronym and MCP is a conversation between three roles: a host, a client, and a server.

• Host: The application you open, such as Claude Desktop, Claude Code, Cursor, or the ChatGPT desktop app. It runs the client.
• Client: A small piece of code inside the host that keeps one dedicated, stateful connection open to a single MCP server.
• Server: A lightweight program that tells the client exactly what it can do, using three primitives: tools (functions the model can call, like “create invoice”), resources (data the model can read, like a database row), and prompts (reusable templates for recurring tasks).

All messages travel as JSON-RPC 2.0 calls, over stdio for local servers or Streamable HTTP for remote ones. The client side also exposes three primitives back to servers: roots (which file directories the server is allowed to see), sampling (letting a server borrow the host model’s reasoning for completions), and elicitation (pausing mid-task to ask a human a direct question, such as confirming a payment amount before sending it).

A concrete example

Say an agent needs to check whether a Stripe invoice is overdue and open a Linear ticket if it is. The host passes the request to its client, which already holds open connections to both the Stripe and Linear MCP servers. The model calls Stripe’s invoice-listing tool first. The client sends a JSON-RPC call to the Stripe server, gets a structured result, and hands it back to the model. The model reads it, determines the invoice is thirty days overdue, and then calls Linear’s issue-creation tool through its own separate connection. Neither Stripe nor Linear needed any prior knowledge of each other. The client orchestrates both.

What changed in the July 2026 spec update

According to the Model Context Protocol Blog, the July 28, 2026 release rebuilt the core around a stateless design, meaning servers can now scale behind ordinary load balancers without holding a persistent connection per user. It also added support for multi-round-trip requests, cacheable list results, tighter OAuth 2.1 and OpenID Connect authorization, and a formal extensions framework including MCP Apps (server-rendered interfaces inside a host) and a Tasks extension for long-running jobs.

Why it matters: the startup problem

Companies like Merge and Paragon built real businesses around normalizing SaaS integrations, precisely the layer MCP now lets any vendor replicate for free. Stripe and Cloudflare already ship their own MCP servers. When a customer can point any MCP-compatible agent at a vendor’s official server, the case for paying a middleware company to normalize that same data gets much harder to make. For businesses building AI integrations, this is actually good news: the plumbing is cheaper. For the startups selling the plumbing, it’s an existential shift.

The NSA’s Cybersecurity Collaboration Center publishing MCP security guidance in June 2026 is a useful signal. Agencies like that don’t write guidance for protocols nobody uses. MCP is now load-bearing infrastructure in production systems that attackers are actively targeting.

Should you be worried about MCP security?

Yes, seriously. A 2026 Practical DevSecOps report tested public MCP servers and found 43% vulnerable to command injection and 36.7% of more than 7,000 scanned servers open to server-side request forgery (SSRF, a class of attack where a server is tricked into making requests to internal systems it shouldn’t reach). These are not theoretical risks. If you are running or consuming MCP servers in any production workflow, treat them like any other external API endpoint: validate inputs, restrict network access, and audit what tools you expose. Teams working on workflow automation that touches sensitive data should vet every MCP server they connect before it goes live.

Our take

MCP is genuinely useful infrastructure, and the fact that all major AI labs converged on it within thirteen months is remarkable. But the security numbers from Practical DevSecOps should make any operator pause before wiring an MCP server into a production system that touches customer data or financial records. Nearly half of tested servers had command injection vulnerabilities. That is not a minor footnote.

For business owners evaluating AI agents, the right question is not “does this tool support MCP?” but “who built the MCP server it connects to, and has anyone audited it?” Vendor-official servers from Stripe or Cloudflare are a safer starting point than community-built ones with no maintenance history.

The compression happening to integration middleware startups is real and worth watching. If your vendor already ships an MCP server, you probably don’t need a third-party integration layer on top of it. If they don’t, that gap is still a legitimate business opportunity, at least for now. Keep an eye on the broader AI infrastructure news to see which vendors move next. And if you are scoping out what AI agent workflows might look like for your own business, the Lumien team is worth a conversation before you buy something you won’t need in twelve months.

Build on the standard. Be paranoid about what you connect to it.

Source: Bing News · Claude AI