For two years the interesting work in applied AI was getting a model to use tools — search, code execution, a company's internal APIs. Everyone built this the same way and everyone built it incompatibly: a bespoke integration between one model and one tool, repeated until the wiring collapsed under its own weight. Agent protocols are the standardization layer that grew out of that mess. The most important of them, the Model Context Protocol, is barely eighteen months old and has already become the closest thing the field has to a default.
The N-by-M problem
The forcing function was combinatorial. With N AI applications and M tools or data sources, ad-hoc integration is an N-by-M problem: every app needs custom glue for every tool, and every new tool must be re-integrated everywhere it is used. This is exactly the shape of problem protocols exist to collapse — turn N-by-M into N-plus-M by defining one interface that tools implement once and apps consume once. The analogy the MCP project reaches for is USB-C: a single standardized port replacing a drawer full of proprietary cables. The prize is an ecosystem where a tool built for one assistant works with all of them.
MCP in depth
MCP, introduced by Anthropic in November 2024, is an open protocol built on JSON-RPC 2.0 with a three-role architecture. A host is the AI application — a chat client, an IDE, an agent runtime. Within it, clients each hold a dedicated one-to-one connection to a server, and servers are the programs that expose capabilities: a GitHub server, a Postgres server, a filesystem server. The host's model reasons; the servers do the reaching into the world.
What the protocol standardizes is a small set of primitives. Tools are model-callable functions with typed inputs — the server advertises what it can do, and the model invokes it (search this database, open this pull request). Resources are data the server exposes for context — files, records, documents — addressable and readable without side effects. Prompts are reusable, parameterized templates a server offers, often surfaced to the user as slash-commands. The protocol also defines capabilities running the other direction: sampling lets a server ask the host's model to complete a prompt, roots scope a server to particular parts of a filesystem, and elicitation lets a server request structured input from the user mid-task. The specification has continued to evolve — revised through 2026 — and has grown an extension for interactive MCP apps that render their own UI inside the client, a sign the protocol is expanding from plumbing toward experiences.
The design choice worth flagging is the separation of the three core primitives by who controls them: tools are model-controlled, resources are application-controlled, and prompts are user-controlled. That is not incidental — it is the seam along which much of the security discussion runs.
Adoption and governance
MCP's adoption is the strongest evidence for its design. What began as an Anthropic project was adopted by OpenAI across ChatGPT and its developer tools in March 2025, by Google DeepMind in April 2025, and by Microsoft, and it is now supported across IDEs and agent frameworks — VS Code, Cursor, and many others. The server ecosystem numbers in the tens of thousands by independent counts, indexed across public registries. Then, in December 2025, Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation, co-founded with Block and OpenAI. That governance move matters: a protocol owned by one lab is a hard sell to that lab's competitors, and a neutrally governed one is not. A single vendor's protocol being adopted by its direct rivals inside a year, then handed to a foundation, is the clearest possible signal that the N-by-M pain was real and widely felt.
Beyond tool access: agent-to-agent
MCP connects a model to tools and data. A different problem is connecting agents to each other — letting an autonomous agent from one vendor delegate to, negotiate with, or hand off work to an agent from another. Google's Agent2Agent (A2A) protocol, announced in April 2025 and subsequently contributed to the Linux Foundation, targets exactly this: agents advertise their skills through a machine-readable 'agent card,' then exchange tasks and results over a defined message format, without either side needing to expose its internal tools or prompts to the other.
It is worth being precise about the relationship, because vendor marketing blurs it: MCP and A2A are complementary, not competing. MCP is vertical — an agent reaching down to tools and data. A2A is horizontal — agents talking peer-to-peer. A realistic 2026 stack uses both. That said, the agent-to-agent layer is markedly less mature than tool access: adoption is thinner, the compelling multi-vendor use cases are still emerging, and several overlapping efforts and framework-specific protocols are jockeying for position, so anyone declaring a settled winner at this layer is ahead of the evidence.
The security surface
Protocols that let a model take actions in the world inherit every security problem of doing so, and add new ones. The root issue is old and unsolved: prompt injection. A language model does not reliably distinguish its instructions from the data it processes, so text retrieved from a webpage, an email, or a document can carry commands the model then follows. Give that model tools, and injection stops being a content problem and becomes a control problem — the injected instruction can now exfiltrate data or take destructive action on the user's behalf.
MCP introduces a sharper variant: tool poisoning. A tool's description is itself text the model reads, so a malicious or compromised server can hide instructions inside its tool metadata — invisible to the user who approved the tool, but read by the model on every invocation. Researchers have catalogued cross-tool poisoning (one server's description manipulating how another is used), rug-pull updates (a server that behaves until it is trusted, then quietly changes its metadata), and Unicode-concealed payloads that exploit the gap between what the approval interface displays and what the model actually ingests. A 2026 disclosure reported on the order of a hundred-thousand-plus exposed or vulnerable MCP instances, and client hardening varies widely — some clients enforce strong guardrails while others are notably susceptible. The combination that should worry anyone deploying this is what security researchers call the 'lethal trifecta': a system with access to private data, exposure to untrusted content, and the ability to communicate externally is one successful injection away from exfiltration.
The defenses are real but partial: human-in-the-loop approval for consequential actions, pinning and verifying server integrity, static analysis of tool metadata, sandboxing and least-privilege scoping, and runtime monitoring of what agents actually do. None of them solves prompt injection, because prompt injection is not yet solved at the model level — it is a property of how current models process text, and the protocols merely raise the stakes of it.
An honest assessment of maturity
So how mature is this? The tool-access layer — MCP specifically — has crossed from experiment to infrastructure: multi-vendor adoption, neutral governance, tens of thousands of servers, and a specification stable enough to build on. That is genuine, and it happened fast. But maturity of adoption is not maturity of safety. The security model is still being retrofitted onto a protocol that spread faster than its threat model was understood, and the agent-to-agent layer above it is early enough that its standards remain unsettled. The honest read for August 2026: MCP is a safe bet as the integration standard and a risky thing to deploy carelessly; agent-to-agent interoperability is promising but unfinished; and the hardest problem — models that can be talked into misusing the very tools these protocols so effectively hand them — belongs to today's models, not to the protocols, and will not be standardized away.