MCP explained for companies: what it is and how to adopt it safely

What MCP is, in plain terms

A standard socket between AI applications and the systems they use.

The Model Context Protocol is an open protocol that Anthropic published on November 25, 2024, with SDKs and reference servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer. Before it, each pairing of an AI application and a system needed its own integration; with MCP, a system exposes one server and any compatible client can use it.

Three roles. The host is the application the user works in: a chat assistant, an IDE or your own agent. Inside it, an MCP client connects to each server, which wraps a system such as a database or a SaaS API. Servers run locally, launched by the host, or remotely over HTTP, the usual enterprise case.

A server offers tools (actions the model can call, with arguments described by a JSON schema), resources (data the application can read into context) and prompts (reusable templates the user picks). Tools carry most of the value and most of the risk, because the model decides when to call them.

Two years of specification: what changed and when

MCP versions are dates. Five revisions matter for a company.

The 2026-07-28 revision is the largest since launch, and it breaks things: it removes protocol-level sessions and the initialization handshake, deprecates Roots, Sampling and Logging, formally deprecates the old HTTP+SSE transport and sets a minimum 12-month deprecation window. The four Tier 1 SDKs (TypeScript, Python, Go and C#) supported it on release day. Servers built around session IDs need a migration plan.

Fast-moving features now ship as official extensions: MCP Apps (interactive interfaces in sandboxed iframes, January 2026), Tasks (contributed by AWS) and Enterprise Managed Authorization.

Governance, registry and vendor adoption

MCP is no longer one vendor's protocol.

On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund of the Linux Foundation co-founded by Anthropic, Block and OpenAI, with MCP, goose and AGENTS.md as founding projects. Its platinum members are AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI. MCP keeps its own maintainers and proposal process.

Adoption came first. OpenAI announced MCP support in its Agents SDK in March 2025 and in the Responses API in May; Google DeepMind said in April 2025 that Gemini would support it; Microsoft presented it in May as a foundation for agents in Windows 11. At the donation, MCP counted over 97 million monthly SDK downloads and 10,000 active servers; by July 2026 its main SDKs were close to half a billion downloads a month. Google also put managed MCP servers for Maps, BigQuery, Compute Engine and GKE into public preview in December 2025.

The official MCP Registry opened in preview on September 8, 2025. Server names use namespaces tied to verified GitHub accounts or domains, community moderation can denylist malicious or impersonating servers, and it held close to 2,000 entries by November 2025. A listing is not a security review: you still need your own allowlist.

MCP, A2A, APIs, Agent Skills and AGENTS.md

Complementary layers, not competitors.

In practice they stack: a support agent can follow a skill describing your refund procedure, read the CRM through an MCP server and hand a fraud check to another team's agent over A2A. For one application with one model, a plain API is still the right answer; MCP pays off when several AI clients must reach the same systems under the same controls.

Security risks: what has already gone wrong

Every MCP server is code or a service you trust with your model's context, and often with credentials.

Exposure is broad: a single-author preprint (July 2026, not peer reviewed) found over 21,000 internet-facing MCP servers, and 91.8% of the 414 it audited had no OAuth. In September 2026 Google's threat intelligence group also reported trojanized forks of real MCP servers on PyPI. More in prompt injection and agents and AI supply chain security.

A confused deputy is a server that uses its own privileges for a user who should not have them, or passes a token to a service it was not meant for. The spec binds tokens to one server with RFC 8707 resource indicators (June 2025) and credentials to their issuer (July 2026); checking each call against the end user's rights remains your job.

The controls we recommend

None is exotic; together they contain most of the cases above.

• Allowlisted servers. Only servers approved by security, published in a private registry; nothing installed from a link in a chat.
• Pinned versions. Pin each server and review changes to tool names and descriptions before any upgrade.
• Scoped OAuth. Per-user delegated tokens, narrow scopes, short lifetimes and no token passthrough.
• Egress rules. Servers and agents reach only the hosts they need; local servers run in containers without default internet access.
• Human confirmation. Destructive tools (write, send, delete, pay) need approval. Tool annotations help, but a malicious server can mislabel its tools: trust them only from servers you control.
• Logging. Every call recorded with user, server, tool, arguments and result, append-only, with retention that respects data-protection law.
• A gateway. One entry point that authenticates, authorizes per tool, rate-limits and logs; since July 2026, the Mcp-Method and Mcp-Name headers let it do so without parsing request bodies.

Microsoft's Windows design (May 2025) is a useful reference: a central registry limited to servers that meet a security baseline, calls mediated by a trusted proxy and user approval for each client and tool pair.

An adoption plan for a company, step by step

From a first read-only server to a governed platform.

1. Pick two or three read-mostly use cases with an owner and a metric: customer lookup in the CRM, order status in the ERP, search in internal documentation.
2. Check what your vendors already ship. Official servers from your SaaS and cloud providers usually beat community ones, after review.
3. Build thin internal servers. The MCP server calls your existing CRM or ERP API, which keeps business rules, validation and authorization; read and write tools stay separate.
4. Put a gateway in front, tied to your identity provider, with per-user tokens, per-tool authorization, rate limits and logs.
5. Keep an allowlist and a private registry with pinned versions and an owner per server.
6. Evaluate and red-team before launch: tool-selection accuracy on real tasks, plus injection cases hidden in documents and tool results (see LLM evals).
7. Open write actions gradually, each with confirmation, idempotency keys and a rollback path.
8. Govern it like an API platform: quarterly review of servers and scopes, a deprecation policy (the spec itself uses 12 months) and an incident runbook.

In Colombia and Europe, tool-call logs often hold personal data covered by Law 1581 of 2012 and the GDPR: host internal servers and their logs where your data-protection analysis requires, and set retention periods. For regulated systems, prefer servers running in your own cloud tenancy over third-party remote servers you cannot audit.

This is the sequence we recommend in our AI agent and custom software projects; the rest of the stack is in AI agents in production.