AI agents and the Model Context Protocol, in plain terms

MCP, the Model Context Protocol, is an open standard for connecting AI applications such as agents to tools and data. An agent is a language model that decides its own next step and uses tools in a loop. Since 9 December 2025, MCP has been a Linux Foundation project under the Agentic AI Foundation. MCP does not make agents ready for unsupervised work. Reliability falls as tasks get longer. Prompt injection has no complete fix.

What agentic means

There is no single agreed definition. The clearest one I know of is in Anthropic's engineering guide Building effective agents (December 2024). It separates two things that vendors tend to blur. In a workflow, models and tools are orchestrated along code paths written in advance. In an agent, the model itself directs the process, choosing which tool to use and what to do next. The guide's advice is cautious. Start with the simplest design. Add agentic autonomy only when a task is open-ended enough to need it, because agents cost more to run and their errors can compound.

What MCP is

An agent is only as useful as the systems it can reach. Before MCP, each connection between an AI application and a database, file store or business tool was a one-off integration. The MCP specification describes an open protocol that standardises that connection. It uses JSON-RPC 2.0 messages between three roles. Hosts are the AI application, clients are connectors inside the host and servers are services that expose capabilities. Servers can offer resources (data and context), prompts (templated instructions) and tools (functions the model can call). The specification says the design borrows from the Language Server Protocol, which did a similar job for programming-language support in code editors.

Anthropic introduced MCP in late 2024. The specification is versioned by date. The revision current as of October 2026 is 2026-07-28.

Who governs it now

On 9 December 2025 Anthropic donated MCP to the Agentic AI Foundation (AAIF), a new body under the Linux Foundation. According to the Linux Foundation's announcement, the foundation launched with three contributed projects. They were MCP from Anthropic, goose from Block and AGENTS.md from OpenAI. The announcement lists its platinum members as Amazon Web Services, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI.

The project's own governance page sets out the detail. MCP is established as a series of LF Projects, LLC. Contributions are licensed under Apache 2.0. Technical authority runs through a hierarchy of contributors, maintainers, core maintainers and two lead maintainers who hold final say. Seats are held by named individuals, with none held by companies. Specification changes go through written Specification Enhancement Proposals. Changes to the governance document itself need LF Projects approval.

Anthropic's donation announcement claimed more than 10,000 active public MCP servers and support in products including ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code. Those are a vendor's figures. The list of adopters is the significant part. Direct competitors are using the same connector standard.

For a business reader, a shared protocol under neutral governance lowers one specific risk. That is the risk of building integrations that only work with one supplier's models. That is a real benefit. It does not mean agents are ready for unsupervised work. Two limits explain why.

Limit one: reliability over long tasks

The research group METR measures the length of task, in human working time, that a model can complete at a given success rate. Its March 2025 study found that this length had been doubling roughly every seven months. It also found that the models of the time succeeded almost always on tasks that take a person under four minutes. On tasks taking more than about four hours they succeeded less than 10% of the time. Capability has moved on since then. The shape of the finding is the useful part. Success rates fall as tasks lengthen. A headline figure quoted at 50% success is not a level you would accept from a colleague.

METR is careful about what this does not show. Its time horizons page notes that the tasks are mostly software engineering, machine learning and cybersecurity. It adds that they are much cleaner than real economically valuable work. It also says the measure cannot predict the automation of jobs that depend on dealing with other people.

Limit two: prompt injection

An agent reads content (emails, web pages, documents) and acts on instructions. The difficulty is that a language model does not reliably tell the two apart. The UK's National Cyber Security Centre argued in December 2025 that this makes prompt injection different in kind from older attacks such as SQL injection. There is no clean boundary between data and instruction to enforce, so the problem may never be fully fixed. Claims to have stopped it deserve suspicion. The NCSC suggests treating a model as a deputy that is inherently open to being confused, then limiting what it is allowed to do.

The OWASP guidance on prompt injection points the same way. It advises least-privilege access, human approval for high-risk actions and clear separation of untrusted external content.

MCP does not remove this risk and does not claim to. The specification states that the protocol cannot enforce its security principles itself. It tells implementers to obtain user consent before tools are invoked. It also tells them to treat descriptions of tool behaviour as untrusted unless they come from a trusted server.

If a supplier proposes an agent, I would ask these questions before anything else:

• Which tools and systems can it reach and with whose permissions?
• Which actions need a person to approve them and can that be configured?
• What untrusted content will it read (inbound email, web pages, uploaded files)?
• Is there a full log of what it did and why?
• What success rate was measured, on what tasks and by whom?

Beyond procurement, three things are worth following:

• Governance in practice. A neutral foundation is a structure. It is no guarantee. Watch whether specification decisions keep being made in the open.
• The specification itself. It is revised regularly. Check which revision a product supports.
• Injection claims. Treat any statement that prompt injection has been solved as a prompt for hard questions.

The last procurement question leads directly to the note on how to read an AI benchmark claim. For the regulatory backdrop, see the EU AI Act timeline. The specification and security guidance cited here are in the reading list.