MCP Turns One: The Protocol That Changed AI Integration
In November 2024, Anthropic open-sourced a protocol specification called the Model Context Protocol — MCP. It defined a standardized way for AI models to discover, authenticate with, and invoke external tools through a JSON-RPC interface. The initial release was accompanied by SDKs for Python and TypeScript, a handful of reference server implementations, and documentation that described MCP as “a universal open standard for connecting AI assistants to the systems where data lives.”
One year later, MCP has become the de facto standard for AI-to-tool communication. The protocol's adoption curve over the past twelve months has been one of the fastest for any open standard in the AI ecosystem. The most recent stable specification release was published on November 25, 2025. What started as an Anthropic project is now an industry-wide standard with contributions from every major AI lab.
The Adoption Timeline
The speed of MCP adoption is worth documenting because it illustrates how ready the industry was for a standardized tool-communication protocol.
Within weeks of the November 2024 launch, independent developers and companies began building MCP servers for popular services. Postgres, Slack, GitHub, and file system servers appeared in the first month. By January 2025, dozens of MCP servers covered the most common enterprise integrations.
The pivotal moment came in March 2025, when OpenAI officially adopted MCP. OpenAI integrated MCP support into the Agents SDK, Responses API, and ChatGPT desktop application, allowing ChatGPT to connect to any MCP server. This was significant not just because of OpenAI's market position, but because it signaled that MCP was no longer an Anthropic-specific protocol. When the two largest AI model providers both support the same tool-communication standard, the format war is effectively over.
Google followed with MCP support in Gemini tooling. Microsoft integrated MCP into its developer tools. Smaller AI labs and tooling companies adopted MCP as the default integration standard. By mid-2025, asking whether a new AI tool supported MCP was like asking whether a website supported HTTPS — the answer was expected to be yes.
The Ecosystem at One Year
The MCP ecosystem at its first anniversary is substantially larger than most observers predicted at launch.
Over 10,000 active public MCP servers exist across community repositories, vendor offerings, and enterprise internal deployments. These cover an extraordinary range of services: database systems (Postgres, MySQL, MongoDB, Redis), communication platforms (Slack, Discord, Microsoft Teams), developer tools (GitHub, GitLab, Jira, Linear), CRM and business tools (Salesforce, HubSpot), cloud providers (AWS, GCP, Azure), payment systems (Stripe, Square), and hundreds of specialized services.
The protocol itself has matured through multiple specification updates. The November 25, 2025 release includes refinements to capability negotiation, improved error handling semantics, better support for streaming responses, and clarified security considerations. The specification process has become increasingly collaborative, with contributions from multiple organizations.
The “USB-C of AI” analogy that circulated in the early days has proven apt. Before MCP, every AI platform had its own tool integration format. OpenAI's function calling used one schema. Anthropic's tool use used another. Google's function declarations used yet another. Building a tool integration meant building it three or four times, once for each major platform. MCP collapsed that into a single specification. Build an MCP server once, and every MCP-compatible agent can use it.
What MCP Got Right
Several design decisions in the original MCP specification contributed to its rapid adoption.
Simplicity. An MCP server is a process that speaks JSON-RPC. It exposes tools (functions the agent can call), resources (data the agent can read), and prompts (templates the agent can use). The protocol requires no special runtime, no proprietary SDK, no hosted service. You can implement an MCP server in any language that can read and write JSON over stdin/stdout or HTTP. This low barrier to entry is why thousands of servers appeared in the first few months.
Capability negotiation. MCP includes a discovery phase where the client and server negotiate what capabilities are available. The agent does not need to know in advance what tools a server provides. It asks, the server responds, and the agent adapts. This makes MCP servers composable: connect a new server, and the agent automatically discovers and can use its capabilities.
Transport agnosticism. MCP works over local stdio connections (for desktop applications), HTTP with Server-Sent Events (for remote servers), and other transports. This flexibility means MCP works equally well for a local development tool running on your laptop and a remote enterprise service running in a cloud data center.
Open specification. MCP was released as an open specification from day one, with permissive licensing that allowed anyone to implement clients and servers without royalties or restrictions. This eliminated the adoption friction that kills many standards before they gain traction.
What Still Needs Solving
For all its success, MCP at one year has clear gaps that the ecosystem is still working to address. These gaps are not flaws in the protocol — they are categories of functionality that MCP intentionally leaves to implementations, and that implementations have not yet standardized.
Security
MCP defines how an agent communicates with a tool server. It does not define how credentials are managed, how tool access is scoped, or how to prevent an agent from misusing the tools available to it. An MCP server for Postgres has database credentials. An MCP server for Slack has API tokens. The protocol provides no standard for least-privilege access, credential rotation, or sandboxed execution. Each implementation handles security differently, which means each implementation can get it wrong differently.
Governance
When an agent calls a tool through MCP, the call executes. There is no standardized approval workflow, no audit trail format, no human-in-the-loop mechanism defined in the protocol. For enterprises operating under SOC 2, HIPAA, FedRAMP, or similar frameworks, this means building governance layers on top of MCP — and every organization builds them differently, with varying degrees of rigor and completeness.
Operations
Production MCP deployments need monitoring, rate limiting, failover, cost management, and multi-model routing. None of these are within MCP's scope, and no standardized operational layer has emerged. Organizations deploying MCP to production are building bespoke operations infrastructure that would benefit from shared standards and tooling.
The Second Year
MCP's first year established it as the universal standard for AI tool integration. That problem is solved. The protocol works. The ecosystem is vast. The adoption is irreversible.
The second year will be defined by what gets built on top of MCP. The protocol provides the communication layer. What enterprises need now are the security, governance, and operations layers that make MCP-based systems production-ready for regulated, high-stakes environments.
This is the work we are doing at AgenticWork. The platform provides a complete MCP ecosystem: MCP Workshop for creating, testing, and deploying MCP servers with hot-reload and zero-downtime deployment. agenticode-cli for script-based MCP development and CI/CD pipeline integration. CodeMode for building MCP servers in VS Code in the browser with AI pair programming and Kubernetes sandbox isolation.
On top of the development tools, the platform provides the enterprise layers that MCP's second year demands: the DLP Scanner for real-time data loss prevention across MCP tool calls, RBAC with per-tool granularity, the Audit System with immutable cryptographically hashed logs, SmartModelRouter for multi-model orchestration across multiple model families and provider integrations, and OpenTelemetry-based observability for production monitoring.
MCP gave the AI ecosystem a common language for tool integration. The next step is giving enterprises a complete toolkit for building, securing, and operating those integrations at scale. The connector exists. Now we need the workshop, the circuit breakers, and the building inspector.
Happy first anniversary, MCP. The hard part starts now.