Before late 2024, connecting a model to a tool meant writing a custom integration for each pair: this assistant to that ticket system, that agent to this database. In November, Anthropic introduced the Model Context Protocol (MCP) as an open standard for connecting AI applications to data sources and tools.
The idea is ordinary in the best way. A tool exposes an MCP server once; any MCP-capable client can use it. The diagram below shows why that matters: one shared protocol in place of a web of one-off connectors. The specification and SDKs are public.
Adoption came fast. By December 2025, Anthropic reported more than 10,000 active public MCP servers and 97M+ monthly SDK downloads, and donated the protocol to the Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI [2].
For anyone building agents, MCP made the hard part easy: an agent could now reach a calendar, a code host, a database and a file store in an afternoon. That is also the governance problem. Each server is a new set of permissions, often running with a person's own tokens, and an agent that can call ten tools can be talked into misusing any of them.
The protocol is a plug, not a policy. Who may connect which server, with which scopes, and how calls are logged, are still decisions you have to make.
What to do about it
Before connecting MCP servers to anything real, list them, give each one its own narrowly scoped credential, and log every tool call. Our Build service designs AI and agent systems with evaluations and these controls in from the start. See Build.
