MCP explained: how Anthropic’s model context protocol works

The stateless shift in AI connectivity

The industry standard for AI connectivity counts 15,930 public servers across four major registries. Anthropic released the Model Context Protocol in November 2024 to solve the integration problem where developers wrote custom glue code for every model and tool pairing. This protocol reduces the workload from N x M integrations to N + M. The July 28, 2026 specification changed the protocol to a stateless model. This update removes the requirement for a session ID or a handshake between the client and the server.

The protocol scales.

Anthropic donated the protocol to the Agentic AI Foundation in December 2025. This foundation includes members like OpenAI, Microsoft, and Google. The protocol handles the "hands" of an AI system. It does not handle the "brain" or high-level orchestration. The 2026-07-28 release establishes the protocol as production-grade infrastructure.

The 2026 specification introduces Multi Round-Trip Requests to replace the need for held-open bidirectional streams. When a tool needs user confirmation, the server returns an "input_required" result. The client then retries the original call with the necessary answers. This allows the protocol to work over standard HTTP without requiring sticky sessions. The update also adds Mcp-Method and Mcp-Name headers to Streamable HTTP requests. These headers allow gateways and rate limiters to route traffic without parsing JSON bodies.

Architecture and the three primitives

MCP architecture relies on three entities. The host, such as Claude Desktop or an IDE, contains the LLM and manages interactions. The client, residing in the host, translates natural language into JSON-RPC 2.0. The server is the gateway to external data or tools.

Servers present three primitives. Resources provide read-only access to data like file contents or database rows. Tools allow the AI to perform actions such as writing to a database or triggering a deployment. Prompts provide templates for common communication patterns. Python and TypeScript SDKs have passed 1 billion total downloads.

An AI assistant can summarize a Slack conversation and then immediately create a Jira ticket by routing requests through a Slack server and a Jira server, which demonstrates how the host orchestrates multiple connections simultaneously.

Developers use different transport mechanisms. The stdio transport runs servers as local subprocesses. Streamable HTTP supports remote servers deployed on the internet.

Tasks provide a "call-now, fetch-later" pattern for long-running work. This pattern allows an agent to receive a task handle and poll for progress. It prevents the system from blocking on operations that take more than a few seconds. The ecosystem includes specialized servers for many tasks. A PostgreSQL server allows for read-only database access with schema inspection. A Puppeteer server enables browser automation. A Git server allows for the manipulation of repositories. A Google Drive server provides file access and search capabilities.

It works.

Security risks and enterprise deployment

Security creates significant friction. The NSA and CISA issued formal guidance because independent scans found exploitable flaws in a large share of public servers. Prompt injection allows attackers to coerce a model into executing unintended tool calls. If an attacker captures an OAuth token, they can execute data exfiltration at scale.

The "Confused Deputy" scenario arises when flawed delegation or token scope enforcement allows one client or tool to act on behalf of another. This leads to privilege escalation through over delegation. Tool poisoning occurs when attackers hide malicious logic inside tool descriptions or schemas. This creates an invisible exploit surface that influences the model’s decision making.

You already know that connecting an AI to a production database requires strict permission controls.

The 2026 specification includes a 12-month deprecation window for legacy versions. This window provides a period for teams to plan upgrades before the older protocol versions disappear.

The security of many public servers is terrible.

How will developers manage the 12-month migration window for thousands of legacy servers?