From Protocol to Agent Infrastructure: The MCP Maturation

When Anthropic quietly published the Model Context Protocol (MCP) on a Tuesday afternoon in November 2024, it looked like a developer convenience: a JSON-RPC 2.0 framework, drawing heavily on the design philosophy of the Language Server Protocol, for connecting a model to a tool. The problem it solved was real but narrow — the "N×M integration problem," where connecting ten AI applications to a hundred data sources meant a thousand bespoke connectors. MCP collapsed that to N+M: one server per tool, reusable by any compatible client. The popular shorthand was "USB-C for AI."

What no one fully predicted was that solving the integration problem at the AI layer would position MCP as the defining infrastructure standard of the agentic era. This article traces how MCP moved from protocol to infrastructure, what the 2026 rewrite changed, and — crucially — why a settled transport protocol is not the same as a deployable architecture.

The adoption curve that looked like infrastructure

Infrastructure standards are recognizable by their adoption shape, not their marketing. HTTP became universal not because it was technically superior but because it won cross-vendor adoption at the moment web communication became economically important. OAuth 2.0 won because major platforms converged on it. MCP is following that exact pattern at the inflection point where AI agents become economically important.

The numbers tell the story. OpenAI adopted MCP in March 2025 across its Agents SDK, Responses API, and ChatGPT desktop; Sam Altman's note was simply that "people love MCP." Google DeepMind confirmed support in April 2025, calling it "rapidly becoming an open standard for the AI agentic era." Microsoft shipped MCP servers for GitHub, Azure, and Microsoft 365 through 2025. By April 2026 the MCP Python SDK alone crossed 164 million monthly downloads on PyPI, more than 10,000 public MCP servers were active, and 78% of enterprise AI teams reported at least one MCP-backed agent in production — up from 31% a year earlier (Compute Forecast, 2026). By the July 2026 spec release, both the TypeScript and Python SDKs had crossed one billion total downloads.

That is not the curve of a developer convenience. It is the curve of infrastructure.

The governance event that sealed it

The decisive moment was governance, not technology. In December 2025, Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded by Anthropic, OpenAI, and Block. AWS, Google, Microsoft, Cloudflare, and Bloomberg joined as founding members. The Linux Foundation's track record — Kubernetes, PyTorch, Node.js — gave the protocol the institutional weight enterprise procurement teams require before committing to a foundational standard.

This was a strategic signal, not merely a legal one. When Anthropic handed a protocol it created and controlled to a neutral body governed partly by its largest competitors, it made the same calculation that historically precedes foundational standards: the technology generates more value as ubiquitous infrastructure than as proprietary advantage. IBM donated networking protocols; Sun open-sourced Java; Google open-sourced TensorFlow. MCP joined that lineage.

The protocol grew up

MCP's early design assumed a single AI app talking to a local server over stdio, with a persistent, stateful handshake. That model breaks the moment you deploy behind a load balancer or across regions. Over 2025–2026 the protocol was rebuilt for the cloud-native world it had unexpectedly conquered.

Remote transport and auth. The March 2025 revision replaced the old HTTP+SSE transport with Streamable HTTP and introduced an OAuth 2.1 authorization framework, formally classifying MCP servers as OAuth resource servers. The June 2025 update closed a token-leakage vulnerability by mandating Resource Indicators (RFC 8707): clients must name the target server in token requests, so a rogue server cannot harvest credentials meant for another. Tool annotations (readOnly, destructive, idempotent, open-world) let clients enforce policy — auto-approving safe tools, gating destructive ones.

Discovery and registry. The official MCP Registry launched in preview in September 2025 — an npm-like catalog for servers, with sub-registries for curated sets. Third-party directories (Glama, MCP.so) reached ~18,000 servers each by early 2026. A separate IETF draft proposed an mcp:// URI scheme and a /.well-known/mcp-server manifest for capability discovery.

The 2026-07-28 stateless rewrite. The largest revision since launch, the July 2026 spec removed the initialize handshake and the Mcp-Session-Id header entirely. Every request now carries its protocol version, client identity, and capabilities inside a _meta block — so any request can land on any instance behind a plain round-robin load balancer. New Mcp-Method and Mcp-Name HTTP headers let gateways route and authorize on headers without parsing JSON-RPC bodies. List responses became cacheable with ttlMs hints, stabilizing upstream prompt caches. Server-initiated calls moved to Multi Round-Trip Requests (MRTR), removing the need for held-open bidirectional streams. A formal Extensions framework shipped with MCP Apps (interactive HTML in a sandboxed iframe) and Tasks (a durable state machine for long-running work) as first-class citizens, plus Enterprise-Managed Authorization (EMA) for org-controlled SSO. Authorization hardened further toward OAuth 2.1 + OIDC, with RFC 9207 issuer validation, and a formal 12-month deprecation policy locked the protocol's evolution path.

The practical effect: a remote MCP server that once needed sticky sessions, a shared session store, and deep-packet inspection at the gateway can now run as ordinary serverless infrastructure. As co-creator David Soria Parra put it, "agentic applications are stateful, but the protocol itself doesn't need to be."

The control-plane gap: a transport is not an architecture

Here is the part the protocol war obscured. MCP standardizes how an agent discovers and invokes a tool. It deliberately says nothing about whether the agent should. Authorization semantics — which agent may take which action on whose behalf under what conditions — remain every deployer's homework. A perfectly authenticated MCP server will still cheerfully execute a destructive operation an agent was prompt-injected into requesting; authentication establishes who is calling, not whether the call is wise.

This is the "ungoverned agent problem," and at enterprise scale it is the default state of the ecosystem. The documented gaps:

• Credential sprawl. GitGuardian found 24,008 unique secrets exposed in MCP configuration files in 2025 alone — API keys, database connection strings, OAuth tokens scattered across environment variables and config files, with no single point of revocation.
• No native least-privilege. MCP defines no role-based access control. If an agent can connect, it can discover every tool the server exposes. A support agent sees database-admin endpoints.
• Observability black holes. Direct agent-to-tool connections leave no unified execution timeline, no trace correlation, no cost attribution.
• No cost governance. MCP tracks no token consumption or usage limits; an agent can loop on paid API calls with no budget ceiling.
• Standing attack surface. Prompt injection, tool-permission chaining that exfiltrates data, and lookalike servers that silently replace trusted ones are documented, active patterns. OWASP now codifies supply-chain compromise of agent tooling as ASI04.

The industry's answer is the MCP gateway — a control plane sitting between agents and enterprise systems that provides centralized authentication and identity propagation, RBAC, cryptographic audit trails, rate limiting, DLP, and a kill switch. As Futurum's Mitch Ashley framed it at the 2026 MCP Dev Summit: "The question enterprises are actually asking isn't whether MCP works. It's whether they can govern what it does. That's a control plane problem, not a protocol problem."

The scope boundary held at the summit. MCP connects AI applications to data sources; governance belongs to the layers above. TCP/IP never solved authorization either. It just made the problem worth solving.

The layered agent infrastructure

MCP is now one layer in a small stack of agent-interoperability protocols, each addressing a different tier (Ehtesham et al., arXiv:2505.02279):

The survey proposes a phased roadmap — MCP for tool access, ACP for multimodal messaging, A2A for collaborative execution, ANP for decentralized marketplaces. MCP is the substrate; the others compose on top. Gartner projects that by the end of 2026, 75% of API-gateway vendors and 50% of iPaaS vendors will ship MCP features, and 40% of enterprise applications will embed autonomous agents. The protocol has become the pipe; the agents are the flow.

What builders should take away

The protocol war is over. The rational posture now is not "wait and see" but "build the control plane." Concretely:

1. Treat MCP as settled transport. Stop debating the standard; it won. Stand up your two or three highest-value internal data sources as first-class MCP servers, exposed once, securely, to every agent you'll ever deploy.
2. Inventory before you expand. Most organizations already run dozens of ad-hoc connectors and several unsanctioned MCP servers. Find them first; the 2026 conformance roadmap will publicly separate thin API wrappers from real servers.
3. Stand up the security baseline. Internal allowlisted, version-pinned registry; OAuth/mTLS on every non-local server; per-server least-privilege credentials; configs in version control with drift monitoring; sandboxed execution with egress rules; centralized tool-call audit logs.
4. Add a gateway, not just a server. Centralized identity propagation, RBAC, rate limiting, and DLP are the difference between a demo and a deployable agent.
5. Version and test tool contracts. Two servers can expose tools with identical names and subtly different behavior; the model's interpretation of a loosely worded description is now a production dependency.

MCP earned its place by solving a genuine pain point: the N×M integration tax. It is earning its production credentials through governance maturation the maintainers are actively managing — donation to a neutral foundation, a stateless cloud-native rewrite, and a hardening roadmap driven by enterprise necessity. The vendors that build the control plane above MCP will own the path to production for AI agents. The protocol is no longer the story. The infrastructure around it is.