What is the Model Context Protocol (MCP)?
MCP is an open protocol for connecting AI applications to external tools and data. Anthropic published it in November 2024 and donated it to the Linux Foundation's Agentic AI Foundation on December 9, 2025. The current revision, 2026-07-28, is stateless: every request carries its own version and capabilities, and the initialize handshake is gone.
What MCP standardizes
MCP is a JSON-RPC 2.0 protocol that defines how an AI application discovers and calls capabilities exposed by an outside service. A host runs one client per server, and each server exposes three primitives: tools (functions the model invokes through tools/call), resources (readable data addressed by URI), and prompts (templated messages). That is the entire surface. Auth, transport and registries all sit around it.
The current spec is stateless
Most explanations of MCP still describe the November 2024 design: an initialize handshake, a long-lived session, servers pushing requests back at the client. The 2026-07-28 revision removed all three. Every request now carries its own protocol version and capabilities in _meta, an optional server/discover call replaced the mandatory handshake, and servers answer with an InputRequiredResult instead of initiating their own requests. Two transports survive, stdio and Streamable HTTP. HTTP+SSE has been deprecated since 2025-03-26, and sampling, roots and logging were deprecated in the 2026-07-28 revision with removal possible after 2027-07-28.
The consequence worth knowing: there is no protocol-level session. A server that needs state across calls has to return an explicit handle, such as a basket_id or a browser context id, and accept it as an argument later. Assuming per-connection state is the fastest way to write a server that breaks in production.
What it costs to run
Tool definitions occupy model context on every turn. Anthropic measured one Google Drive to Salesforce workflow falling from 150,000 tokens to 2,000 once definitions stopped loading upfront. Mount a dozen servers globally and the context budget is spent before the first prompt. Load servers per task, and treat tool descriptions and annotations as untrusted input: the spec requires clients to assume annotations are hostile unless the server itself is trusted.
Last updated: May 20, 2026