MCP Explained: Connectors for Users, Protocol for Builders
This content was developed with AI assistance and is regularly reviewed for accuracy.
Snapshot: October 2026. Model names, prices, and product features change monthly; What's New in AI is the maintained chronology.
The Model Context Protocol (MCP) is the open standard that lets an AI assistant or agent reach tools and data outside its own chat window. If you use Claude, ChatGPT, or Gemini, you have almost certainly used MCP without noticing: each connector you switch on inside the app is an MCP server underneath. If you build software, MCP is the protocol you implement once so that every compatible client can call your system. This page covers both sides, explains who now governs the protocol, and shows how to read the ecosystem numbers people quote.
What you'll learn
- What MCP is and the integration problem it removes
- How MCP looks to an everyday user (connectors) versus a builder (servers, tools, transports)
- Who has governed the protocol since December 2025 and what the 2026-07-28 revision changed
- How to read registry and download figures without being misled
The problem MCP solves
Before MCP, every AI platform had its own way to call a tool. A team that wanted Slack access from three assistants built three integrations, each with its own authentication, schema, and bugs. Multiply that by every tool a company uses and you get the "M times N" problem: M assistants, N tools, and M times N connectors to maintain.
MCP collapses that to N. Build one server for Slack, and any MCP client can connect to it. The analogy that stuck is USB-C: one port, many devices, no adapter per brand.
The protocol is a client-server design. The client is the assistant or agent: Claude, ChatGPT, Claude Code, or a script you wrote. The server wraps one system (GitHub, a database, a folder on disk) and advertises what it offers. A client asks "what do you have?", receives a list, and decides mid-conversation when to use an item. Adding a tool to a server needs no change on the client side.
MCP for users: connectors
As an end user you never see JSON or a port number. In Claude, you open the connectors page (claude.ai/customize/connectors), pick a service from Anthropic's reviewed directory (claude.ai/directory), sign in with the service's own login, and the connector's tools appear in your conversations. Connectors you add in claude.ai also appear in Claude Code automatically. ChatGPT exposes the same idea as "apps" chosen from a directory inside the product; those apps are reported to run on MCP underneath, though OpenAI's own pages could not be verified for these notes. Gemini's developer tooling is also reported to speak MCP.
What matters is what a connector grants. Every MCP server exposes some mix of three capabilities:
- Tools: actions the model can call, such as "search messages" or "create issue". Some tools write or delete.
- Resources: data the model can read, such as a file or a record.
- Prompts: reusable instruction templates the server supplies.
The connector you switch on for "read my calendar" may also carry "delete event". Claude Code's Routines documentation is blunt about the consequence: a Routine includes all your connected MCP connectors by default, and Claude can use every tool from an included connector, including writes, without asking. Three habits follow. Choose servers from a reviewed directory. Read the tool list before you rely on a connector. Remove connectors a task does not need. Connect Your First MCP Server walks through each habit, and Supply Context shows where connectors sit alongside files, projects, and memory.
MCP for builders: the protocol
For a developer, MCP is a JSON-RPC protocol with official SDKs. As of the July 2026 release, TypeScript, Python, Go, and C# are Tier 1 SDKs, Rust is in beta, and a Ruby SDK reached 1.0 as a Tier 2 implementation. A server declares tools (each with a JSON Schema for its arguments), resources (addressed by URI), and prompts. The client discovers them through tools/list, resources/list, and prompts/list requests. Since 2026-07-28 those list results carry cache hints (ttlMs, cacheScope) so clients stop re-fetching them on every turn.
Transport is where 2026 changed most. Streamable HTTP is the recommended transport for anything remote. Stdio remains the choice for a local process that your client launches. The older HTTP+SSE transport is deprecated with a one-year offramp, and Claude Code now tries HTTP first. The 2026-07-28 specification, the largest rewrite since launch, also made the core stateless (no handshake, no session header), replaced server-initiated requests with Multi Round-Trip Requests, hardened OAuth, and moved long-running Tasks into a formal extension. If a tutorial still teaches an initialize handshake, Mcp-Session-Id, SSE, sampling, or roots, it predates July 2026. Build and Secure an MCP Server covers the new model step by step.
Who governs MCP
Anthropic released MCP in late 2024 and, on December 9, 2025, donated it to the Linux Foundation as the founding project of the Agentic AI Foundation (AAIF), co-founded with OpenAI and Block. The foundation launched holding MCP, Block's goose agent, and OpenAI's AGENTS.md convention, with Google, Microsoft, AWS, Cloudflare, and Bloomberg among the supporters. It is reported to have passed 170 member organizations by April 2026. Google's Agent2Agent (A2A) protocol is reported to have joined in August 2026, although that date rests on a single source.
Governance is now formal rather than one company's roadmap. The maintainers' roadmap of August 22, 2026 describes working groups that triage proposals in their areas, a contributor ladder, and a feature-lifecycle policy with a twelve-month minimum deprecation window. For a builder, that policy is the practical win: a deprecated feature keeps working for at least a year, so a migration can be planned instead of forced.
How big is the ecosystem (and why the numbers disagree)
Two kinds of figures circulate. Download counts come from the project itself: the 2026-07-28 release post says the Tier 1 SDKs see close to half a billion downloads a month, and that the TypeScript and Python SDKs have each passed one billion total downloads. Treat those as the solid numbers.
Server counts are messier, because every audit counts something different: official servers only, unique servers, or server-plus-version records. All of the following are secondary figures, reported during 2026:
| Snapshot (reported) | Count | What was counted |
|---|---|---|
| February 2026 | about 518 | official servers in a security audit |
| March 2026 | about 3,000 | unique servers |
| May 2026 | about 9,650 latest records; about 29,000 including versions | registry records |
| September 2026 | about 30,000 unique servers from about 99,000 records | one analyst's registry pull, single source |
The honest summary: the registry grew from hundreds to tens of thousands of entries during 2026, and any single number quoted without a date and a method is marketing.
MCP and its neighbours
MCP is one of several open conventions you will meet in agent work. They complement each other rather than compete.
| Standard | What it carries | Governance (October 2026) |
|---|---|---|
| MCP | Tools, resources, and prompts a server exposes | AAIF (Linux Foundation) |
Agent Skills (SKILL.md) | Reusable how-to knowledge a model loads on demand | Open standard; 40+ compatible products reported |
AGENTS.md | Project rules for coding agents | AAIF; 60,000+ repositories reported |
| A2A | Agent-to-agent messaging | v1.0 in 2026; AAIF membership reported |
A useful mental model: MCP gives an agent hands, skills give it know-how, and AGENTS.md or CLAUDE.md gives it house rules. Skills, AGENTS.md, and CLAUDE.md covers the other two.
Security in one paragraph
An MCP server runs code and returns text the model will read. That makes two risks real. Prompt injection is when content a server fetches contains instructions the model follows. Tool poisoning is when a tool's own description smuggles instructions in. Anthropic's guidance to users is three words long: verify every server. Prefer vendor-maintained or directory-reviewed servers, give database servers a read-only user, approve project-level servers interactively, and test any remote connector with fake data before pointing it at real records. Agent Safety and Guardrails covers the wider agent risks; the build page covers server-side defences.
Key takeaways
- MCP is an open protocol: one server per system, usable by every compatible client.
- To users it appears as connectors; what matters is the tool list a connector grants, including writes.
- To builders it is a stateless, HTTP-first protocol since 2026-07-28, governed by the Agentic AI Foundation under the Linux Foundation.
- Quote ecosystem sizes only with a date and a method; download counts are firmer than server counts.
- Verify every server before you connect it, and scope what it can touch.
What's in this section
- This page: the concepts, governance, and numbers.
- Connect Your First MCP Server: the user path through claude.ai connectors,
claude mcp addin Claude Code, and ChatGPT apps. - Build and Secure an MCP Server: the 2026-07-28 specification for builders, with the security baseline.
Next steps
Continue to: Connect Your First MCP Server
- Building agents that use these tools? See Claude Code: Your AI Coding Agent.
- Worried about what a connected agent can do? Read Agent Safety and Guardrails.
- Want an agent that runs on a schedule with connectors? Start with Loops and Harnesses.