The History of the Model Context Protocol: How AI Got a Universal Plug (2026)

In July 2024, an engineer at Anthropic named David Soria Parra got tired of copying and pasting. He would ask Claude Desktop a question, get an answer, and then move that answer by hand into his code editor. The model was capable. It just could not reach anything.

Seventeen months later, the protocol he sketched to fix that annoyance was the connective tissue of the AI industry. ChatGPT, Claude, Gemini, Microsoft Copilot, VS Code and Cursor all speak it. Its two largest SDKs pulled more than 470 million downloads in the 30 days ending July 21, 2026. And it no longer belongs to Anthropic at all.

This is the complete, primary-sourced history of the Model Context Protocol.

TL;DR: MCP is the open standard that lets any AI app talk to any tool through one interface, announced by Anthropic on November 25, 2024 and donated to the Linux Foundation on December 9, 2025. It collapsed the N times M integration problem, shipped four spec revisions in its first year and a half, and goes fully stateless with the fifth on July 28, 2026. Connect your workspace to it.

What Is the Model Context Protocol?

The Model Context Protocol is an open standard that lets an AI application connect to external tools and data through one common interface, instead of one bespoke connector per pairing. It uses JSON-RPC messages, defines three things a server can offer (tools, resources, and prompts), and negotiates a version at connection time. Anthropic published it under an open license on November 25, 2024 and handed governance to the Linux Foundation just over twelve months later.

The shortest useful description is the one the industry settled on: MCP is a universal plug. Before USB, every peripheral shipped its own cable, its own connector, and its own driver. After USB, the peripheral implements the port once and every computer can use it. MCP does that for the space between a model and the world.

Three terms do most of the work, and they are worth getting straight:

A server exposes three kinds of capability. Tools are actions the model can invoke, which is tool calling with a shared wire format. Resources are readable context, like a file or a record. Prompts are reusable templates the host can surface to the user. That split matters more than it looks: it separates "things the model may do" from "things the model may read," which is the seam every permission model since has been built on.

The Problem MCP Solved: N Times M Integrations

Before MCP, connecting 10 AI applications to 100 tools required up to 1,000 separate integrations, each with its own authentication, schema, retry logic, and maintenance burden. A shared protocol turns that multiplication into addition. Ten clients plus one hundred servers is 110 pieces of work, built once, by the party that actually understands each side.

This is the same arithmetic that made the Language Server Protocol succeed in code editors, and it is not a coincidence. Soria Parra brought the idea over from LSP, which his co-creator has said was new to him at the time and made immediate sense once he saw what it solved.

MCP vs API vs Plugin vs Webhook

These four get conflated constantly, and the differences decide which one you should reach for. The clean split is direction, discovery, and who reads the documentation.

The distinction people miss: an API is written for a programmer who reads the documentation before writing a line. An MCP server describes itself at runtime, so the model can list what is available, read the schema, and decide what to call with nobody writing glue code first. That is why MCP servers show up inside agent harnesses rather than inside build pipelines.

Before MCP: The Plugin Era That Did Not Scale

The first serious attempt at giving models hands was the ChatGPT plugin ecosystem, launched in March 2023, and it failed for a structural reason: plugins belonged to one host. A developer who built a ChatGPT plugin could not run it anywhere else. OpenAI stopped new plugin conversations on March 19, 2024 and retired the program entirely on April 9, 2024, folding the capability into GPTs and Actions.

Three things happened in that window that made MCP both possible and necessary:

• June 2023: function calling. Models learned to emit structured calls against a schema you supplied. This solved the model's half of the problem and left the plumbing entirely to you. See function calling and tool use for the mechanics.
• 2023 to 2024: everyone built the same connector twice. Each AI product wrote its own GitHub integration, its own Slack integration, its own database reader. All the same work, none of it shared.
• 2024: agents made it urgent. A chatbot with one tool is a feature. An agent that plans across ten tools needs those ten tools to behave consistently, or it cannot recover from a failure.

The Language Server Protocol had already proven the fix in a neighboring domain. Microsoft published LSP in 2016 so that one language implementation could serve every editor instead of one plugin per editor. MCP is the same trade applied to models rather than editors, and it kept both halves of what made LSP work: the N times M insight, and JSON-RPC as the message format.

July 2024: A Frustrated Engineer and a Protocol Borrowed From Editors

MCP started as an internal-tooling irritation, not a strategy. In an interview with Latent Space, Soria Parra described joining Anthropic a few months earlier, appreciating what Claude Desktop could do, and being unable to extend it. He kept moving work by hand between the chat window and his editor.

He took the idea to Justin Spahr-Summers, and the two started on it almost immediately after that conversation. By Spahr-Summers' account they spent a couple of months on what he called the really unrewarding bits, the specification and plumbing work that has to exist before anything looks impressive. The public record backs the timeline: the specification repository was created on GitHub on September 24, 2024, two months before anyone outside Anthropic heard the name.

The moment it stopped being a side project was an internal hackathon about a month before launch. Employees built MCP servers for whatever they had lying around, including one that drove a 3D printer. That is a strange proof point and also a perfect one: if a protocol designed for documents and databases can drive a printer without changes to the protocol, the abstraction is right.

One decision from that period shaped everything after it. The first editor to run MCP was not an Anthropic product. It was Zed, the third-party editor, and Soria Parra says he wrote that implementation himself and had it working about a month and a half before the public release. A protocol whose first integration lands in somebody else's product, in the open, is much harder to read as a land grab.

November 25, 2024: The Launch

Anthropic announced MCP publicly on November 25, 2024, open-sourcing the specification, SDKs for Python and TypeScript, local server support in Claude Desktop, and a repository of prebuilt servers for Google Drive, Slack, GitHub, Git, Postgres, and Puppeteer. The launch spec carried the version string 2024-11-05.

The reference server repository had been created on GitHub six days earlier, on November 19, 2024. It now has over 88,000 stars.

Six companies were named as early adopters on day one, and the mix was the point: Block and Apollo on the enterprise side, Zed, Replit, Codeium, and Sourcegraph on the developer-tools side. Anthropic shipped no competing product in either category, which made the "open standard" framing credible rather than defensive.

"Open technologies like the Model Context Protocol are the bridges that connect AI to real-world applications, ensuring innovation is accessible, transparent, and rooted in collaboration."

Dhanji R. Prasanna, Chief Technology Officer, Block (Anthropic announcement, November 25, 2024)

The Complete Model Context Protocol Timeline

Every date below is verified against a primary source: the protocol's own specification and blog, the announcing company's post, or a public repository record.

The last row is the only one that has not happened yet. As of July 23, 2026 the current published revision is still 2025-11-25, and 2026-07-28 is a release candidate in its final validation window.

How MCP Actually Works

An MCP connection is a conversation between four parties, and understanding the shape explains most of the design decisions. The host application owns the model and the user interface. It spawns one client per server. Each server wraps exactly one system and advertises what it can do. The model never touches the network directly.

Two transports matter. stdio runs the server as a local subprocess, which is how most desktop setups work and why the earliest MCP servers were command-line programs. Streamable HTTP runs the server remotely over a normal web endpoint, which arrived in the 2025-03-26 revision and replaced the original HTTP-plus-server-sent-events design. Remote transport is what turned MCP from a power-user desktop trick into something a company can host.

Each server capability answers a different question, and hosts treat them differently:

Two of those are on their way out. The 2026-07-28 release candidate deprecates Sampling, Roots, and Logging under the protocol's new feature lifecycle policy, pointing servers at direct provider APIs, tool parameters, and standard observability tooling instead. Deprecation is annotation-only: the methods keep working, and the policy guarantees at least twelve months before anything can be removed.

2025: The Year Every Rival Adopted It

MCP won the format war in four months, and the deciding move came from a competitor. On March 26, 2025 Sam Altman posted that OpenAI would add MCP support across its products, starting that day in the Agents SDK. Two weeks later Demis Hassabis committed Google's Gemini models and SDK. By May, an operating system had joined.

The May 1, 2025 Claude Integrations launch is the one worth pausing on. It brought remote MCP servers to the web with ten partners at once, including Atlassian, Zapier, Cloudflare, Intercom, Asana, Square, PayPal, Linear, and Plaid. Until that day, using MCP meant editing a JSON config file on your own machine. After it, connecting a tool meant clicking a button.

The Spec Revisions, and What Each One Fixed

One revision reversed itself, which is a healthy sign in a young protocol. JSON-RPC batching was added in 2025-03-26 and removed one revision later in 2025-06-18, three months after it arrived.

Security: The Bill for Trusting Tool Descriptions

MCP's central convenience is also its central risk: a tool description written by a third party lands in the model's context as trusted text. Invariant Labs disclosed this as tool poisoning in April 2025, showing that instructions hidden in a tools/list response are read by the model and normally never displayed to the user. In May 2025 the same researchers demonstrated a live exploit against the widely used GitHub MCP server, where a malicious issue in a public repository could steer an agent into leaking private repository contents. Notably, that attack required no compromised tool at all.

The specification has been paying that bill down ever since:

• 2025-06-18 classified MCP servers as OAuth Resource Servers, added protected resource metadata for discovering the authorization server, and required clients to implement RFC 8707 resource indicators so a malicious server cannot harvest a token meant for someone else.
• 2025-11-25 added OpenID Connect Discovery, incremental scope consent through WWW-Authenticate, and URL-mode elicitation so credentials can be collected out of band rather than typed into a chat.
• 2026-07-28, still a release candidate, requires clients to validate the iss parameter on authorization responses per RFC 9207, has clients declare an OpenID Connect application_type during dynamic registration, and introduces a formal deprecation policy with a minimum twelve-month window before a feature can be removed.

The practical guidance has not changed since 2025. Treat every third-party MCP server as untrusted code running with your credentials. Scope tokens to the narrowest resource that does the job, keep a human approval step on destructive actions, and prefer servers you or your vendor operate. This is the same discipline that agent permissions and agent sandboxes exist to enforce, and it is why the agent environment is now a design surface rather than an afterthought.

December 9, 2025: MCP Leaves Anthropic

Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation, on December 9, 2025. The founding companies were Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, Cloudflare, and Bloomberg. At handover the project reported 97 million monthly SDK downloads and more than 10,000 active servers.

The governance split is the interesting part. The foundation board handles money, membership, and new-project approval. MCP itself keeps full autonomy over technical direction, its existing maintainer structure, and its community proposal process, where changes arrive as numbered SEPs that anyone can file. The first-birthday post two weeks earlier, on November 25, 2025, counted 58 maintainers around a steering group of 9, a Discord contributor community past 2,900, and more than 100 new contributors joining every week.

Donating a standard you invented is a real cost and a rational one. A protocol controlled by one lab is a protocol every other lab has a reason to fork. Handing it to a neutral foundation is what turns adoption into permanence.

2026: MCP Goes Stateless

The 2026-07-28 revision is the first deliberate breaking change in MCP's history, and it exists because the original design assumed a desktop. The release candidate was locked on May 21, 2026 and the final specification is scheduled for July 28, 2026, which makes the ten weeks in between a validation window rather than a victory lap. The maintainers describe it as the largest revision of the protocol since launch, and say plainly that it contains breaking changes.

Two removals do the work. SEP-2575 deletes the initialize and initialized handshake. SEP-2567 deletes the Mcp-Session-Id header and the protocol-level session it implied. Protocol version, client info, and client capabilities now ride along in per-request metadata, and a new server/discover method fetches server capabilities when a client wants them up front.

  BEFORE  (2024-11-05 through 2025-11-25)      AFTER  (2026-07-28)
  ------------------------------------------   ------------------------------------
  client  --> initialize            --> srv    client --> request (+ _meta) --> any
  client  <-- capabilities          <-- srv    client <-- response          <-- any
  client  --> initialized           --> srv
  client  --> request (Mcp-Session-Id) --> srv  no handshake
  client  <-- response                 <-- srv  no session id
                                                no sticky routing
  every later request must reach THE SAME       every request may reach ANY
  server instance that did the handshake        healthy server instance

The practical consequence is boring and enormous: an MCP server can now sit behind an ordinary round-robin load balancer with no sticky sessions and no shared session store. That is the difference between a protocol that runs on a laptop and one that runs a public service. It also reframes a long-standing design question about whether agent connections should be stateless or stateful, and the answer the protocol chose is to push state into task handles rather than into the connection. What used to live in a protocol-level session now lives in the agent session above it, where the host can actually reason about it.

Three other changes ship alongside it. The extensions framework existed in 2025-11-25 but had no formal process behind it, so the new revision gives extensions reverse-DNS identifiers, independent versioning, and their own repositories, and the core stays small. MCP Apps graduates from proposal to official extension, letting servers ship interactive HTML interfaces that the host renders in a sandboxed iframe. And tasks move from experimental core feature to an extension, reshaped around stateless operation, which means anyone who built against the 2025-11-25 experimental tasks API has a migration to do.

MCP Apps deserves its own note. The proposal, SEP-1865, was announced on November 21, 2025 and co-authored by core maintainers from both OpenAI and Anthropic alongside the creators of MCP-UI. Two labs competing directly on frontier models jointly wrote one interface standard. That is the clearest signal available that MCP stopped being anybody's strategy and became infrastructure.

What MCP Still Does Not Solve

MCP standardizes how a model reaches a tool. It says nothing about whether that tool is any good. Four gaps remain open in July 2026:

• Quality is unranked. The registry is a catalog, not a review board. A server with a thoughtful schema and a server that returns 40,000 tokens of unfiltered JSON look identical from the outside.
• Context budget is the host's problem. Connect six servers exposing thirty tools each and you have spent a meaningful share of the context window before the user has typed anything. This is exactly the territory that context engineering covers.
• Descriptions are unverified prose. The model decides what to call based on text a stranger wrote. Better tool naming guidance landed in 2025-11-25, but the incentive to oversell a tool is structural.
• Multi-agent coordination is out of scope. MCP connects a model to a tool. Connecting an agent to another agent is a different problem, addressed by the agent-to-agent protocol and by the handoff patterns that multi-agent designs rely on.

None of these are protocol failures. They are the layer above the protocol, which is where product design lives, and it is the same layer that decides whether an agent stack actually works in production.

How Taskade Fits: A Hosted MCP Server for Your Real Work

Taskade runs a hosted MCP server, so the AI tools you already use can work with your actual projects instead of a copy you pasted into a chat window. Connect Claude Desktop, Cursor, VS Code, Windsurf, or any MCP-compatible client, and the assistant can list your agents, projects, and automations, then pull a full project in to work with it. The Taskade MCP server guide has the setup, and a recent release widened the connection so those tools can create and change work, not only read it.

The connection runs one direction, which is the part worth being precise about:

• Inbound, on every paid plan: your workspace becomes an MCP server other tools can call. See the hosted server walkthrough and the Claude and Cursor setup.
• Outbound is not available on any plan: nothing inside Taskade connects out to third-party MCP servers today. Agents get their reach from 34 built-in tools and from Taskade's own integration layer instead.

That is one half of the picture. The other half is that the project on the far end of the connection is a real one, with 7 views (List, Board, Calendar, Table, Mind Map, Gantt, and Org Chart, with timelines living inside Gantt), 100+ bidirectional integrations, and automations that keep running after the chat window closes. Taskade EVE, the agent that orchestrates work across those surfaces, draws on 15+ frontier models from OpenAI, Anthropic, Google, and open-weight providers. Paid plans start at $10 per month billed annually on the pricing page, and you can see what people have built on the community gallery.

The reason this matters for a history post: MCP made the connection standard, and the interesting question moved one layer up. Not "can my AI reach my data," but "is what it reaches worth reaching."

Frequently Asked Questions

Further Reading

Protocol and history:

• What is the Model Context Protocol? and the split between MCP servers and MCP clients
• Tool calling, function calling, and tool use, the mechanics MCP standardized
• Agent harness and agent tools, the layer that decides what an agent may reach
• The history of workflow automation and the history of Mermaid.js, two other standards that won by being boring

Building with it:

• The best MCP servers and an MCP server comparison
• Building a hosted MCP server and turning an OpenAPI spec into one
• The Taskade MCP server and what MCP means for everyday work
• Agent harnesses explained and agentic design patterns
• The developer API for the cases MCP does not cover

MCP's real achievement was not technical elegance. It was restraint. A protocol small enough that a competitor could adopt it in four months, open enough that its first client belonged to somebody else, and boring enough to hand to a foundation before it became leverage. That is how a standard wins: the same way Memory, Intelligence, and Execution compound inside a workspace, by being reliable long enough that everything else can be built on top of it.

▲ ■ ●

Connect your workspace to any MCP client →