Protocol Primacy: How MCP Became the Connective Tissue of the Agent Economy

Ninety-seven million monthly SDK downloads. That was the adoption figure the Model Context Protocol’s maintainers published on Dec. 9, 2025, the day Anthropic donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation, alongside 10,000 active servers and first-class client support in ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot and Visual Studio Code. Mike Krieger, Anthropic’s chief product officer, described the origin in the foundation’s press release that day: “MCP started as an internal project to solve a problem our own teams were facing.” Thirteen months separate that origin from the download count. This article records the dated milestones of MCP’s ascent, weighs the adoption data against its caveats, explains why a tool protocol won the first round of agent standardization, and prices the security record that arrived with it.

Model Context Protocol Milestones, Dated

Anthropic introduced MCP on Nov. 25, 2024, as an open standard for connecting language models to external tools, systems and data sources; engineers David Soria Parra and Justin Spahr-Summers built it, according to the protocol’s Wikipedia entry. OpenAI adopted the standard in March 2025 after integrating it across products including the ChatGPT desktop app. Google DeepMind followed on April 9, 2025, per TechCrunch coverage cited in the same entry. September 2025 brought MCP support to ChatGPT apps. The donation on Dec. 9, 2025, bundled MCP with Block’s goose agent and OpenAI’s AGENTS.md convention, which the Linux Foundation said 60,000-plus open-source projects had adopted; AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI signed on as platinum members. Four months later, in April 2026, the foundation hosted the MCP Dev Summit North America in New York, which drew roughly 1,200 attendees.

Compression is the point. A specification that traveled in 13 months from one vendor’s internal tooling to a foundation backed by every hyperscaler owed its speed to competitors, since the two labs that adopted MCP first, OpenAI and Google DeepMind, were Anthropic’s direct rivals in the model market, and each had commercial reasons to prefer a standard it could shape over a standard it would have to build.

MCP Adoption Data: Downloads, Servers, Searches and Production Use

The headline numbers carry provenance of varying quality. Both the 97 million monthly SDK downloads and the 10,000 active servers are the project’s own count, published on its blog on Dec. 9, 2025, and repeated in the Linux Foundation release. Registry data compiled by DigitalApplied on May 24, 2026, from the official MCP registry API showed 9,652 latest-version server records, 28,959 server-version records, 15,926 GitHub repositories tagged mcp-server and 86,148 stars on the reference servers repository. Stacklok’s “State of MCP in Software 2026” survey, as cited in the same compilation, found 41% of software organizations running MCP in production, split between 29% in limited use and 12% in broad use, with 45% inside the software-industry cohort. Search demand tracked the same curve: Exploding Topics flagged “Model Context Protocol” on March 2, 2026, at 40,500 monthly searches, up 4,400% over two years, with a trajectory label placing the term at or near its peak.

Two caveats apply. Exploding Topics publishes proprietary estimates that run high relative to advertiser keyword tools, so the 40,500 figure works as an ordinal signal of attention and little more. DigitalApplied is a secondary compilation; its registry counts trace to an API query on a single date, and the Stacklok percentages come from a vendor survey whose sample size the compilation omits.

O’Reilly’s June 8, 2026, edition of “The AI Agents Stack” used the 97 million figure as the anchor for its integration layer. Paolo Perrone’s stack places MCP as the tool-connection standard beneath frameworks and above the model tier, which matches the position the protocol’s first-class clients occupy in practice: every major coding agent and every major chat product speaks it.

Why a Tool Protocol Won: Client-Side Network Effects

The economics of MCP adoption differ from those of agent-to-agent standards. Six first-class clients concentrate demand, and a server written once against the specification reaches all of them, so the marginal server costs its author one integration and gains six distribution channels. Agent2Agent, by contrast, requires two independently built agents to agree before either gains anything, which is why the Linux Foundation counted A2A’s first year in organizations, 150-plus on April 9, 2026, while MCP counted in downloads and servers. One side of the MCP market was already consolidated when the protocol appeared. That asymmetry did the work.

A supply glut follows. Ten thousand servers against six major clients implies that most servers compete for attention inside a client’s tool list, and the market has begun to price that competition. Glean said on May 28, 2026, that its retrieval was “2.5x preferred over off-the-shelf MCP tools” while using 30% fewer tokens, a vendor-published benchmark that marks where the competitive frontier moved: away from raw connectivity and toward curated context. Primitives AI’s March 6, 2026, survey of the infrastructure stack found the MCP tooling and marketplace segment still open, with several contenders and a leader yet to emerge.

Cloudflare made tools a billable unit. Its Monetization Gateway, launched July 1, 2026, charges agents for “web pages, datasets, APIs, or MCP tools” through the x402 payment standard, and on Aug. 4, 2026, the company added stablecoin Wallets and cloudflare.pay identity handles for agents, according to Search Engine Journal’s Aug. 12 report. A protocol that began as a way to read a database table now carries a price per call. Rent extraction on tool calls is the business model MCP made possible, and the servers most exposed to it are the commodity connectors the registry counts in thousands.

MCP Security: Tool Poisoning, Path Traversal and an Espionage Campaign

Security arrived with adoption. In April 2025, four months after launch, security researchers published an analysis identifying multiple outstanding issues with MCP, including prompt injection and poisoned tools that enabled data exfiltration through other connected tools, per the protocol’s Wikipedia entry. O’Reilly’s 2026 stack piece cites a study that found 82% of analyzed MCP servers susceptible to path traversal and 67% to code injection; both figures are secondary, carried by O’Reilly from a study whose primary text remains to be checked against its sample.

Operational proof came on Nov. 13, 2025, when Anthropic disclosed the first documented large-scale cyber-espionage campaign executed mostly by AI: a group the company attributed with high confidence to the Chinese state used Claude Code and MCP to target about 30 organizations across technology, finance, chemicals and government, with AI performing 80% to 90% of the work and four to six human decision points per operation. MCP was the tool bus. The same day MCP joined the foundation, Dec. 9, 2025, the OWASP GenAI Security Project released its Top 10 for Agentic Applications with 100-plus contributors; two entries map directly onto MCP deployments, ASI02 (tool misuse and exploitation) and ASI04 (agentic supply chain vulnerabilities). An MCP server is a dependency with execution rights. It deserves the provenance checks, signing and least-privilege scoping that package registries took a decade to standardize.

Governance After the Donation: What the Agentic AI Foundation Changes

Ownership changed; control stayed put. The MCP blog stated that the people deciding the protocol’s direction remain “still the maintainers who have been stewarding it,” that individual projects keep full autonomy over technical direction, and that changes flow through the SEP process with community input. Krieger framed the move as a guarantee that the protocol stays open and neutral as it becomes critical infrastructure, and pointed to enterprises deploying it on AWS, Google Cloud and Azure as the constituency that wanted the guarantee. Procurement comfort is what a foundation sells. A protocol owned by one model vendor is a supplier risk on a purchasing checklist; the same protocol under a neutral steward with eight platinum members clears the checklist.

Three governance risks survive the transfer. First, the platinum roster contains every hyperscaler and the two largest labs, and a directed fund gives funders a seat at the budget, so the incentives of the steward and the incentives of the largest clients now overlap in ways a single-vendor protocol at least made visible. Second, velocity and stability pull in opposite directions: the 97 million downloads describe a developer base that wants features, while the 12% of software organizations in broad production want a frozen surface. Third, the registry is a chokepoint. Whoever curates 9,652 records decides discoverability, and Cloudflare’s gateway shows discoverability converting into revenue. TechCrunch’s Dec. 9, 2025, report framed the foundation as an effort to standardize the agent era; standardization also decides who collects the tolls on it.

What to Watch

Stacklok’s next survey will show whether the 41% production figure climbs or whether broad use stalls at 12%, which would signal that security review, and the ASI04 supply-chain question, gates the second wave. Registry consolidation matters more than registry growth: a fall in server-version records alongside a rise in production use would indicate that curation has begun. Cloudflare’s paid MCP tools ride on x402, whose on-chain settlement volume had fallen 93% year to date by Aug. 13, 2026, so the first evidence of tool-call revenue will come from the gateway’s own disclosures. Exploding Topics’ near-peak label for the search term deserves a check at the next MCP Dev Summit. Watch, too, for the next incident disclosure that names MCP as the tool bus, because the Nov. 13, 2025, campaign established that the protocol’s reach is available to attackers on the same terms it is available to everyone else.