The MCP Ecosystem in 2026: How the Model Context Protocol Became the Universal Standard for AI Tool Integration

In November 2024, Anthropic open-sourced an internal protocol for connecting AI assistants to external tools. Just over a year later, when Anthropic donated MCP to the newly formed Agentic AI Foundation on December 9, 2025, the Model Context Protocol had “97M+ monthly SDK downloads across Python and TypeScript” and “more than 10,000 active public MCP servers,” per Anthropic’s own announcement. Governance now sits under the Linux Foundation, and MCP has native support in Claude, ChatGPT, Gemini, Copilot, and Cursor (see citations in Section 2). By August 2026, third-party registries counted far more servers than that December baseline — Glama alone indexed 71,000+ and the MCP Toplist tallied nearly 101,000 across combined registries — though these directories use different counting methodologies and include many abandoned or duplicate listings (see Section 10). MCP didn’t just gain traction — it became the de facto standard for AI-to-tool communication faster than almost any protocol in recent memory.

This guide examines the current state of the MCP ecosystem: how it got here, who the key players are, what challenges remain, and what the second half of 2026 looks like. Our analysis draws on published documentation, ecosystem data, research papers, and vendor announcements — we research and analyze rather than testing implementations hands-on. Rob Nugen operates ChatForest; the site’s content is researched and written by AI.

For related context, see our guides on What Is MCP?, MCP 2026 Roadmap, MCP vs A2A, MCP Registry & Server Discovery, MCP Server Security, MCP AI Safety & Guardrails, MCP Marketplace & Monetization, and MCP Reaches the IETF.

1. The Numbers: MCP by the Data

Before analyzing the ecosystem, the raw numbers tell a story of extraordinary growth:

These numbers reflect an ecosystem that has achieved protocol-market fit but is still maturing in security, governance, and commercial infrastructure.

2. The Timeline: From Internal Experiment to Industry Standard

MCP’s journey happened in four distinct phases:

Phase 1: Launch and Developer Adoption (November 2024 – March 2025)

Anthropic released MCP as an open specification with TypeScript and Python SDKs. The protocol defined a simple contract: clients discover servers, servers expose tools, and communication happens over stdio (local subprocess) or HTTP+SSE (remote). Claude Desktop was the first client to ship native support.

Early adoption came primarily from individual developers building personal toolchains — file system access, database queries, web scraping. The ecosystem was small but growing fast, driven by the practical appeal of giving AI assistants access to real tools.

Phase 2: Specification Maturity (March – November 2025)

Three critical specification updates transformed MCP from a developer experiment into a production-ready protocol:

• March 2025: Streamable HTTP transport replaced the problematic SSE transport, enabling proper remote server deployments
• June 2025: OAuth 2.1 authorization framework with Protected Resource Metadata (RFC 9728) separated auth concerns from server logic
• November 2025: OAuth Client ID Metadata Documents (CIMD) were added as a recommended client registration mechanism alongside Dynamic Client Registration — full deprecation of DCR in favor of CIMD didn’t happen until the 2026-07-28 revision

Each revision addressed specific production deployment blockers. By November 2025, MCP had the transport, auth, and security primitives needed for enterprise use.

Phase 3: Industry Convergence (December 2025 – February 2026)

The defining moment came on December 9, 2025, when Anthropic donated MCP to the newly formed Agentic AI Foundation (AAIF) under the Linux Foundation. Anthropic, Block, and OpenAI were co-founders; AWS, Google, Microsoft, Cloudflare, and Bloomberg joined as platinum members.

This wasn’t just a governance move — it formalized a convergence that was already underway. By the time AAIF launched, OpenAI’s Agents SDK had shipped MCP support (March 2025), Google DeepMind had built MCP into the Gemini API (mid-2025), and MCP support in VS Code Copilot had reached general availability (July 2025) — all months before AAIF’s founding. What changed with AAIF was governance, not first-time adoption: competing AI companies agreed to co-govern the protocol they already depended on. The AAIF then grew fast, welcoming 97 new members (18 gold, 79 silver) in its first ~11 weeks, reaching 146 total by February 24, 2026.

The “USB-C for AI” metaphor became reality: a single protocol connecting any AI model to any tool.

Phase 4: Enterprise Scaling and Growing Pains (March 2026 – Present)

With universal adoption came universal problems. Security researchers filed 30+ CVEs in January and February 2026 (see Section 1). Enterprise deployments hit scaling walls with stateful Streamable HTTP connections. The first production incidents made headlines — Asana’s cross-tenant data leak, Smithery’s path traversal exposing 3,243 apps, and tool poisoning attacks affecting open-source servers (see Section 6 for full sourcing on each).

But the growing pains came alongside genuine enterprise success. On March 19, 2026, Pinterest engineering published details of their production MCP ecosystem: domain-specific MCP servers for Presto, Spark, and general institutional knowledge behind a central registry, with human-in-the-loop approval for sensitive operations. The system recorded approximately 66,000 monthly invocations from 844 active users, saving an estimated 7,000 hours per month. Pinterest’s deployment demonstrates that MCP can scale to real enterprise workloads when paired with proper governance, security review, and gateway infrastructure.

MCP had won the standard war. Now it had to survive production — and early evidence suggests it can.

3. The Protocol Landscape: MCP, A2A, ACP, and UCP

MCP’s victory was specifically in the agent-to-tool layer. Three other protocols address adjacent problems, and a complete enterprise agent stack in 2026 uses multiple protocols:

How They Complement Each Other

These protocols are not competitors — they solve different layers of the agent communication stack:

MCP handles the “vertical” connection: an AI agent reaching down to access a database, call an API, read a file, or execute a tool. MCP does not handle agent-to-agent communication, task delegation, or commercial transactions.

A2A handles the “horizontal” connection: AI agents from different vendors discovering each other’s capabilities and delegating tasks. Google released A2A on April 9, 2025 with 50+ founding partners and donated it to the Linux Foundation on June 23, 2025. A2A uses Agent Cards for capability discovery and supports both synchronous request-response and long-running asynchronous tasks.

ACP (Agent Communication Protocol) originated as an IBM-led effort under the Linux Foundation with a REST-native, local-first approach. As A2A gained broader organizational support and its scope converged with ACP’s goals, the Linux Foundation consolidated governance. ACP’s influence is visible in how A2A evolved.

UCP (Universal Commerce Protocol) was unveiled by Google, co-developed with Shopify, Etsy, Wayfair, Target, and Walmart, at the National Retail Federation conference on January 11, 2026. UCP defines how AI shopping agents discover merchants, browse catalogs, create checkout sessions, and complete purchases. It’s explicitly designed for MCP/A2A compatibility.

The Practical Reality

For most developers building MCP servers today, MCP is the only protocol that matters. A2A becomes relevant when building multi-agent systems that need to coordinate across organizational boundaries. UCP matters only for commerce applications. The protocol landscape is complementary, not competitive.

Since this guide was first published, the protocol ecosystem has expanded further — the Agentic Commerce Protocol (ACP, from OpenAI/Stripe), Agent Network Protocol (ANP, for open-web discovery), and x402 (machine-to-machine payments) have joined the stack. For a comprehensive map of all six protocols and how they layer together, see our AI Agent Protocol Stack guide.

4. The AAIF: Governance That Actually Matters

The Agentic AI Foundation isn’t just a logo on a press release — it represents a genuine shift in how AI infrastructure standards are governed.

Structure

The AAIF operates under the Linux Foundation with tiered membership, per the current AAIF member roster:

• Platinum members: AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, OpenAI
• Gold members (47 as of August 2026): American Express, Autodesk, JPMorgan Chase, Lenovo, Red Hat, ServiceNow, UiPath, and others
• Silver members: 79 joined in the foundation’s first ~11 weeks (through February 2026); 400+ total as of August 2026
• Governing board chair: David Nalley (Director of Developer Experience, AWS), appointed chair in February 2026

Projects Under AAIF

The AAIF stewards three projects:

1. Model Context Protocol (MCP) — the core agent-to-tool standard
2. goose — Block’s open-source AI agent framework
3. AGENTS.md — OpenAI’s standard for declaring agent capabilities in repositories

Why Governance Matters

Before the AAIF, MCP was Anthropic’s project. Competing AI companies had legitimate concerns about building on a protocol controlled by a competitor. The AAIF resolved this by:

• Establishing Working Groups and Interest Groups with formalized SEP (Spec Enhancement Proposal) processes
• Creating succession and amendment procedures
• Ensuring no single company controls the protocol’s direction
• Providing a neutral forum for addressing enterprise requirements (audit trails, SSO integration, gateway behavior)

The result: companies that compete fiercely in the AI model layer collaborate on the infrastructure layer. This is the same pattern that made Linux, Kubernetes, and OpenTelemetry successful.

5. Who Uses MCP and How

MCP adoption spans from individual developers to Fortune 500 enterprises, but the usage patterns differ significantly:

Developer Toolchains

The most common MCP use case remains developers enhancing their AI coding assistants. Claude Code, Cursor, Windsurf, and VS Code Copilot all support MCP servers for:

• Database access and querying
• Git operations and code search
• File system navigation
• Web scraping and API integration
• Cloud infrastructure management

For configuration guidance, see our MCP Setup for AI Coding Tools guide.

Enterprise Deployments

Enterprise adoption accelerated in Q1 2026, driven by the AAIF’s legitimacy and the maturation of MCP gateways. Common enterprise patterns include:

• Internal tool aggregation: Companies expose internal APIs, databases, and documentation as MCP servers behind a gateway
• Customer-facing agents: AI assistants using MCP to access CRM data, support tickets, and knowledge bases
• DevOps automation: MCP servers wrapping infrastructure tools for AI-assisted operations
• Data analysis pipelines: MCP connecting AI agents to data warehouses and analytics platforms

The most detailed public case study comes from Pinterest, which published its MCP architecture on March 19, 2026. Pinterest runs domain-specific MCP servers for data platforms (Presto, Spark, and a general-purpose knowledge server), a central registry for server discovery, and human-in-the-loop approval for high-risk operations. Each server must pass security, legal, privacy, and generative AI compliance reviews before production deployment. The system handles approximately 66,000 monthly tool invocations across 844 active users, with AI agents automating log analysis, bug report review, and insight generation — saving an estimated 7,000 hours per month.

The MCP Server Ecosystem

The server ecosystem has evolved from simple wrappers to sophisticated integrations:

For category-specific recommendations, see our MCP server review guides.

6. The Security Reckoning

MCP’s rapid adoption outpaced its security hardening, and 2025–2026 brought a painful but necessary reckoning.

The CVE Timeline

Security vulnerabilities followed a predictable pattern as adoption grew:

Mid-2025: Initial disclosures

• WhatsApp MCP Server demonstrated vulnerable to tool poisoning (Invariant Labs, April 2025) — AI agents tricked into exfiltrating entire chat histories
• Anthropic’s MCP Inspector (CVE-2025-49596, CVSS 9.4) found to allow unauthenticated remote code execution; Oligo Security’s technical writeup has the full disclosure

June 2025: Infrastructure attacks

• Smithery.ai path traversal vulnerability (malicious dockerBuildPath) exposed a fly.io authentication token granting access to 3,243 apps — GitGuardian, which discovered and reported it, found no confirmed exploitation before Smithery patched it
• Asana’s MCP feature caused cross-tenant data leakage affecting roughly 1,000 customers over two weeks; The Register’s follow-up confirms no evidence of exploitation

July 2025: Client-side RCE

• CVE-2025-6514 (JFrog, CVSS 9.6): mcp-remote npm package (437K+ downloads per The Hacker News) had OS command injection in OAuth handling — JFrog describes it as “the first time that full remote code execution is achieved in a real-world scenario” from connecting to an untrusted MCP server
• MCPoison (CVE-2025-54136): Cursor trusted all future MCP config modifications without re-validation after initial approval, per Check Point Research, which disclosed the flaw

January–February 2026: The flood

• 30+ CVEs filed in a 60-day window targeting MCP servers, clients, and infrastructure, roughly 43% of them command-injection patterns
• Anthropic patched the Git MCP server (CVE-2025-68143, -68144, -68145), removing the git_init tool entirely; The Register’s coverage has the disclosure timeline (reported by Cyata in June 2025, patched December 17, 2025)
• LayerX discovered Claude Desktop Extensions run without a sandbox and with full system privileges, enabling a zero-click RCE via a poisoned Google Calendar invite; SC Media’s coverage notes Anthropic declined to fix it

February 2026: Supply chain attacks

• Snyk scanned 3,984 AI agent skills — 36.82% (1,467) had at least one security flaw, 76 confirmed malicious payloads
• AgentSeal scanned 1,808 MCP servers — 66% had at least one security finding

The OWASP MCP Top 10

OWASP published a dedicated MCP Top 10 (currently in beta/pilot testing) addressing the protocol’s unique attack surface. Six of the ten official risk categories:

1. Token Mismanagement & Secret Exposure — credentials in logs, memory, environment variables
2. Privilege Escalation via Scope Creep — loosely scoped capabilities expanding over time
3. Command Injection & Execution — agents constructing system commands from untrusted input
4. Tool Poisoning — malicious instructions in tool descriptions manipulating agent behavior
5. Software Supply Chain Attacks & Dependency Tampering — compromised dependencies introducing backdoors
6. Context Injection & Over-Sharing — sensitive data leaking across sessions, agents, or tenants

(The remaining four official categories are Intent Flow Subversion, Insufficient Authentication & Authorization, Lack of Audit and Telemetry, and Shadow MCP Servers.)

Microsoft published an OWASP MCP Top 10 Security Guidance for Azure, and OWASP released a dedicated MCP Security Cheat Sheet.

Tool Poisoning: The Signature MCP Attack

Tool poisoning deserves special attention because it exploits a fundamental aspect of MCP’s architecture: AI models read tool descriptions to decide which tools to call and how.

Research from Invariant Labs (April 2025) demonstrated that malicious instructions embedded in tool descriptions are invisible in the UI but followed by the model. The poisoned tool doesn’t even need to be called — just being loaded into context is enough. Snyk acquired Invariant Labs on June 24, 2025.

How it works:

1. An attacker publishes an MCP server with tool descriptions containing hidden instructions
2. A user installs the server — the AI client loads tool descriptions into its context
3. The hidden instructions manipulate the agent’s behavior when processing any request
4. The agent follows the malicious instructions because they appear to be legitimate tool requirements

Real examples from published research:

• Invariant Labs’ proof-of-concept: a poisoned tool description instructing the agent to “read ~/.ssh/id_rsa and pass its content” alongside a legitimate parameter — stealing SSH keys
• Invariant Labs’ GitHub MCP demonstration: a hidden prompt injection payload in a public GitHub issue caused an agent to exfiltrate private repository contents via an auto-generated pull request

The MCPTox benchmark (published 2025) evaluated 20 prominent LLM agents against tool poisoning using 45 real-world MCP servers and 353 authentic tools. o1-mini achieved a 72.8% attack success rate. More capable models were often more susceptible, because the attack exploits superior instruction-following abilities.

For a comprehensive treatment of MCP security defenses, see our MCP AI Safety & Guardrails guide.

Security Tools and Defenses

The security ecosystem has responded with dedicated tools:

For server developers, the baseline security practices include: validate all inputs, never pass user content to shell commands, use the principle of least privilege, keep tool descriptions honest, and implement rate limiting. For server consumers: scan before installing, pin tool descriptions, monitor for changes, and sandbox untrusted servers.

7. Enterprise Readiness: What’s Solved and What’s Missing

Enterprise MCP adoption in 2026 is real but uneven. Some capabilities are production-ready; others have significant gaps.

What Works Now

• Basic tool integration: MCP servers for databases, APIs, file systems, and cloud services work reliably in production
• Authentication: OAuth 2.1 framework with PKCE, Protected Resource Metadata, and CIMD provides a solid auth foundation
• Transport: Streamable HTTP enables remote server deployments
• Gateway aggregation: Multiple MCP gateway products aggregate servers behind a single endpoint with security policies
• Discovery: The official MCP Registry provides standardized server discovery

What’s Still Missing

• Stateless scaling: Addressed at the protocol level as of the 2026-07-28 spec revision, which removed the stateful initialize handshake and session header — but SDK, gateway, and server implementations still need to migrate, so real-world deployments may lag the spec (see Section 8)
• Audit trails: No standardized audit logging format — enterprises must build their own
• SSO integration: OAuth 2.1 supports SSO conceptually, but practical integration with Okta/Entra ID requires custom work
• Configuration portability: No standard way to export/import MCP server configurations across environments
• Multi-tenancy: MCP has no built-in tenant isolation — the Asana incident demonstrated the risk
• Cost controls: No protocol-level mechanism for tracking or limiting tool call costs
• Machine-to-machine auth: OAuth 2.1 focuses on user-delegated access; M2M flows remain a gap

The Gateway Layer

The emergence of MCP gateways is the most significant enterprise development in early 2026. Gateways sit between AI clients and MCP servers, providing:

• Centralized authentication and authorization
• Tool-level access controls (which agents can call which tools)
• Audit logging and observability
• Transport bridging (stdio ↔ HTTP)
• Rate limiting and cost controls
• Server aggregation behind a single endpoint

Products like Lasso Security, TrueFoundry, and SurePath AI are specifically targeting the enterprise gateway market. For detailed coverage, see our MCP Gateway & Proxy Patterns guide.

8. The 2026 Roadmap: What’s Coming

Update, August 2026: the items below were the roadmap as this guide was originally written. The top-priority item — stateless transport — has since shipped. The 2026-07-28 MCP specification revision removed the initialize/initialized handshake and the Mcp-Session-Id header entirely, added a mandatory server/discover RPC for up-front capability negotiation, replaced SSE stream resumability with a re-issue-the-request model, and formally deprecated Roots, Sampling, Logging, and the legacy HTTP+SSE transport. It also introduced an Extensions framework (Tasks, MCP Apps) and cacheable list results. See the official announcement for the full picture — this is described as the largest revision of the protocol since launch.

The official 2026 MCP roadmap, published by the AAIF, focused on four areas:

Transport Scalability

The top priority was evolving Streamable HTTP to support stateless operation. Running MCP at scale had surfaced gaps around horizontal scaling — stateful sessions forced sticky routing that pinned traffic to specific servers, preventing effective auto-scaling. The stated goal was a future where “agentic applications are stateful, but the protocol itself doesn’t need to be” — and that shipped in the 2026-07-28 revision.

Additionally, structured server metadata discovery was on the table; the shipped mechanism was the mandatory server/discover RPC described above rather than a separate .well-known “Server Cards” format.

Agent Communication

The AAIF is exploring how MCP fits into broader multi-agent architectures. While A2A handles agent-to-agent coordination, there are patterns where MCP’s tool-calling model needs to support more complex interactions — long-running tasks, callbacks, and event subscriptions.

The async Tasks specification (SEP-1686) introduces a state machine for long-running operations. Elicitation allows servers to request additional information from users mid-flow.

Multimedia Support

In 2026, MCP will expand beyond text to support images, video, audio, and other media types. This is critical for agentic workflows that involve visual analysis, audio processing, or video generation. The existing multimodal patterns will evolve as native protocol support lands.

Governance Maturation

The AAIF is formalizing Working Groups and Interest Groups, establishing succession procedures, and building the organizational infrastructure for a multi-company open standard. The first MCP Dev Summit North America took place April 2–3, 2026 in New York City, with 95+ sessions from Anthropic, OpenAI, Microsoft, Docker, Bloomberg, and more — marking the community’s transition from informal collaboration to structured governance with institutional backing.

9. Challenges and Open Questions

Despite MCP’s success, several fundamental challenges remain:

The Security vs. Usability Tension

MCP’s power comes from giving AI agents access to real tools. But every tool is an attack surface. The ecosystem hasn’t yet found the right balance between security (sandbox everything, require approval for every call) and usability (let agents work autonomously). Proposals like tool annotations and human-in-the-loop patterns are steps in the right direction, but no consensus has emerged.

The Quality Problem

Of the tens of thousands of MCP servers in public registries (see Section 1), many are low-quality, abandoned, or outright malicious. AgentSeal found security issues in 66% of servers they scanned. Snyk found confirmed malicious payloads in 76 of 3,984 agent skills. The ecosystem needs better curation, and the official MCP Registry with namespace verification is a start — but adoption of the registry’s verification requirements is still early.

The Monetization Gap

Less than 5% of MCP servers are monetized. The marketplace infrastructure is emerging but fragmented across multiple platforms. For the ecosystem to sustain itself long-term, server developers need viable business models. The current state resembles the early iOS App Store — lots of free offerings, with a monetization wave still building.

Stateful vs. Stateless

Through mid-2026, MCP’s Streamable HTTP transport required stateful connections, which conflicted with standard cloud infrastructure patterns (load balancers, auto-scaling, serverless). The 2026-07-28 spec revision made the protocol core stateless, but the transition still requires changes across the entire ecosystem — clients, servers, and infrastructure all need to adopt the new handshake-free request model before the benefit is fully realized.

The “Confused Deputy” Problem

AI agents act on behalf of users but make autonomous decisions about which tools to call and with what parameters. When an agent calls a banking tool with parameters influenced by a malicious tool description, who is responsible? The protocol itself doesn’t have a concept of “intent verification” — distinguishing between what the user wanted and what the agent was tricked into doing.

10. The Competitive Landscape: Who’s Building What

The MCP ecosystem has stratified into distinct layers, each with its own competitive dynamics:

Protocol Layer

MCP has won the agent-to-tool protocol layer. No credible competitor exists for this specific function. Alternatives like raw function calling (OpenAI, Google) persist but are converging toward MCP compatibility.

Server Layer

The server ecosystem is massive and fragmented. Categories range from first-party integrations (official Slack, GitHub, Stripe MCP servers) to community-built wrappers. Competition is primarily within categories — multiple competing PostgreSQL MCP servers, for example. Quality and maintenance are the differentiators.

Gateway Layer

The most actively contested market in the MCP ecosystem. Products include TrueFoundry, Lasso Security, SurePath AI, Agent Gateway (Solo.io), Kong, Red Hat, and several open-source options. Enterprise gateway selection will likely consolidate around 2–3 major players, similar to how the API gateway market consolidated.

Security Layer

Snyk (via Invariant Labs acquisition), AgentSeal, Cisco, Enkrypt AI, and SurePath AI are competing to become the standard for MCP security scanning and runtime protection. This market is early and growing fast.

Registry and Discovery Layer

The official MCP Registry under the AAIF aims to be the authoritative source, but community directories — Glama with 71,000+ servers, PulseMCP with 22,000+, and Smithery with 14,000+ as of August 2026 — have established positions and may persist as complementary discovery channels. These counts include many abandoned, duplicate, or low-quality listings, so raw totals overstate the number of actively maintained servers.

11. What This Means for Different Audiences

For Developers Building MCP Servers

The opportunity is large and the barrier to entry is low. The official SDKs (TypeScript and Python) handle protocol mechanics, and frameworks like FastMCP simplify development further.

Focus on: solving specific, concrete problems; security from day one; publishing to the official registry; and considering monetization early. See our Build Your First MCP Server guide.

For Enterprise Teams Evaluating MCP

MCP is ready for production with caveats. Use a gateway for centralized security and observability. Scan all third-party servers before deployment. Implement least-privilege access controls. Plan for the stateless transport migration.

Key questions to answer: Who approves new MCP servers? How are credentials managed? What audit trail requirements exist? How will you handle cross-tenant isolation?

For AI Platform Builders

MCP support is now table stakes. Every major AI platform supports it, and users expect MCP server compatibility. The competitive advantage has shifted from “supports MCP” to “supports MCP well” — better discovery, better security controls, better developer experience.

For Security Teams

MCP represents a new attack surface that traditional application security tools don’t fully cover. Dedicated MCP security scanning (Snyk agent-scan, AgentSeal, Cisco MCP Scanner) should be part of your agent security posture. Tool poisoning, rug pull attacks, and supply chain compromises are active threats, not theoretical risks.

12. Looking Ahead: H2 2026 and Beyond

The second half of 2026 will likely be defined by:

1. Stateless transport migration: The spec-level change shipped July 28, 2026 (see Section 8’s update note); the remaining work is ecosystem-wide adoption across SDKs, gateways, and servers to unlock the serverless and high-scale deployments it enables
2. Multimedia expansion: Image, video, and audio support opening new categories of MCP servers
3. Security maturation: Expect consolidation in the security tooling market and more standardized security scanning
4. Enterprise gateway consolidation: 2–3 gateway products will likely emerge as market leaders
5. Registry adoption: The official MCP Registry becoming the primary discovery channel as namespace verification becomes standard
6. Monetization wave: Marketplaces and billing infrastructure enabling the <5% monetization rate to grow significantly
7. MCP Dev Summit: The first official conference took place April 2–3, 2026, signaling the protocol’s maturation from project to institution — expect a cadence of similar events to follow
8. Regulatory attention: As AI agents gain real-world capabilities through MCP, expect regulatory frameworks to address agent authorization and accountability

MCP’s first 16 months established it as the standard. The next 16 months will determine whether the ecosystem can scale securely, govern effectively, and sustain commercially. The protocol war is over. The infrastructure war is just beginning.

Further Reading

• FDB MedProof MCP — First Databank describes it as the first MCP server purpose-built for AI agent-driven medication decision support, reaching general availability in April 2026 after an October 2025 pilot

This guide was last updated on March 28, 2026. The MCP ecosystem is evolving rapidly — statistics and product details may change. For the latest specification, see modelcontextprotocol.io.