MCP (Model Context Protocol) for business: what it does, what changed in 2026, what it exposes

MCP defines how an AI application discovers and uses external capabilities. Messages use JSON-RPC 2.0. The spec names three roles:

• Host: the AI application that opens connections (Claude Desktop, Claude Code, VS Code, an agent you build).
• Client: the component inside the host that manages the connection to one server.
• Server: the service that provides context and capabilities, such as access to a CRM, a database or a shared drive.

A server can expose three kinds of features:

• Tools: functions the model decides to run, such as "create a contact" or "run a SQL query". The spec says a human should be able to deny a call.
• Resources: context and data for the user or the model to use.
• Prompts: templated messages and workflows the user chooses to run.

On the client side, Elicitation lets a server ask the user for more information, and it remains active. Two other client features from earlier versions are deprecated as of 2026-07-28: Sampling (the server asked the client to query the model), to be replaced by calling the model provider's API directly, and Roots (the server asked which directories it could work in), to be replaced by paths passed as tool parameters or server configuration.

Two transports are defined. With stdio, the client launches the server as a subprocess on the same machine. With Streamable HTTP, each message is an HTTP POST to a single endpoint, so the server can be hosted remotely. The older HTTP+SSE transport is deprecated.

Anthropic open-sourced MCP on 25 November 2024, with the spec, SDKs, local server support in Claude Desktop, and reference servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer. Block and Apollo were named as early adopters; Zed, Replit, Codeium and Sourcegraph were working on integrations.

On 9 December 2025, Anthropic donated the protocol to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation. Anthropic, Block and OpenAI are co-founders; Google, Microsoft, AWS, Cloudflare and Bloomberg are supporters. Technical decisions stay with the MCP maintainers, through formal proposals (SEPs). The AAIF board decides budget and strategy.

Governance is also written into the spec: version 2025-11-25 formalised working groups and SDK tiers, and version 2026-07-28 added a feature lifecycle policy with at least 12 months between deprecating a feature and removing it. For a company building on MCP, that is the minimum migration window to plan around.

The only adoption figures available are published by the project itself, with no independent audit: 97 million monthly SDK downloads in December 2025, then close to half a billion downloads a month across Tier 1 SDKs in July 2026, according to the official MCP blog. These numbers count package downloads and say nothing about how many companies run MCP in production.

MCP versions are named by date. Four versions came before the current one: 2024-11-05, 2025-03-26, 2025-06-18 and 2025-11-25. An article or a vendor still reasoning from 2025-06-18 is two revisions behind.

Four changes in 2026-07-28 directly affect a deployment:

• No more sessions. The initialize handshake and the Mcp-Session-Id header are gone. A remote server can run as several instances behind a plain round-robin load balancer, with no sticky sessions. When a server needs more input, it returns input_required and the client retries the request with the answer.
• Routing headers. Mcp-Method and Mcp-Name are required, so a gateway or WAF can filter calls by method and tool name without parsing the request body.
• Hardened authorization. Clients must validate the iss parameter (RFC 9207), stored credentials are bound to the authorization server that issued them, and application_type is required at registration. Dynamic Client Registration (DCR) is deprecated in favour of CIMD.
• Enterprise-Managed Authorization (EMA). Announced as stable on 18 June 2026, this extension lets the client get an identity assertion (ID-JAG) from the company identity provider at single sign-on, then exchange it for an MCP access token. Users no longer see a consent screen per server, and IT controls access from the directory. According to the MCP blog, Claude, Claude Code, Cowork and VS Code support it as clients, Okta as identity provider, and Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase as servers.

Authorization remains optional in the spec. HTTP transports should follow the OAuth framework it describes; local stdio servers should take credentials from the environment. The roadmap published on 22 August 2026 gives no date for the next version; agent identity (DPoP, Workload Identity Federation) is among its priorities.

The table only includes what vendors document on their own pages. Announcements seen only in press coverage or search snippets are left out.

Table sources: OpenAI Responses API, OpenAI Agents SDK, Gemini API, Google Cloud, Copilot Studio, VS Code, Windows.

In practice, an MCP server written for your internal tools can serve Claude as well as assistants from OpenAI, Google or Microsoft. If you are still choosing a provider, our comparison Claude or ChatGPT for business covers the other criteria.

The two coexist. In most cases an MCP server calls the existing API of the product it exposes: MCP adds a description layer that AI assistants can read. The real question is whether that layer serves you.

For the document side, see our guide to RAG in the enterprise. For a concrete example of a business tool wired to Claude, see connecting Claude to your CRM.

The spec is blunt about it: an MCP tool amounts to arbitrary code execution, and its annotations (read-only, destructive) can only be trusted when the server itself is trusted. Incidents published since 2025 show where the risk turns real.

• Tool poisoning (1 April 2025). Invariant Labs showed that hidden instructions in a tool description could make Cursor read and send out ~/.cursor/mcp.json and a private SSH key. The same post describes "rug pulls" (a description changed after approval) and one server shadowing another server's tools.
• Prompt injection through the GitHub server (26 May 2025). A malicious issue in a public repository led an agent using the GitHub MCP server to leak private repository data into a public pull request (Invariant Labs). No server was compromised: the content the agent read was enough.
• CVE-2025-6514 in mcp-remote. Versions 0.0.5 to 0.1.15 ran an OS command built from the authorization endpoint returned by a malicious server. CVSS 9.6 according to JFrog (9 July 2025), fixed in 0.1.16.
• CVE-2025-49596 in MCP Inspector. Before 0.14.1, missing authentication between the Inspector client and its proxy allowed remote code execution. CVSS 9.4 (GitHub advisory dated 13 June 2025).
• Asana incident (June 2025). Asana's MCP server, launched on 1 May 2025, had a logic flaw that exposed data across organisations. Found on 4 June, the server was taken offline and restored on 17 June. Roughly 1,000 customers were affected, according to an Asana spokesperson quoted by BleepingComputer on 18 June 2025; we did not find an Asana statement confirming that figure.

Against these cases, the 2026-07-28 spec requires or recommends:

• Servers: validate inputs, enforce access controls, rate-limit and sanitize outputs (required); check that each token was issued for this server (RFC 8707); refuse any token meant for another service; never put a token in the URL.
• Clients: get explicit user consent before a tool call, confirm sensitive operations, show tool inputs before sending, validate results before passing them to the model, log for audit.
• Local servers: sandbox the process and show the exact command before running it. A Streamable HTTP server must validate the Origin header and, when local, bind to 127.0.0.1.
• Scopes: avoid wildcard or all-access scopes and request more permissions step by step.

Logging tool calls also helps with compliance: if your agent falls under an AI Act obligation, see our guide the EU AI Act for businesses. Agent risks beyond MCP itself are covered in AI agent security.

Anthropic offers three entry points, each with its own rules. The details below come from its documentation, read on 13 September 2026.

Claude apps: custom connectors

In claude.ai, Claude Desktop, Cowork and the mobile app, a remote MCP server is added as a custom connector. Every plan has access, with Free limited to one connector. On Team and Enterprise only Owners add connectors; each member then connects individually, with their own permissions in the tool.

One point to raise with your network team: the connection to the server comes from Anthropic's cloud. A server reachable only from your internal network will not respond unless you allowlist Anthropic's IP addresses.

Claude Code: admin controls

Claude Code supports stdio, HTTP (recommended), SSE (deprecated) and WebSocket. A server can be configured at three scopes: local, project (a .mcp.json file, which needs approval before first use) or user. Authentication uses OAuth, static headers, or headersHelper for Kerberos, SSO or short-lived tokens.

For a team of developers, the managed settings managedMcpServers, allowedMcpServers, deniedMcpServers and the managed-mcp.json file let you enforce allowed and denied servers. The docs warn that servers fetching external content expose you to prompt injection.

Claude API: the MCP connector

For an agent you build, the Claude API can connect to an MCP server itself. Its limits:

• Beta, header mcp-client-2025-11-20 (the older mcp-client-2025-04-04 is deprecated).
• Tool calls only, to public HTTPS servers (Streamable HTTP or SSE). No local stdio servers, no resources or prompts.
• Your application runs the OAuth flow and passes the token as authorization_token; mcp_toolset allowlists or denylists tools.
• Not eligible for Zero Data Retention. Available on the Claude API, Claude Platform on AWS and Microsoft Foundry; not available on Amazon Bedrock or Google Cloud.

For local servers, prompts or resources, Anthropic's SDKs provide client-side helpers. API costs are covered in our Claude API pricing guide. For an MCP server built on your own business tools, see Claude integration for businesses or our custom AI agents.

The MCP Registry is an open catalogue and API for publicly available MCP servers. It stores metadata only: the code stays on npm, PyPI, Docker Hub and similar. Maintainers can denylist spam, malicious or impersonating servers, and a company can run a private sub-registry on top of it.

It launched in preview on 8 September 2025 and its API was frozen at v0.1 on 24 October 2025. As of 13 September 2026 its GitHub repository still calls it a preview and warns that breaking changes or data resets may occur. We found no general availability announcement.

The modelcontextprotocol/servers repository now points to the Registry for a list of servers. It keeps seven reference servers (Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking, Time); thirteen were archived, including GitHub, Slack, Postgres, Google Drive and Puppeteer, all part of the 2024 announcement. We could not date that change. A tutorial that installs those archived servers is best avoided in production.

1. Inventory every server: publisher, code repository, version, requested permissions. A Registry listing is no audit.
2. Check the spec version supported (2026-07-28) and the tier of the SDK in use.
3. Update components with known flaws: mcp-remote 0.1.16 or later, MCP Inspector 0.14.1 or later.
4. For remote servers: OAuth 2.1, token audience validation, no token passthrough and no tokens in URLs, minimal scopes, CIMD registration over DCR.
5. Tie access to SSO through the EMA extension when the client, identity provider and server all support it.
6. For local servers: sandboxing, the command shown before launch, binding to 127.0.0.1 and Origin header validation over HTTP.
7. Require human confirmation for any write, delete or send, without relying on annotations from a server you do not control.
8. Separate agents that read public content (issues, inbound email, web pages) from agents with access to private data, following the lesson of the GitHub case.
9. Log every tool call with the user, inputs and result.
10. Lock down Claude Code with managed-mcp.json and allowed or denied server lists.
11. Check data handling: the Claude API MCP connector is excluded from Zero Data Retention, and OpenAI also excludes data sent to MCP servers from its retention and residency commitments.