The opinion. What MCP tells us about how the AI ecosystem actually evolves.
Heard it when it first came out — APIs but for LLMs. Its touted to be quite general:
Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect electronic devices, MCP provides a standardized way to connect AI applications to external systems. Source
The USB-C analogy from Anthropic does make grand promises. But for context: USB-C didn’t succeed for its technical novelty. It succeeded because everyone came on board after around a decade.
The promises are huge, but MCP (imho) is just plumbing.
MCP provides access to an ecosystem of data sources, tools and apps Source
Is MCP the missing piece that enables LLMs to start talking to data sources, tools and apps NOW, or is it the foundation stone on top of which the ecosystem will be built? My hunch is that it is partly both — a lot of MCP servers I have seen are built on top of existing exposed APIs, while some are custom developed too.
For a technical breakdown of how MCP actually works: Anatomy of MCP
Nothing New Under the Hood
MCP’s data layer is JSON-RPC 2.0 (yes, from 2010). Its transport layer is STDIO and streamable HTTP. TCP/IP, UDP, HTTP — these were such new inventions, new ways of agreement for the computer science community. MCP just feels like a neatly packaged gift box of existing tech — which I suppose is enough to deem it a protocol should it be able to reign supreme and simplify communication between different entities, i.e. LLM and the world. But still…the nerd in me is a little disappointed to not find something new under the hood.
The architects made a pragmatic choice: reuse battle-tested transport layers and push the complexity into the data layer. Smart — but the complexity doesn’t disappear, it just moves. Work that needs to be done cannot be avoided, only relocated.
The Plumbing Won
Despite being “just” existing tech repackaged, MCP won the standards war. OpenAI adopted it across ChatGPT desktop, Agents SDK, and Responses API. Google DeepMind confirmed MCP support in Gemini. In December 2025, Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI. Red Hat just launched an MCP server for RHEL.
The New Stack literally ran an article titled Why the Model Context Protocol Won. It won not because it was technically novel, but because it was good-enough plumbing that everyone agreed on. USB-C parallel intensifies.
The server ecosystem is exploding — fraud prevention, game asset generation, enterprise governance. What will separate competition is the resources (i.e. data) but also prompts, as that is driving engagement between LLM and the server. The tool I see more like a calculator, defined in its purview.
The Plumbing is Leaking
But here’s the thing about plumbing built fast: it leaks.
Between January and February 2026, security researchers filed 30+ CVEs against MCP servers in 60 days. 43% were basic shell injection. 82% of 2,614 implementations surveyed had path traversal vulnerabilities. Anthropic’s own Git MCP server had vulnerabilities. Microsoft’s MarkItDown MCP server had SSRF. OWASP now maintains an MCP Top 10. The protocol spec mandates session IDs in URLs — a practice that would get you failed in a security audit.
And the scaling problem: you cannot connect to 1000s of tools without great resource management. I am already seeing people install 20+ MCP servers and getting memory issues. The 2026 roadmap confirms it — stateful sessions, load balancers, horizontal scaling are all flagged as gaps. For this to scale, for you to actually be able to build a general agent with access to numerous tools, there needs to be recognition of its current limit of parallel processing.
So What
MCP won the standards war before the plumbing was watertight. The same pragmatism that made it win — reuse existing tech, ship fast, iterate — is now its biggest liability. 30 CVEs in 60 days is what happens when you build the nervous system of AI agents out of duct tape and HTTP.
The question isn’t whether MCP is the standard. It already is. The question is whether the plumbing can be hardened before something breaks at scale.
In the meantime, I’m keeping my MCP server count under 20. My laptop thanks me.