Every few years a technology gets called "the standard that changes everything," and almost every time it's marketing. So when Anthropic quietly dropped the Model Context Protocol on GitHub in November 2024 — no fanfare, a modest press note, two SDKs — the safe assumption was: another vendor protocol, another land grab, ignore until it matters.
A year later it had 97 million SDK downloads a month, more than 5,800 servers, native support in ChatGPT, Gemini, and Copilot, and in December 2025 Anthropic handed it to the Linux Foundation as critical industry infrastructure. That is, plausibly, the fastest adoption of a technical standard in the history of AI.
Here's the part that gets misread: MCP didn't win because it was elegant, or first, or backed by the biggest lab. It won because it solved a math problem nobody could keep paying to ignore. And once you see the math, you understand why this isn't a feature of one model — it's the first real infrastructure layer of the agentic web.
1. The Math: N×M Was Bankrupting Everyone
Before MCP, every AI agent that wanted to do something real — read a file, query a database, call an API, check a repo — needed a custom integration with each tool. Each connector spoke its own API, its own data format, its own auth logic.
Run the numbers. Ten agents, a hundred tools: that's a thousand bespoke connectors to write and maintain. That's N×M — and N×M is a cost curve that kills ecosystems. Every new tool multiplies against every agent. Every new agent multiplies against every tool. Nobody can keep up, so everybody builds a few integrations badly and the whole space stays fragmented.
MCP collapses N×M into N+M. An agent implements the client side once. A tool implements the server side once. Now every agent can talk to every tool through one shared protocol — the way any USB-C device charges from any USB-C charger. The famous USB analogy is right, but it undersells the point: USB wasn't adopted because the connector was beautiful. It was adopted because the alternative — a drawer full of incompatible cables — was economically intolerable. MCP won for the same reason. It wasn't better taste. It was cheaper math.
2. It's Boringly Well-Engineered — and That's the Point
MCP runs on JSON-RPC 2.0, a proven remote-procedure-call protocol. No exotic invention. The architecture is plain client-server with three roles: a host (the AI app — Claude Desktop, ChatGPT, Cursor), a client (the layer inside the host that speaks MCP), and a server (the program exposing capabilities).
A server can offer three things: tools (functions the agent can call — query a DB, send mail, run code), resources (data the agent can read — files, docs, pages), and prompts (ready-made templates). The agent sends a structured JSON-RPC request, the server acts, returns a result, the agent decides what's next.
None of this is clever. That's the feature, not the bug. Infrastructure standards win by being predictable, auditable, and model-agnostic — not by being novel. The protocols that run the world (the ones MCP now sits beside under the Linux Foundation — Kubernetes, PyTorch, Node) all share the same boring virtue: they got out of the way.
3. The Adoption Curve That Shouldn't Be Possible
Watch the timeline, because the speed is the story:
- November 2024 — Anthropic publishes the spec and first SDKs. Early adopters: Block and Apollo. Reference servers for Drive, Slack, GitHub, Postgres.
- By February 2025 — over a thousand community servers. Developers wire everything from code repos to SaaS apps into agents.
- March 2025 — OpenAI officially adopts it. The moment a competitor adopts your protocol is the moment it stops being yours and becomes the industry's.
- April 2025 — Google DeepMind confirms support in Gemini; Microsoft joins the steering committee. The four biggest AI players at one table.
- December 2025 — Anthropic hands MCP to a neutral foundation, locking in that it stays open and vendor-neutral.
Standards almost never move this fast. The reason this one did goes back to the math: the pain it removed was universal and compounding. Everyone was paying the N×M tax. The first credible way to stop paying it spread at the speed of relief.
4. The Dark Side Nobody Wants to Headline
Here's what an honest account of MCP can't skip — and what most breathless write-ups leave out. The very thing that makes MCP powerful — agents fluidly reaching into many tools through one protocol — is exactly what makes it dangerous. Security researchers laid out the vectors, and they're structural, not incidental:
- Prompt injection through MCP servers. An agent reading data via a server can be steered into actions the user never intended, if that data carries hidden instructions. It's agent hijacking, moved down to the protocol layer.
- Tool-combination exfiltration. An agent with access to several servers — filesystem plus email plus calendar — can be walked through extracting sensitive data and sending it out, even when no single tool has permission for the whole operation. The capability emerges from the combination.
- Lookalike tools. A malicious server can register a tool with a name identical or near-identical to a trusted one and silently substitute its calls. The agent doesn't know it's invoking a counterfeit.
These aren't reasons to avoid MCP. They're reasons to deploy it consciously — which is exactly what the spec itself urges: require explicit user consent before each tool call, implement access controls, and never trust a tool's self-description as the truth about what it does. The protocol that connected everything also connected the attack surface. Power and exposure came in the same box.
5. Why This Is the Floor, Not the Ceiling
Step back and MCP stops looking like a model feature and starts looking like a foundation. WebMCP — the in-browser cousin running through navigator.modelContext — is inspired by it. Capability-negotiation schemes echo its logic. Agent discovery through .well-known endpoints answers the same underlying question MCP answers for tools: how does an agent know what it's allowed to do here?
That question — what can an agent do on your surface, and how does it find out — is the whole game of the agentic web. MCP solved it for tools. The rest of the stack is now solving it for sites, browsers, and content. A surface that works well with MCP-speaking agents effectively plugs into the entire ecosystem the standard built: Claude Code, ChatGPT, Gemini, Copilot, and thousands of developer tools. That's not a forecast. It's infrastructure that exists today and is growing at a rate we haven't seen from any previous standard.
The Reframe
We keep evaluating AI standards on taste — is the design elegant, is the API clean, who's behind it. MCP is a reminder that infrastructure doesn't win on taste. It wins on economics. N×M was a tax everyone was paying and nobody could afford; MCP was the first credible refund, so the whole industry cashed it within a year.
The lesson generalizes past MCP. The pieces of the agentic web that actually take hold won't be the cleverest ones. They'll be the ones that turn a multiplying cost into an additive one — that let everyone implement once instead of everyone implementing against everyone. Watch for the math, not the demos.
MCP wasn't the best idea in agentic AI. It was the one that made the impossible arithmetic add up — and that turned out to matter far more.