MCP already won

Ninety-seven million SDK downloads in a single month. Over 10,000 active servers. Every major AI provider on board. The protocol wars for agent-tool integration are effectively over, and MCP won. Not because it was the most elegant specification, but because it shipped first, got adopted fast, and crossed the threshold where replacing it became more expensive than just building on top of it. This is worth examining, because the pattern is familiar and the implications are significant.

Standards win by adoption, not specification quality

The history of technology standards is littered with technically superior protocols that lost to ones that moved faster. TCP/IP beat the OSI model not because it was better designed, but because it had running code and a community that iterated in the open while OSI committees spent years debating specifications. The Internet Hall of Fame's postmortem is blunt: billions of dollars were wasted on OSI, and the commercial benefits of the internet flowed to the ecosystems that backed TCP/IP early. USB-C followed a similar arc. It wasn't the first reversible connector concept, and it wasn't the cheapest. But it consolidated enough industry support, got mandated by regulators, and became the default. Apple held out with Lightning for years, but by 2023 even they switched. The technical merits of Lightning versus USB-C mattered far less than the fact that USB-C had become the expectation. MCP is following the same playbook. Anthropic introduced it in November 2024 as an open protocol for connecting AI models to external tools. Within months, OpenAI, Google DeepMind, and Microsoft had adopted it. By December 2025, Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation, with platinum members including AWS, Google, Microsoft, Bloomberg, and Cloudflare. That move signaled something important: this was no longer one company's protocol. It was shared infrastructure. The 97 million monthly download figure comes from the Python and TypeScript SDKs alone. The ecosystem now includes over 5,800 MCP servers spanning developer tools, business applications, data sources, and specialized integrations. As WorkOS summarized in their March 2026 overview, MCP has become "the de facto protocol for connecting AI to the real world."

How it actually happened

MCP hit critical mass not through some grand strategy, but through a combination of timing and pragmatism. Before MCP, connecting an AI agent to external tools meant writing custom integrations for every pairing. Want your agent to read from GitHub, query a database, and send Slack messages? Three separate integrations. Switch your model provider? Start over. This was the "M × N problem," and it was eating up engineering budgets on plumbing instead of product work. MCP solved this by borrowing an idea from developer tooling. The protocol took direct inspiration from the Language Server Protocol (LSP), which standardized how code editors talk to language-specific backends. LSP didn't win because it was theoretically optimal. It won because VS Code shipped it, it worked well enough, and the ecosystem built around it before anyone could propose something better. The same dynamic played out with MCP. Anthropic shipped it, Claude supported it natively, and developers started building servers. By the time competitors could have proposed alternatives, there were already thousands of community-built MCP servers covering everything from coding assistants to enterprise CRMs. The switching costs had already become real. The competitor protocols that emerged, Google's Agent-to-Agent (A2A) and IBM's Agent Communication Protocol (ACP), ended up occupying different niches rather than competing directly. A2A focuses on agent-to-agent communication, ACP on heterogeneous enterprise setups. But for agent-to-tool integration, the core use case, MCP is effectively unchallenged. As one Towards AI analysis put it, MCP is "the hands of the agent," and the other protocols handle different body parts.

The 97 million number in context

Raw download numbers can be misleading, but the 97 million figure tells a specific story when you look at where the adoption is coming from. The first wave was developers, particularly those building AI coding assistants and agentic development tools. Developer tool servers account for over 1,200 of the ecosystem. This makes sense: developers are the earliest adopters, and coding agents were the first mainstream use case for tool-connected AI. The second wave is enterprise. Business application servers now number over 950, reflecting deployments in customer service, sales automation, and internal operations. CData projects the enterprise MCP market reaching $10.3 billion with a 34.6% CAGR. CIOs are paying attention, not because MCP is technically fascinating, but because it solves the integration complexity that was blocking their AI pilots from reaching production. The shift toward remote MCP servers is particularly telling. Analysis of the 20 most-searched MCP servers shows that 80% offer remote deployment. Large companies are choosing remote servers because they're easier to deploy, scale, and maintain. This is the pattern of infrastructure maturing: what starts as a developer tool becomes an enterprise platform.

What MCP actually changed

The most important thing MCP did wasn't technical. It was economic. By standardizing how agents connect to tools, it commoditized the integration layer. Before MCP, tool access was a moat. If you had built custom integrations between your AI product and popular services, that was a competitive advantage. After MCP, tool access is table stakes. If your tool doesn't have an MCP server, you're invisible to the agent ecosystem. This commoditization has a second-order effect that matters more than the first. When every agent can access every tool through the same protocol, the differentiator shifts upstream. The value moves to orchestration, context management, and judgment, deciding which tools to use, when, and how to combine their outputs. The plumbing layer is settled. The intelligence layer is where the competition lives now. For agent builders, this changes the calculus significantly. You no longer need to invest engineering time in building and maintaining tool integrations. You invest in making your agent smarter about using the tools that are already available through MCP. The protocol handled the connection problem. Your job is the decision problem.

The security surface nobody planned for

With 97 million downloads and 10,000+ servers, MCP has also created something else: a massive new attack surface. Shodan-style scans have found over 490 unauthenticated MCP servers publicly exposed on the internet, with API keys embedded directly in configurations. Praetorian's security researchers demonstrated code execution, data theft, and response manipulation through MCP servers, all invisible to end users. The problem isn't that MCP is inherently insecure. It's that the protocol scaled faster than the security practices around it. The core challenge is that MCP servers represent arbitrary code execution paths. When an agent calls a tool through MCP, it's running code on the server side. If that server is compromised, misconfigured, or malicious, the agent becomes a vector. Traditional API security models don't fully apply because MCP involves agent-driven decision-making, shifting contexts, and dynamic tool chains. Every interaction creates new risk vectors. The MCP working group published Security Standard v1.1 in March 2026, addressing prompt injection via tool outputs, server authentication requirements, and scope limitation patterns. The specification now mandates OAuth 2.1 with PKCE for authorization, providing per-user authentication and scoped access tokens. Major enterprise deployments have adopted v1.1 as their baseline. But the security community's consensus is clear: least-privilege matters more than ever. Micro-MCP architectures that break capabilities into single-purpose services, rather than monolithic servers with broad permissions, are emerging as a best practice. The principle is the same one that drove microservices adoption: don't give any single component more access than it strictly needs.

What's still missing

MCP won the adoption war, but the plumbing isn't finished. The 2026 roadmap from the MCP maintainers identifies four priority areas where production readiness still needs work. Auth and identity remain fragmented. While the spec now mandates OAuth 2.1, implementation varies wildly across the ecosystem. Many community servers still rely on ambient credentials or hardcoded API keys. The gap between what the spec requires and what's actually deployed is significant. Billing and rate-limiting across MCP don't exist as protocol-level concepts. When an agent chains together calls across multiple MCP servers, there's no standardized way to track usage, enforce quotas, or attribute costs. For enterprise deployments running agents at scale, this is a real operational gap. Agent-to-agent communication is outside MCP's scope entirely. MCP connects agents to tools, but it doesn't address how agents talk to each other. As one developer noted, "MCP has 97 million downloads. It still cannot connect two agents." This is where protocols like A2A and ACP fill in, but the integration between these layers is still early. And observability is nascent. When an agent makes a chain of MCP calls that produces an unexpected result, debugging the interaction is harder than it should be. Correlation IDs, structured logging, and tracing across MCP server boundaries are all areas where tooling is catching up to need.

The protocol wars are over, the platform wars are starting

MCP's victory in agent-to-tool integration doesn't mean the broader competition is settled. If anything, it clarifies where the next battles will be fought. With tool access commoditized, the competition shifts to who can build the best orchestration layer on top. Which agents make the smartest decisions about tool selection? Which platforms handle context most efficiently? Who builds the most reliable multi-step workflows? These are harder problems than connecting to a tool, and they're where the real product differentiation will emerge. The parallel to the early web is instructive. HTTP and HTML won the protocol wars in the 1990s, and that settled the plumbing layer. But the real value creation happened in the platforms and applications built on top: search engines, social networks, e-commerce, SaaS. The protocol was necessary infrastructure, not the product. MCP is in that same position now. It's the settled infrastructure layer that everything else will be built on. The teams that understand this, that stop debating protocols and start building the intelligence layer on top, are the ones that will capture the value from the agentic era. The protocol wars are over. The interesting part is just starting.

References