What Is the Model Context Protocol (MCP)?

MCP in Two Years: From Anthropic Launch to Cross-Vendor Standard

When Anthropic introduced the Model Context Protocol on November 25, 2024, it offered a simple analogy that stuck: MCP is the USB-C for AI. Just as USB-C replaced a tangle of proprietary cables with one universal connector, MCP gives AI agents a single, open standard for plugging into external data sources, tools, and APIs.

In under two years, that standard has outgrown its creator. Anthropic donated MCP to the Linux Foundation's Agentic AI Foundation, giving the ecosystem a neutral governance home, and every major AI platform now supports it first-party — OpenAI/ChatGPT, Google Gemini, Microsoft Copilot Studio, GitHub, VS Code, and Cursor among them. That cross-vendor backing is arguably the strongest adoption signal of all.

The numbers tell a measurable story, though the counting method matters. Anthropic's December 2025 ecosystem update reported 10,000+ active public MCP servers and 97M+ monthly Python and TypeScript SDK downloads, while a Stacklok survey found 41% of software organizations running MCP in some form of production. Note that registry counts don't equal ecosystem counts — private enterprise servers and many npm/PyPI-hosted servers fall outside public registries, so treat any single "total server" figure as a floor, not a ceiling.

Under the hood, MCP uses a host/client/server architecture communicating over JSON-RPC. Servers expose three primitives: resources (data the model can read), prompts (reusable instruction templates), and tools (actions the model can invoke). Clients, in turn, expose sampling, roots, and elicitation. Deployment patterns are maturing too — builders now favor Streamable HTTP (59%) over stdio (34%), reflecting a shift from local subprocess servers to remote, production-grade integrations.

Why should you care? Because MCP is becoming the default plumbing for AI agents, and the people building it expect that to accelerate. Among adopters, 72% expect increased MCP usage over the next 12 months, and 40% expect MCP to touch 26–50% of AI tool usage within a year. If your organization runs agents, MCP will likely sit underneath them whether or not you chose it.

That trajectory also raises the stakes on trust. With 24% of servers using no authentication and security cited as the top builder challenge by 50% of survey respondents, the ecosystem needs independent verification of what agents can actually see and do. This is where SkillzBench is building its Equip pillar — a single MCP server plus per-agent loadouts, where users toggle skills and tools per agent and the agent only sees what was chosen, least-privilege by design. It's pre-launch today, but the direction reflects where the protocol ecosystem is heading: standardization everywhere, visibility nowhere, and a growing need for a control panel in between.

• Cross-vendor support from Anthropic, OpenAI, Google, Microsoft, and GitHub makes MCP the de facto agent integration layer.
• Adoption signals are strong but method-dependent — public server counts exclude private enterprise deployments.
• Remote deployment via Streamable HTTP now dominates, signaling production readiness.
• Security gaps — unauthenticated servers, tool poisoning, confused-deputy attacks — make verification tooling essential.

The Security Gap Nobody Talks About: MCP's Real Risks

Ask ten builders what's holding MCP back, and you'll hear the same answer. In a 2025 State of MCP survey, 50% of builders cited security and access control complexity as their biggest challenge, and 38% said security concerns prevent them from using MCP more. Yet the ecosystem keeps growing faster than its defenses.

The gaps are concrete. Roughly a quarter of MCP servers — 24% — use no authentication at all, and only 32% use OAuth 2.0, JWT, or SSO. Worse, vendor-reported testing found 43% of tested implementations vulnerable to command injection. These aren't theoretical flaws; they're the default state of many deployments today.

The protocol's own documentation acknowledges a set of documented attack vectors:

• Confused deputy — proxy servers exploited to obtain authorization codes without the user's consent.
• Token passthrough — explicitly forbidden by the spec, which states servers must not accept tokens not issued for them.
• SSRF risks during OAuth metadata discovery.
• Tool poisoning — tampering with tool metadata so the model misreads what a tool actually does.
• Tool shadowing (Shadow MCP) — attackers registering impersonating tools or deploying fake servers.

Security researchers at CyCognito also flag prompt injection, unauthorized command execution, and supply chain risks from build pipelines. Their recommended posture is instructive: treat tool invocations as capability grants rather than function calls, apply per-tool network egress allowlists, run "secretless" agents that never read raw credentials, and validate all tool inputs and outputs against strict JSON schemas.

This is the problem SkillzBench is being built to address. Its Verify pillar pins every agent skill to a commit SHA, runs security scans and license checks, and feeds the results into a 0–100 trust score where security signals carry real weight — a direct response to the tool poisoning and supply chain risks the industry keeps documenting.

Here's the core tension: an agent that can act on your behalf — write files, call APIs, spend money — needs least-privilege control, full stop. But most MCP setups in the wild simply don't provide it. Until per-agent visibility, explicit consent, and verified provenance become defaults rather than afterthoughts, the protocol's biggest strength — giving agents hands — remains its biggest liability.

How to Deploy MCP Safely: Least Privilege, Version Pinning, and Gated Actions

Security is the number one reason teams hesitate to adopt MCP: half of builders cite security and access-control complexity as their biggest challenge, and a striking 24% of servers run with no authentication at all, according to the 2025 State of MCP report. Deploying MCP safely is therefore less about new technology and more about disciplined defaults.

The consensus pattern for enterprises is to start small and read-only. High-value, low-risk integrations — documentation, analytics, issue tracking, repository search — deliver immediate utility without exposing systems to irreversible actions. Only after those prove stable should teams expand scope.

Write, destructive, and admin actions deserve a different treatment entirely. They should sit behind explicit user approval and audit logging, so every consequential action is attributable to a human decision. The official MCP security best practices specify OAuth 2.0-based mitigations for documented attack vectors, including the confused deputy problem and SSRF during OAuth metadata discovery. One rule is normative, not advisory: MCP servers must never accept tokens that were not explicitly issued for that server — token passthrough is forbidden.

Supply chain threats need their own defenses. CyCognito highlights tool poisoning — tampering with tool metadata so the model misreads what a tool does — and recommends three countermeasures: metadata validation, version pinning, and change alerts. That trio maps almost exactly onto what SkillzBench is building in its Verify pillar: pinning every skill version to a commit SHA, running security scans, and re-scanning when upstream changes land. When a tool's code can change silently overnight, provenance and change detection are the difference between a stable integration and an attack surface.

• Start with read-only integrations (docs, analytics, issue tracking) before enabling writes.
• Gate destructive and admin actions behind explicit user consent and audit logs.
• Implement OAuth 2.0-based mitigations per the official spec; never relay foreign tokens.
• Pin versions, validate metadata, and alert on upstream changes to counter tool poisoning.

Finally, know when MCP is the wrong tool. For static, deterministic workflows — lead routing, employee onboarding, invoice processing — direct API connections are more reliable and sidestep the unpredictability of AI-driven decision making. MCP shines at on-the-fly lookups and ad hoc decisions that need current context; it was never meant to replace well-defined pipelines. Choosing the simpler integration when the workflow is fixed is itself a security decision.

Deployed this way — least privilege, pinned versions, gated actions — MCP becomes what it promises: standardized context access with the guardrails production demands.

Equip Your Agents Without Exposing Everything: SkillzBench's Approach

The MCP spec itself points the way: it requires proxies to implement per-client consent, and it forbids servers from accepting tokens not explicitly issued to them. Yet the ecosystem keeps falling short — Zuplo's survey found 24% of MCP servers run with no authentication at all, and 50% of builders name security and access-control complexity their single biggest challenge. The protocol rewards agents that see everything; the safe pattern is agents that see almost nothing.

That tension is exactly what SkillzBench is building Equip to resolve. The idea is simple: one MCP server, plus per-agent loadouts. You toggle which skills and tools each agent gets, and the agent only sees what was chosen — nothing more. It is least-privilege by design, aligned with the spec's own consent requirements rather than bolted on afterward.

Equip sits at the end of a five-pillar pipeline SkillzBench is building:

• Discover — continuously crawl and dedupe agent skills from GitHub, so the catalog stays current without manual hunting.
• Verify — pin every version to a commit SHA, then validate, license-check, security-scan, and quality-judge it. This mirrors CyCognito's recommended defenses against tool poisoning: metadata validation, version pinning, and change alerts.
• Benchmark — run every skill in a sandbox with the same model, with and without the skill, and publish the Lift in percentage points.
• Equip — the MCP server and per-agent loadouts described above.
• Stay current — track upstream changes, re-scan, re-benchmark, and notify when something shifts.

Every verified skill gets a 0–100 trust score, weighted toward security signals first — matching what the market says it needs, since security is the leading enterprise blocker for MCP adoption. Two rules keep that score honest: Lift is always shown separately from ratings, so a skill that performs well but scores poorly on security can't hide behind its numbers, and money never touches scores. A paid placement cannot buy a better number.

An honest caveat: SkillzBench is pre-launch. The benchmarking, scanning, and MCP server described here are what the lab is actively building and will offer — not a shipping product today. The waitlist and newsletter are live, and that is currently the way in. If equipping agents without exposing everything is the problem you're trying to solve, it's worth being on the list when the doors open.

Skills, proven. Join the SkillzBench waitlist at skillzbench.com and be first in line when Equip goes live.