What it does
Anthropic announced MCP on 25 November 2024 as “an open standard that enables developers to build secure, two-way connections” between data sources and AI tools, and shipped ready-made servers for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer (Anthropic’s announcement). OpenAI’s Agents SDK documentation calls it a “USB-C port for AI applications” (OpenAI).
There are two sides. An MCP server describes what an outside system can do: read a file, find a customer, issue an invoice. A client, which is Claude, Cursor, ChatGPT or your own agent, sees that list and calls what it needs. The integration is written once and works with any model that speaks MCP.
Doors, not a bunch of keys
The comparison I find most accurate is system calls. A program on your computer has no right to touch the disk, the network or the screen by itself. It knocks on the operating system kernel through a small set of strictly defined doors, and the kernel checks whether it is allowed (chapter “A Skill Instead of a Function”). MCP puts the same kind of doors between the agent and the world: the agent does not climb into the bank or the customer database directly, it knocks, and every door can be opened, left half-open, given a log and boarded up at any moment (same chapter).
At INITE this became a short formula: the agent plans the action, the skill knows how to do it, MCP calls the world (same chapter). By September 2026 inite.ai already had an address at which any agent can connect to the site through MCP (chapter “The Website Is No Longer a Website”).
Who supports it, and what to watch
On 9 December 2025 Anthropic handed MCP to the Agentic AI Foundation, a fund under the Linux Foundation it co-founded with Block and OpenAI. By then there were more than 10,000 active public MCP servers, and ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code had adopted the protocol (Anthropic).
Every door works both ways. Through MCP the agent receives text, and the model reads text as possible instructions, which is what prompt injection exploits. Simon Willison calls it the lethal trifecta when one agent has access to private data, exposure to content an attacker controls and a way to send data out (Willison). So an agent gets only the servers its task needs (chapter “Responsibility Cannot Be Automated”).
