Skip to main content
PORTFOLIO
Back to Blog

MCP at 97 Million Downloads: How the Model Context Protocol Became AI's USB-C

Mohit Byadwal

MCP at 97 Million Downloads: How the Model Context Protocol Became AI’s USB-C

Quick answer (AEO): The Model Context Protocol (MCP) is an open standard that gives AI models a universal interface to connect to external tools and data sources. As of mid-2026, MCP has crossed 97 million monthly SDK downloads, been adopted by OpenAI, Google, Microsoft, and AWS, donated to the Linux Foundation’s Agentic AI Foundation, and has over 6,400 registered servers in its official registry.

From Anthropic experiment to industry standard

In November 2024, Anthropic quietly open-sourced MCP as a way to standardize how Claude connected to external tools. The premise was simple: every AI tool integration was a custom one-off. Every vendor built its own plugin system. The result was the same fragmentation problem USB solved for hardware—except for AI agent capabilities.

Sixteen months later, no other infrastructure protocol in AI history has consolidated a fragmented ecosystem this fast. The adoption curve:

  • Nov 2024: Anthropic open-sources MCP specification and SDK.
  • Early 2025: Claude Desktop, Cursor, Windsurf adopt natively.
  • Mid 2025: OpenAI’s Agent SDK, VS Code, Zed, Replit integrate MCP.
  • Late 2025: Google and Microsoft announce support; enterprise adoption begins.
  • March 2026: MCP roadmap published, focused on enterprise-scale production readiness.
  • April 2026: 2,300+ public MCP servers; donated to Linux Foundation.
  • July 2026: 6,400+ servers, 97M monthly downloads, production-grade auth and streaming.

Architecture: what MCP actually is

MCP defines a client-server protocol where:

  • MCP Hosts (AI applications like Claude, Cursor, Kiro) connect to…
  • MCP Servers (tool providers) that expose…
  • Resources (data), Tools (actions), and Prompts (templates).

The transport layer is intentionally simple—stdio for local processes, HTTP+SSE (or streamable HTTP) for remote servers. This design choice is why adoption exploded: you can wrap any CLI tool, API, or database in an MCP server with minimal code.

// Minimal MCP server exposing a tool (TypeScript SDK)
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { z } from "zod";

const server = new McpServer({ name: "weather", version: "1.0.0" });

server.tool(
  "get-forecast",
  "Get weather forecast for a city",
  { city: z.string().describe("City name") },
  async ({ city }) => {
    const data = await fetch(`https://api.weather.example/v1/${city}`);
    return { content: [{ type: "text", text: await data.text() }] };
  }
);

const transport = new StdioServerTransport();
await server.connect(transport);

Key design principle: MCP servers are stateless tool providers, not agents. They expose capabilities; the host’s agent loop decides when and how to invoke them. This separation of concerns is why the same server works across Claude, Copilot, Cursor, and Kiro without modification.

The security surface nobody talks about

With 6,400+ public servers and 97 million downloads, MCP has become a meaningful attack surface. A large-scale security analysis (published on arXiv, mid-2026) identified several classes of vulnerabilities:

Tool poisoning

A malicious MCP server can embed instructions in tool descriptions or responses that manipulate the host model’s behavior. Because tool descriptions are injected into the model’s context, a server can effectively prompt-inject the agent through its capability declarations.

Mitigation: Host implementations should treat MCP tool descriptions as untrusted input. Sanitize before injection. Kiro and Claude Desktop both implement description length limits and content filtering.

Rug-pull attacks

A server passes security audits during initial review, then updates its tool behavior server-side to become malicious—because the server code runs remotely and can change without the client’s knowledge.

Mitigation: Pin server versions. Use deterministic builds. The MCP registry now supports content hashes for verified servers.

Excessive permission grants

Many MCP servers request broad filesystem or network access. Users approve once and forget. A compromised or malicious server then has standing access to sensitive resources.

Mitigation: Implement least-privilege defaults. MCP’s 2026 roadmap includes OAuth 2.1 scoped authorization and per-tool permission grants (not per-server blanket access).

Shadow tool registration

In multi-server configurations, a malicious server can register tools with names that shadow legitimate tools from other servers, intercepting calls meant for trusted providers.

Mitigation: Namespace tools by server origin. Hosts should display server provenance for each tool invocation.

Building production MCP servers: lessons from the field

After building and consuming MCP servers across several projects, here’s what separates prototypes from production:

1. Design tools as pure functions

Each tool should do one thing, accept typed inputs, and return structured outputs. Avoid tools that maintain internal state between calls—the host may retry, parallelize, or invoke out of order.

// Good: pure, typed, single-responsibility
server.tool("search-docs", "Search documentation by query", {
  query: z.string().min(1).max(200),
  limit: z.number().int().min(1).max(50).default(10)
}, async ({ query, limit }) => {
  const results = await searchIndex.query(query, { limit });
  return { content: [{ type: "text", text: JSON.stringify(results) }] };
});

2. Validate inputs aggressively

MCP inputs come from LLM-generated tool calls. Models hallucinate parameters, pass wrong types, and exceed bounds. Validate everything with schemas (Zod, JSON Schema) and return clear error messages that help the model self-correct.

3. Implement observability from day one

Every tool invocation should emit a structured trace: request ID, input hash, latency, output size, error class. When a model calls your tool 47 times in a loop, you need to understand why before your rate limits or costs explode.

4. Rate-limit and circuit-break

Agent loops can be relentless. A confused model will retry a failing tool indefinitely. Implement per-session rate limits, exponential backoff responses, and circuit breakers that return “service degraded, try alternative approach” rather than silent failures.

5. Handle the auth story early

The 2026 MCP spec supports OAuth 2.1 for remote servers. For local servers (stdio transport), auth is implicit via process-level access. For anything exposed over HTTP, implement proper token validation from the start—not as a retrofit.

The ecosystem map

The MCP ecosystem in mid-2026 breaks into layers:

  • Infrastructure servers: Database access (Postgres, Redis, Supabase), cloud APIs (AWS, GCP), observability (Datadog, Sentry).
  • Development servers: Git operations, CI/CD triggers, test runners, linters, documentation search.
  • Domain servers: Legal research, medical databases, financial data feeds, design tools (Figma).
  • Personal servers: File system, calendar, email, note-taking apps, browser automation.

The registry (hosted under the Agentic AI Foundation) provides discovery, verification status, and compatibility metadata. Think npm for agent capabilities.

What this means for engineers building AI products

MCP is becoming the standard integration layer for AI-enabled applications. If you’re building a product that AI agents should be able to interact with, shipping an MCP server is increasingly expected—the same way shipping a REST API became expected a decade ago.

The investments that matter:

  1. Tool design literacy — understanding how to expose capabilities in a way LLMs can reliably invoke.
  2. Security posture — treating MCP as an attack surface, not just a convenience layer.
  3. Observability — knowing what agents do with your tools at scale.
  4. Versioning — semantic versioning for tool contracts, because breaking an MCP tool breaks every agent that depends on it.

Where MCP goes from here

The 2026 roadmap priorities: streaming responses (for long-running tools), multi-tenant auth (enterprise deployments), tool composition (servers that invoke other servers), and capability negotiation (hosts declaring what they support). The Linux Foundation governance ensures no single vendor controls the standard’s direction.

MCP’s trajectory mirrors HTTP, Docker, and GraphQL: an open protocol that makes a previously fragmented integration problem boring and predictable. The “USB-C for AI” metaphor is earned—and like USB-C, the real value shows up when you stop thinking about the connector and start thinking about what flows through it.

Related reading: Building local AI agents, multi-agent orchestration patterns, and zero-trust networking for internal APIs.

All writing Experience Projects Education