The Model Context Protocol (MCP) is an open standard that lets AI applications connect to tools, data and workflows through one common interface. The latest revision, dated 2026-07-28, makes the protocol stateless, which changes how MCP servers are built and deployed.
If you build with LLMs, run AI agents, or are responsible for the security and privacy of systems that use them, this guide explains what MCP is, how it works, what changed in the July 2026 spec, and what to check before you connect a server to your data.
What Is the Model Context Protocol (MCP)?
MCP was introduced by Anthropic on 25 November 2024 as an open standard and open-source framework. The official documentation compares it to a USB-C port for AI applications: instead of writing a custom connector for every pairing of assistant and tool, you implement the protocol once and it works across clients.
Since launch, other major vendors have adopted it, and in December 2025 Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation. The protocol is now supported by assistants such as Claude and ChatGPT and by developer tools such as Visual Studio Code and Cursor.
How MCP Works: Hosts, Clients and Servers
MCP uses a client-server design with three participants:
- MCP host: the AI application, such as an IDE or a chat assistant, that coordinates one or more clients.
- MCP client: a component inside the host that keeps a dedicated connection to a single server.
- MCP server: a program that supplies context. It can run locally on your machine or remotely on a platform.
Messages use JSON-RPC 2.0. Two transports exist: stdio for local servers running as a child process, and Streamable HTTP for remote servers, which supports standard HTTP authentication and recommends OAuth.
The three server primitives: tools, resources and prompts
| Primitive | What it is | Example |
|---|---|---|
| Tools | Functions the model can invoke to take an action | Run a database query, call an API |
| Resources | Data that gives the model context | File contents, a database schema |
| Prompts | Reusable templates for interactions | System prompts, few-shot examples |
A client discovers what is available with list calls such as tools/list and then runs a tool with tools/call. This keeps the tool list dynamic, because a server can change what it offers over time.
MCP vs Function Calling vs a Normal API
These are related but different layers. A normal API is the interface a service exposes. Function calling is a model capability: the model emits a structured request to call a function you defined. MCP is a shared protocol for describing and exposing those functions so that any compliant client can discover and use them without custom glue code. In practice an MCP server often wraps an existing API, and the host turns its tools into function calls for the model.
What Changed in the 2026-07-28 MCP Specification
The release candidate was locked on 21 May 2026 and the final revision is dated 28 July 2026. According to the official MCP blog and documentation, the main changes are:
- Stateless protocol. Every request now carries the protocol version and client capabilities in a
_metafield, so a server can handle each request on its own. This makes it easier to run servers behind an ordinary load balancer. - Sessions removed. The
initializehandshake and theMcp-Session-Idheader are gone. A server that needs state across calls returns an explicit handle (for example a basket ID) that the model passes back as an argument. - New discovery request.
server/discoverlets a client fetch a server’s supported versions, capabilities and identity. - Deprecations. Roots, sampling and logging are deprecated. The migration paths are tool parameters or resource URIs, direct calls to LLM provider APIs, and stderr or OpenTelemetry respectively. Dynamic Client Registration is also deprecated in favour of Client ID Metadata Documents.
- Tasks as an extension. Long-running work moves from an experimental core feature to an optional extension.
- Authorization tightening. Clients must validate the
issparameter on authorization responses.
The release contains breaking changes. Deprecated features keep working, and the earliest they can be removed is the first revision released on or after 28 July 2027. If you maintain an MCP server or client, check your SDK version and plan the migration rather than assuming it is automatic.
MCP Security Risks and How to Reduce Them
Giving a model the ability to call tools raises the stakes. The official security best-practices page describes several risks that matter in practice:
- Confused deputy attacks against MCP proxy servers that use a static OAuth client ID. The fix is per-client consent and exact redirect URI matching.
- Token passthrough. A server must not accept tokens that were not issued for it.
- Server-side request forgery (SSRF). Clients that fetch OAuth metadata URLs should block private and link-local address ranges and use an egress proxy.
- State handle hijacking. Possession of a handle must never count as authentication, so bind handles to the verified user.
- Local server compromise. A local server runs with your privileges, so clients should show the exact command and ask for consent, ideally with sandboxing.
- Over-broad scopes. Start with minimal, read-oriented scopes and elevate only when needed.
Security researchers have also flagged prompt injection and poisoned tool descriptions that can push data out through other connected tools. Treat tool descriptions and tool outputs as untrusted input, and keep a human approval step for actions that send, delete or pay.
MCP, AI Agents and Data Privacy
Every MCP server you connect is a new path for personal data to reach a model. If an agent can read your CRM or inbox, questions about purpose, consent, logging and breach response follow. I covered the accountability side in AI agents under India’s DPDP Act and the incident side in DPDP breach notification and the 72-hour clock. For the business rollout view, see integrating LLMs into your business.
This section is general information, not legal advice. Consult a qualified lawyer for your specific situation.
Frequently Asked Questions
What does MCP stand for?
MCP stands for Model Context Protocol, an open standard for connecting AI applications to external tools, data and workflows.
Who created MCP?
Anthropic introduced it in November 2024. It is now hosted by the Agentic AI Foundation under the Linux Foundation.
Is MCP the same as an API?
No. An API is a service’s own interface. MCP is a standard way to describe and expose capabilities to AI clients, and an MCP server frequently sits in front of an existing API.
Is MCP secure?
The protocol provides authorization guidance, but security depends on implementation. Use trusted servers, least-privilege scopes, sandboxing for local servers and human approval for sensitive actions.
Do I need to migrate to the 2026-07-28 spec now?
Deprecated features remain functional, but the release has breaking changes, so check your SDKs and test before upgrading production servers.
Conclusion
MCP gives AI applications a common way to reach tools and data, and the July 2026 revision makes it simpler to deploy at scale. Adopt it with the same care as any integration that touches real systems: least privilege, untrusted-input handling and clear approval steps.