MCP (Model Context Protocol) is an open data exchange standard through which a language model or an AI agent connects to external databases, file systems and applications. An MCP server is a software adapter that turns a model’s structured request into an executable command in an external information system.
In brief
- One socket for all tools: the protocol replaces scattered custom integrations with a common standard for connecting an AI agent to corporate data stores, terminals and application programming interfaces (APIs).
- Industry scale: when the standard was handed over to the Agentic AI Foundation under the Linux Foundation on 9 December 2025, there were more than 10,000 active public MCP servers and over 97 million monthly downloads of the Python and TypeScript SDKs.
- Share in production: according to a Stacklok survey (December 2025, 300 senior technology leaders at large enterprises in the US, Canada and the UK), 41% of the organizations surveyed already used MCP in limited or broad production, and 45% in the software development sector.
- Widespread operation without a password: a survey of 1,412 publicly running MCP servers by researcher Henley Wing Chiu (Bloomberry, 24 February 2026) found that among servers whose authentication method could be determined, 38.7% had no authentication at all.
- Control before execution: the protocol is responsible for delivering a call but does not assess how destructive the command’s parameters are, so a gate that checks actions against a formal contract is placed between the agent and the server.
What is MCP and why is it needed?
Model Context Protocol solves a connectivity problem. Before a single standard appeared, every connection of a language model to a corporate database, mail server or code management system required a separate connector written for that specific model. Whenever the model changed or the API was updated, the whole integration layer had to be rewritten.
MCP was originally developed by Anthropic and on 9 December 2025 was handed over to a neutral foundation, the Agentic AI Foundation, under the Linux Foundation. It introduced a universal client-server bus. In this architecture:
- Host application (MCP Host): the environment in which the user or an autonomous loop works (for example, an agentic development environment, a corporate portal or an orchestrator).
- MCP client: an internal module of the host that maintains a connection to a specific server over the standardized protocol.
- MCP server: an external or local adapter that announces a list of available functions and performs operations in the target system at the client’s request.
The move from closed connectors to an open standard led to explosive growth of the ecosystem. By December 2025, downloads of the official software development kits (SDKs) for Python and TypeScript exceeded 97 million a month. According to Stacklok’s report “State of Model Context Protocol in Software 2026” (published in January 2026, based on a survey of 300 senior technology leaders at companies with 500 or more employees in the US, Canada and the UK in finance, retail and software development), 29% of respondents were at the planning stage, 30% were running pilots, 29% used the protocol in limited production and 12% in broad production.
What is an MCP server?
In plain words, an MCP server is a specialized translator program that sits in front of a specific resource (for example, a PostgreSQL database, a Git repository, a cloud console or a file folder) and offers the AI agent a strictly described list of possible operations. The server itself contains no artificial intelligence: it receives a structured call, performs the action in a trusted system and returns the result to the agent.
Under the protocol specification, a server can offer the agent three kinds of primitives:
- Resources: readable data sources (files, table rows, event logs, configuration schemas) that are loaded into the model’s context.
- Tools: executable functions with a description of their input parameters (for example,
execute_sql,delete_file,create_container,send_payment); calling them changes the state of an external system. - Prompts: prepared scenarios and instructions for typical operations with the given service.
To establish a connection, an administrator or developer gives the MCP server credentials for the target system: API tokens, database connection strings or service account keys. From that moment on, any agent that gains access to the server acts in the target infrastructure with the rights of that key.
How does an agent call a tool through MCP?
How MCP works step by step, from the model’s intention to a change in the database: four rounds of message exchange in JSON-RPC 2.0 format.
- Discovery: on connection, the MCP client asks the server for the list of available tools. The server returns the function names and a JSON schema of the required arguments (for example, the table name and the query text).
- The model forms a call: analysing the task and the list of available tools, the language model generates not ordinary text for a human but a structured request to call a specific tool with computed arguments.
- The command goes to the server: the client forwards the structured request to the MCP server over a local input/output channel (
stdio) or over a network transport on top of HTTP. - Execution and response: the MCP server substitutes the arguments into a real system call or API request, executes it under its own credentials and returns a text or numeric result to the model’s context for the next step.
In this scheme, the protocol guarantees that parameters are passed with correct syntax, but it does not check the business or technical meaning of the operation itself. If the model has formed a syntactically valid request to delete a production table or export the customer register, and the server’s key has sufficient rights, a standard MCP server will execute the command. The specification says so directly: tools mean arbitrary code execution, and MCP itself “cannot enforce these security principles at the protocol level”; consent, access control and protection fall on those who implement it (specification revision of 28 July 2026).
| Stage | Direct API call from code | Connection through a standard MCP server | Connection through MCP with an action gate |
|---|---|---|---|
| Who forms the call parameters | A deterministic algorithm written by a programmer | A probabilistic language model, on the fly during reasoning | A probabilistic model, but parameters are intercepted before execution |
| Data structure check | At the level of programming language types and the API schema | At the level of the MCP JSON schema | At the level of the JSON schema and a formal contract (YAML) |
| Action safety check | Hard-coded into the script logic | Absent from the protocol itself (relies on the prompt or the key’s rights) | Mathematical check of parameters by an SMT solver (QF_UFLIA logic) before admission |
| Trace of the operation for review | Scattered entries in web server technical logs | An entry in the host’s local log (if enabled) | A cryptographic hash chain of receipts with OpenTimestamps time anchors |
Why is an MCP server without authentication dangerous?
An unprotected or over-privileged MCP server is dangerous because it becomes an open command gateway into the company’s internal infrastructure for any process or attacker able to send a network request. Since the server already holds working keys to databases and cloud environments, the absence of authentication at the entrance allows privileged operations to bypass perimeter protection.
The actual state of MCP security in the public part of the internet was measured in early 2026:
Case: a survey of 1,412 public MCP servers (Bloomberry, February–March 2026)
The study by Henley Wing Chiu (Bloomberry, “We analyzed 1,400 MCP servers”, 24 February 2026, updated 27 March 2026; the data was later widely cited in a DreamFactory review of 3 March 2026) analysed 1,412 MCP servers publicly running on the internet. Among the servers whose authentication method could be determined with tools (the author did not disclose the exact size of this subsample), 38.7% had no authentication at all. Moreover, only 2.4% of the servers surveyed used rate limiting, and 22.9% had a fully open cross-origin resource sharing (CORS) policy.
Even when an MCP server is password-protected or runs locally on a developer’s machine, a second threat remains: prompt injection and tool description poisoning (MCP injection, page in Russian). If an agent reads an external document, a web page or a third-party repository with a hidden instruction, the model may itself call a local MCP server connected to it and execute a destructive command on behalf of a legitimate user. Lumenova’s analysis of agent security incidents of 25 August 2026 (“Agentic AI Security Incidents”) states plainly that standard pre-release tests did not detect any of the failures it examined, and that the root of the problems lay in the architecture of tool access rather than in the quality of the models (“The failures were about access, not model quality”).
How to check an agent’s MCP calls before execution?
To check an AI agent’s MCP calls before they actually run, place a deterministic software gate between the client and the server that compares the parameters of each command with a formal contract of admissible actions. Trying to check a call’s safety with another neural network does not solve the problem: the second model remains probabilistic and is exposed to the same context distortions.
In the IS 3.0 architecture developed at the ANO Scientific Research Institute of System Synthesis, protection of the MCP loop follows the principle “check the action, not the intention”, through the software MITR gate:
- Intercepting the structured call. When the agent forms a request to an MCP server tool, the gate intercepts the call before the command reaches the executing adapter and the target database.
- Checking against a formal contract. Each class of actions has a strict contract in the form of a data file (YAML). If a class of actions has no contract, the solver refuses; the refusal is enforced in enforce mode, while in advisory mode the agent receives a warning.
- Mathematical proof of safety. The call parameters are passed to an SMT solver (
QF_UFLIAlogic), which, without consulting a language model, checks whether the command’s arguments intersect the set of forbidden states. If the intersection is unsatisfiable (UNSAT), the gate admits the call; if a violation is found, a mathematical counterexample is produced together with the conditions for repairing the request. - Speed and accuracy on the test bench. According to instrument measurements on the institute’s server of 14 October 2026 (on a set of 19 action-class contracts), the median decision time of the gate under a rule (P4) is 0.95 ms, and a full call including an explanation takes 4.26 ms (earlier measurements: 26 September 2026, 0.74 and 3.31 ms with 17 contracts; 2 October 2026, 0.87 and 4.43 ms). On a control set of 62 cases (ADR-0262: 50 attacks on actions and 12 ordinary controls), the gate missed 0 attacks and produced 0 false refusals. The containment mode is set by a flag for each class of actions: as of 14 October 2026, one class (file deletion) runs in enforce mode and the other 18 classes run in advisory mode.
- Recording in a hash chain of receipts. Each gate decision is written to a hash chain of receipts with external
OpenTimestampstime anchors. As of 14 October 2026, a replay of the chain’s decisions with a checker written for an outside party matched 4,958 of 4,958 without discrepancies; the replay was done by the institute. No independent outside verifier has replayed it yet, and the open kit atasi5.ru/console/verify/lets anyone check the integrity of the chain and its time anchors on their own.
What to do: practical steps for a manager
Safe use of MCP on a corporate network requires five organizational and technical measures:
- Run a network audit of deployed MCP servers. Check the organization’s external and internal network perimeters for public adapters launched by developers without authentication, with open CORS policies and without rate limits, keeping in mind that in Bloomberry’s public sample 38.7% of servers with a determinable protection method had no password at all.
- Revoke full-rights (admin/root) keys from MCP servers. Move each adapter to service accounts with the minimum necessary privileges: a server for reading analytics should have no technical ability to drop tables or volumes.
- Ban connecting unvetted third-party MCP packages. Keep an internal register of approved MCP servers and review their source code before launching them in the development environment, to rule out tool description poisoning and covert exfiltration of secrets.
- Put an action gate in front of critical MCP servers. Place a deterministic gate in the call path (for example, built on the MITR architecture) that checks the arguments of each command against formal YAML contracts in
QF_UFLIAlogic with a response time of about one millisecond (median 0.95 ms as measured on 14 October 2026). - Keep a cryptographically linked log of decisions. Record all admitted and refused tool calls in a hash chain with external time anchors, providing a verifiable evidence base for internal investigation and audit (the architecture is described in detail in the book Proven Action. Power and Control over AI Agents: Strategy 2027–2035, Alexander Fischuk, 2026, in Russian).
Frequently asked questions
What is MCP and why is it needed?
Model Context Protocol (MCP) is an open standard that connects language models and AI agents to external data sources and working applications without writing a separate integration for each neural network. In December 2025, Anthropic handed the protocol over to the Agentic AI Foundation under the Linux Foundation, when more than 10,000 active public MCP servers were already running worldwide.
What is an MCP server?
An MCP server is an intermediary program (adapter) that connects an AI agent to a specific database, file store or external service via an API. The server announces the list of available commands to the agent, accepts structured requests from it and executes them in the target system under the credentials it was given.
How does an agent call a tool through MCP?
First, the agent asks the MCP server for the list of available functions and the format of their parameters (a JSON schema). Then, while solving the task, the language model forms a structured command with the required arguments and sends it to the server, which executes the operation and returns the result to the agent’s context.
Why is an MCP server without authentication dangerous?
A server without authentication allows any external process or attacker to execute commands in the company’s internal database or file system with the rights of the key stored in the server’s settings. According to Bloomberry’s study of 24 February 2026 (1,412 public servers), 38.7% of the servers with a determinable protection method had no authentication at all, and only 2.4% limited the rate of requests.
How to check an agent’s MCP calls before execution?
An independent software gate is installed between the agent and the MCP server. It intercepts each tool call and checks its arguments against a formal contract using a mathematical SMT solver. On the MITR gate’s test bench (measured on 14 October 2026 with 19 contracts), such a check takes 0.95 ms at the median without calling a language model, and admits an operation only when there is a formal proof of its safety (UNSAT).
Sources
- Anthropic: Donating the Model Context Protocol and establishing the Agentic AI Foundation. Anthropic’s official announcement of handing the standard over to the Linux Foundation, 9 December 2025: https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation
- Stacklok: State of Model Context Protocol in Software 2026. Report on a survey of 300 senior technology leaders at large enterprises in the US, Canada and the UK (December 2025), published January 2026: https://stacklok.com/wp-content/uploads/2026/01/State-of-MCP-in-Software-2026_FINAL.pdf
- Bloomberry (Henley Wing Chiu): We analyzed 1,400 MCP servers, here’s what we learned. Study of 1,412 publicly running MCP servers, 24 February 2026 (updated 27 March 2026): https://bloomberry.com/blog/we-analyzed-1400-mcp-servers-heres-what-we-learned/
- Lumenova: Agentic AI Security Incidents. Analysis of AI agent security incidents, 25 August 2026: https://www.lumenova.ai/blog/agentic-ai-security-incidents/
- Model Context Protocol: Specification, revision 2026-07-28: https://modelcontextprotocol.io/specification/2026-07-28
- ANO Scientific Research Institute of System Synthesis: instrument measurements of the MITR gate (protocol of 14 October 2026, ADR-0262). Open kit for checking the integrity of the receipt chain: https://asi5.ru/console/verify/
Checked: 16 October 2026