MCP Protocol Deep Dive: The AI Ecosystem's USB Port Behind 5,800+ Servers

> Structured English summary of a zhichai.net technical deep-dive on the Model Context Protocol (MCP). The original Chinese article covers the protocol's essence, architecture, ecosystem, security model, and engineering practice.

Key points

• The USB analogy: Before USB (1996), every peripheral had its own connector and driver. Before MCP, every AI application integrated tools differently (OpenAI Function Calling, LangChain Tools, Claude Tool Use). MCP is a standardized connection layer letting any LLM connect to any tool or data source.
• What MCP is / isn't: An open standard initiated by Anthropic, now maintained by an independent MCP organization. It is a JSON-RPC 2.0-based protocol with transport (stdio / Streamable HTTP) and semantic (Tools / Resources / Prompts) layers. It is not an LLM framework, a model API, a security sandbox, or an Agent framework—it only solves the connection layer.
• Three-layer architecture: *Host* (user-facing app: Claude Desktop, VS Code, Cursor) owns the UI and permissions; *Client* (inside Host) manages JSON-RPC sessions and capability negotiation, one per Server; *Server* exposes capabilities—local via stdio, remote via Streamable HTTP.
• Three capability primitives:
• Tools — callable operations with name, description, JSON Schema inputSchema. Descriptions are written for the LLM, and their quality directly drives call accuracy.
• Resources — read-only data with URI identifiers (file://..., db://users/42), including templates and resources/subscribe push updates.
• Prompts — reusable, parameterized prompt templates hosted server-side.
• Rule of thumb: side effects → Tool; pure reads → Resource.
• Transport evolution: stdio (simple, local-only, no concurrency) → SSE (deprecated: two connections, one-way) → Streamable HTTP (introduced March 2025, standard in spec v2025-11-25): single connection, optional streaming, Mcp-Session-Id stateful sessions, resumability, and backpressure control.

Ecosystem milestones

| Date | Milestone | |------|-----------| | 2024-11 | Anthropic publishes MCP spec draft | | 2025-03 | v2025-03-26 introduces Streamable HTTP | | 2025-06 | 1,000+ servers | | 2025-10 | 5,500+ servers; 97M monthly SDK downloads | | 2025-11 | v2025-11-25 makes Streamable HTTP the standard | | 2025-12 | OpenAI announces MCP support (ChatGPT, Codex) | | 2026-03 | 2026 roadmap: enterprise readiness |

The turning point: OpenAI's December 2025 adoption turned MCP from "Anthropic's protocol" into an industry standard. Hosts include Claude Desktop, Cursor, Windsurf, Zed, JetBrains AI Assistant; servers cover filesystems, databases, GitHub, Slack, Jira, Notion, Figma; it is model-agnostic (Claude, GPT, Gemini, DeepSeek, Llama).

MCP vs Function Calling

| Dimension | MCP | Function Calling | |-----------|-----|------------------| | Defined by | Independent org | Model providers | | Discovery | Self-describing servers | Hard-coded in apps | | State | Stateful sessions | Stateless | | Reuse | One server, many hosts | Per-app implementation |

Use Function Calling for a few APIs in one app; use MCP for cross-app tool reuse and shared ecosystems.

Security: MCP's Achilles' heel

The protocol deliberately provides no security isolation—safety is the Host's responsibility. Key risks: over-privileged servers, prompt injection via server content, supply-chain backdoors, and data exfiltration via logging. Mitigations: least privilege, sandboxing, audit logging, and server signing.

2026 roadmap

1. Transport-scale optimization (backpressure, connection pools, load balancing) 2. Agent-to-agent communication (potentially evolving MCP into an inter-agent collaboration protocol) 3. Governance: permissions, auditing, compliance 4. Enterprise readiness: SSO, multi-tenancy, SLAs

Practical advice

• Server devs: tool descriptions determine LLM call accuracy; validate inputs strictly with JSON Schema; return structured errors; use resource subscriptions; respect capability negotiation for backward compatibility.
• Host devs: fine-grained permissions, timeouts/retries, resource caching, audit logging.
• Users: install only trusted servers, review permission requests, keep servers updated.

Closing thought

MCP sits at the OS-interface layer of the AI stack—like POSIX for AI applications. USB succeeded not because it was the best technology, but because everyone agreed on it. MCP is following the same path.

References

• MCP Specification: modelcontextprotocol.io/specification/2025-11-25
• 2026 Roadmap: blog.modelcontextprotocol.io/posts/2026-mcp-roadmap
• Ecosystem stats: mcpmanager.ai/blog/mcp-adoption-statistics
• Security guide: mcpmanager.ai/blog/mcp-security-guide
• MCP vs Function Calling: webfuse.com/mcp-vs-function-calling