MCP Deep Dive: The Protocol That Became an Industry Standard in 15 Months

One protocol. Fifteen months. From an internal Anthropic experiment to an industry-wide standard. MCP redefined how AI agents connect to the world — and the story is far from over.

I. The Beginning: November 25, 2024

On November 25, 2024, Anthropic published a deceptively quiet announcement:

"Today we're open-sourcing the Model Context Protocol (MCP), a new standard for connecting AI assistants to the systems where data lives."

Nobody predicted what would happen next.

At launch, Anthropic shipped:

• The MCP specification — a lightweight protocol built on JSON-RPC 2.0
• Python SDK and TypeScript SDK
• 5 reference servers: filesystem, GitHub, Slack, PostgreSQL, SQLite
• Claude Desktop as the first MCP-compatible host application

MCP's core philosophy is strikingly simple: AI applications shouldn't be silos. Every LLM application was reinventing the wheel — writing custom integrations for every database, every API, every tool. MCP provides a unified interface: write once, run everywhere.

II. Three Primitives: Tools, Resources, Prompts

MCP defines three core primitives, each solving a specific connection problem:

Primitive	Problem Solved	Analogy
Tools	Functions LLMs can call — standardized function calling	AI's hands
Resources	Structured data LLMs can read	AI's eyes
Prompts	Parameterized, reusable prompt templates	AI's dictionary

These three primitives cover the vast majority of agent-to-world interaction scenarios. You don't need a new protocol for each new tool — just implement these three primitives.

III. The Watershed: OpenAI Adopts MCP (March 2025)

For the first four months after MCP's release, it was seen as a "Claude-only protocol." In February 2025, third-party apps like Zed, Replit, Codeium, and Sourcegraph started supporting it — but one crucial signal was missing.

In March 2025, OpenAI announced MCP support in its Agents SDK and ChatGPT desktop application.

By May 2025, community servers surpassed 1,000. Directory sites like mcp.so and mcpservers.org launched.

IV. Specification Evolution: From stdio to Full Stack

MCP underwent four major specification upgrades:

Date	Version/Feature	Impact
2024.11	Initial release — stdio transport	Foundation for local tool integration
2025.04	Remote servers + HTTP/SSE transport	Unlocked enterprise and SaaS use cases
2025.04	OAuth 2.0 authentication	Secure enterprise-grade deployment
2025 Q3-Q4	Sampling + Roots + Progress	Agent loops, file scoping, long-running operations
2026 Q1	MCP 1.0 Stable Specification	Formalized by tri-party working group (Anthropic + OpenAI + Google + Microsoft)

The evolution of transport mechanisms is also notable:

• stdio → Local process communication, simplest
• HTTP + SSE → Remote servers, unlocked SaaS integration
• WebSocket → Bidirectional real-time communication, formally added in MCP 1.0

V. MCP vs A2A: Vertical vs Horizontal

In April 2025, Google released the A2A (Agent-to-Agent) protocol. Many asked: are MCP and A2A competing?

No. They solve problems at different layers, forming a dual-layer solution:

Dimension	MCP	A2A
Core Focus	Tool/resource access	Inter-agent collaboration
Communication Direction	Vertical (Agent → Resource)	Horizontal (Agent ↔ Agent)
State Model	Essentially stateless	Stateful task lifecycle
Service Discovery	mcp:// server URL	Agent Card (/.well-known/agent-card.json)
Output Types	Tool results, resource reads	Tasks, artifacts, multi-turn dialogs
Origin	Anthropic (2024.11)	Google (2025.04)

Layered architecture in real deployments:

Orchestrator Agent
    │
    ├── MCP → PostgreSQL server (read order data)
    ├── MCP → Stripe server (process payments)
    │
    ├── A2A → InventoryAgent (complex inventory reasoning)
    │             │
    │             └── MCP → WarehouseDB
    │
    └── A2A → ComplianceAgent (compliance checks)
                  │
                  └── MCP → RegulationsAPI

The orchestrator uses MCP for direct tool access and A2A to delegate tasks to specialist agents. Each specialist agent internally uses MCP to access its own data sources. They're complementary — both are essential.

VI. A2A's Task Lifecycle

A2A's core unit of work is the Task, with a well-defined state machine:

SUBMITTED → WORKING → COMPLETED (terminal)
                    → FAILED (terminal)
                    → CANCELED (terminal)
           → INPUT_REQUIRED (interrupt — awaiting user input)
           → AUTH_REQUIRED (interrupt — needs authentication)
           → REJECTED (terminal — agent declined)

Core JSON-RPC methods:

Method	Description
SendMessage	Submit task and wait for synchronous response
SendStreamingMessage	Submit task and receive streaming SSE updates
GetTask	Poll current task state
CancelTask	Request task cancellation
SubscribeToTask	Subscribe to task state change events

When a task enters the INPUT_REQUIRED state, the orchestrator can inject additional messages and resume processing — without starting a new task. This explicitly supports multi-turn dialogs.

VII. Security Challenges in Production

7.1 Man-in-the-Agent Attack

In 2025, Trustwave SpiderLabs demonstrated a critical attack class: a malicious agent submits a bloated Agent Card whose description fields are carefully crafted to manipulate the orchestrator's LLM selection logic. This is prompt injection operating at the infrastructure layer.

7.2 Four-Layer Defense Model

1. mTLS transport-layer authentication — each agent holds a PKI-issued certificate
2. OAuth 2.0 Client Credentials — short-lived access tokens scoped to specific capabilities
3. Signed Agent Cards — cryptographically verify cards are issued by domain owners
4. Zero-trust task routing — verify the submitting agent's token has the scopes claimed in its card

VIII. Ecosystem Status (June 2026)

Key tools and frameworks:

Tool	Purpose
MCP Inspector	Debug and test MCP servers
FastMCP	Rapidly build MCP servers
LangChain MCP Adapter	LangChain ecosystem integration
LlamaIndex MCP Tools	LlamaIndex ecosystem integration

IX. Five Drivers of MCP's Rapid Rise

1. Open-source from day one — MIT license eliminated vendor lock-in concerns
2. Protocol simplicity — JSON-RPC 2.0 over stdio/HTTP, easy to implement in any language
3. Anthropic's credibility — launched alongside Claude, immediately had real use cases
4. OpenAI's endorsement — March 2025 adoption removed the "Anthropic-only" label
5. Right timing — 2024-2025 AI Agent use case explosion, market desperately needed standardization

X. When to Use Which Protocol?

Scenario	Recommended Protocol
Need direct access to raw data or tools	MCP
Required capability can't be expressed as a single synchronous tool call	A2A
Required expertise resides in another agent with its own reasoning	A2A
Simple database/API queries	MCP
Cross-organization/cross-vendor agent collaboration	A2A

Google's developer guide recommends: Start with MCP for simple tool integration; introduce A2A when you need capabilities that can't be expressed as a single synchronous tool call.

---

XI. Next Steps: The Future of the Protocol

MCP 1.0 is stable, but protocol evolution never stops. The MCP Working Group's roadmap points to several directions:

• Cross-agent context sharing — deeper MCP + A2A integration
• Enterprise observability — W3C traceparent across agent boundaries
• Agent Registry — centralized service discovery, whitelisting, caching
• Standardized security audits — Agent Card signature verification as mandatory

From a weekend project in November 2024 to an industry-wide standard infrastructure by 2026 — MCP completed in 15 months what most protocols take years to achieve. It proved: in the age of AI Agents, the best protocol isn't the most complex — it's the simplest one at the right time.