Updated: 2026-07-12

When Anthropic published Model Context Protocol in November 2024, reaction split in two. One group saw a sensible but still immature idea that would take years to matter, another saw the OAuth of agents, the missing protocol to stop every model-tool integration from being specific. Twenty months later, the second reading has proved more accurate. MCP is present in the most-used clients, there are dozens of production-ready servers, and patterns of a mature ecosystem are emerging.

Key takeaways

  • MCP is now de-facto standard: supported by Claude Desktop, Cursor, Zed, Continue, and VS Code with Copilot.

  • The official registry held close to 2,000 entries at its first anniversary (November 2025), and Anthropic put the whole ecosystem at over 10,000 active public servers when it donated the protocol to the new Agentic AI Foundation that December.

  • Three recognizable deployment patterns: local, corporate proxy, and managed SaaS.

  • Open problems: granular authorization, inconsistent community server quality, and distributed observability.

  • The historical pattern of LSP and DAP predicts consolidation around the most-maintained servers.

Why MCP consolidated fast

Three factors explain the speed:

  • The standard is simple. A JSON-RPC protocol over stdio or websockets with three basic types (tools, resources, prompts) and a single negotiation layer. It doesn’t try to solve authentication, authorization, or observability beyond the minimum.

  • Big clients supported it almost simultaneously. Claude Desktop supported it from launch, in November 2024. Cursor built it in natively with its 1.0 release in June 2025, with one-click install and OAuth authentication. Zed and Continue added it during that same year, and GitHub Copilot in Visual Studio Code reached general availability for MCP in July 2025, with version 1.102. No competitor with real weight in the editor market wanted to be left out.

  • The community published servers quickly. The official registry launched in preview in September 2025; two months later, at its first anniversary, it already held close to 2,000 entries, a 407% jump from the initial batch. By December 2025, when Anthropic donated the protocol to the Agentic AI Foundation (a directed fund under the Linux Foundation, co-founded with Block and OpenAI and backed by Google, Microsoft, AWS, Cloudflare, and Bloomberg), it put the whole ecosystem at over 10,000 active public servers and more than 97 million monthly SDK downloads. The network effect is the classic one.

The servers actually used

Of hundreds cataloged, a subset captures most real traffic:

Productivity (most used): official Google Workspace, Microsoft 365, Notion, Linear, and Slack servers. Production-mature with well-solved OAuth authentication.

Development (most used): Git (local repositories), official GitHub, GitLab, and connectors to CI/CD tools. For databases, PostgreSQL, MySQL, MongoDB, and Redis servers are stable.

Persistent memory (recent but already important): let agents remember facts across sessions. The two most popular are Anthropic’s (memory-mcp) and Mem0-MCP.

Specific corporate: Salesforce, SAP, ServiceNow, Jira, Confluence, and HubSpot have mature implementations enabling enterprise agentic flows.

For installing any of these locally, see the local MCP server installation guide.

Deployment patterns that emerged

When the ecosystem was starting, every install was ad-hoc. Today three clear patterns are recognizable:

Local pattern: the individual developer’s. MCP servers running on the same machine, configured in a per-app file. Good for exploration, good privacy, almost zero operational cost. Doesn’t scale.

Corporate proxy pattern: when an organization wants to expose MCP servers to the whole team with auditing and control. A central proxy hosts servers, authenticates against the internal directory (Azure AD, Google Workspace, Okta), and exposes them to clients via signed authentication. Enables centralized policy, audit logs, and common versioning.

Managed SaaS pattern: the most recent. Specialized providers (Zenrows, Composio, Pipedream) offer hosted MCP servers with OAuth to third parties managed by them. Useful for small teams wanting access to many services without operating infrastructure.

Problems that remain open

Despite consolidation, three structural problems still lack clear answers:

  • Granular authorization. MCP delegates authorization to the server, but there’s no standard for the client to express "I want to allow the agent to do X but not Y". This creates risk when the agent has broad write access: an OX Security audit disclosed in April 2026 found a design flaw in the stdio transport that exposed roughly 200,000 MCP servers to command execution, which Anthropic treated as a configuration risk rather than a protocol vulnerability. It is a problem also addressed in enterprise agent governance.

  • Inconsistent quality of community servers. Many work well for demos but fail in production: lack of robust error handling, absent retries, badly calibrated timeouts, incomplete documentation.

  • Observability. When an agent passes through five MCP servers to resolve a request, knowing where an error was introduced requires distributed traces that no tool today offers integrally.

Comparison with earlier protocols

MCP resembles in pattern protocols like LSP for editors, DAP for debugging, and ODBC connectors for databases in the nineties. The three established a common layer that replaced point-to-point integrations, and the three went through similar cycles:

  • Fast adoption in main clients.

  • Server proliferation with heterogeneous quality.

  • Progressive consolidation around the most-cared-for servers.

The historical lesson is that these protocols win when the incentive is shared between tool makers and service providers. MCP has that incentive.

My reading

By mid-2026, MCP has crossed the threshold of a protocol you use without thinking. For developers, the decision is no longer whether to integrate MCP but which servers to include in a given project. For product teams, the cost of incorporating new agentic functionality has dropped considerably.

The official-directory-with-curation piece already has an institutional home: the Agentic AI Foundation, under the Linux Foundation. What genuinely remains open is the rest of the second maturity cycle: standard granular authorization and integral observability, plus the security discipline that this year’s stdio transport flaw exposed. If those two fronts get solved during 2026, MCP consolidates as silent infrastructure of the agent ecosystem, similar to what LSP did with editors. The pace of the last twenty months makes that outcome the more likely one.

Versión en español: Ecosistema MCP consolidado: mapa rápido para 2026.

Sources

  1. Anthropic: Introducing the Model Context Protocol
  2. Model Context Protocol: One Year of MCP, November 2025 Spec Release
  3. Model Context Protocol: MCP joins the Agentic AI Foundation
  4. Visual Studio Code: release notes 1.102 (MCP general availability)
  5. Cursor: changelog 1.0 (MCP one-click install)
  6. VentureBeat: MCP stdio flaw exposes 200,000 AI agent servers