The Model Context Protocol (MCP) is an open standard created by Anthropic that defines how AI models communicate with external data sources and tools. Anthropic donated the protocol to the Linux Foundation's Agentic AI Foundation, stating that the protocol should belong to the broader community rather than any single company. (Sources: Building Effective AI Agents, Trustworthy Agents in Practice (Anthropic, April 2026), Scaling Managed Agents: Decoupling the Brain from the Hands)
Function
MCP standardizes the tool-integration layer for agentic AI systems — the interface between an AI model and the external services, APIs, data sources, and execution environments it can use. It provides a common client implementation that allows models to integrate with third-party tools without each integration requiring custom code. The protocol sits at the Augmented LLM layer, where it serves as the mechanism by which an LLM gains standardized access to retrieval, tools, and memory.
Rationale
In Anthropic's public rationale, open protocols allow security properties to be designed into the infrastructure once, rather than patched together one deployment at a time, and keep competition focused on the quality and safety of the agent rather than on who controls the integrations. Anthropic contrasts this with proprietary tool protocols, which in its account produce fragmentation: security properties must be independently validated for every deployment; switching costs lock deployers into specific providers; and innovation in agent safety cannot compound across the ecosystem. Trustworthy Agents in Practice (Anthropic, April 2026)
Security architecture in Managed Agents
In Anthropic's Managed Agents infrastructure, MCP plays a specific security role. OAuth tokens for MCP tools are stored in a secure vault outside the sandbox, and Claude calls MCP tools through a dedicated proxy. The proxy accepts a token associated with the session, fetches the corresponding credentials from the vault, and makes the call to the external service, so that the harness and the agent are never credential-aware. According to Anthropic, this vault pattern prevents prompt injection from being exploitable for credential theft, because the agent can call tools but cannot see the auth tokens those tools use. (Source: Scaling Managed Agents: Decoupling the Brain from the Hands)
Governance
MCP was originally created by Anthropic and subsequently donated to the Linux Foundation's Agentic AI Foundation, placing it alongside other Linux Foundation projects such as the Linux kernel, Kubernetes, and OpenSSF as community-governed infrastructure. Anthropic frames the donation by analogy to Brad Smith's "Digital Geneva Convention" concept, describing it as shared governance infrastructure that no single actor can use for competitive advantage.
Relation to NIST standards work
Anthropic's trustworthy agents policy post calls for NIST to develop shared benchmarks for agent security, including agent resistance to prompt injection and reliability of uncertainty surfacing, and positions MCP's open-standard architecture as the infrastructure layer on which those security properties should be built. Trustworthy Agents in Practice (Anthropic, April 2026) This connects to NIST's AI Agent Standards Initiative, launched in February 2026, which includes a workstream on "Software and AI Agent Identity and Authorization" — the security-boundary problem that MCP's vault pattern addresses.
Status
As of April 2026, MCP was in active use in Anthropic's Claude Platform, including Managed Agents and Claude Code, and supported a growing ecosystem of third-party tool integrations. The protocol had been donated to the Linux Foundation, with community governance underway. NIST CAISI had received Anthropic's technical submission on agentic security (referenced in Trustworthy Agents in Practice (Anthropic, April 2026)).
Relationships
- depends-on: Agentic AI — MCP exists to solve agentic tool integration
- related: Agent Architecture Patterns — MCP is the integration standard at the augmented-LLM layer
- related: Prompt Injection — vault pattern built on MCP addresses credential-theft injection attacks
- related: NIST AI Agent Standards Initiative (Feb 2026) — NIST agent security workstream; MCP positioned as enabling infrastructure
- related: National Institute of Standards and Technology (NIST) — NIST as standards body called to develop agent security benchmarks
- related: Anthropic — creator and initial steward; donated to Linux Foundation
- related: Scaling Managed Agents: Decoupling the Brain from the Hands, Building Effective AI Agents, Trustworthy Agents in Practice (Anthropic, April 2026) — primary sources