The model context protocol has become the default way to connect AI applications to tools and data. It now sits under the Linux Foundation, and its 2026-07-28 revision makes the protocol stateless and tightens OAuth 2.1 authorization.
That maturity has not made MCP safe by default. Public research has shown tool poisoning, prompt injection through tool output, a critical remote code execution flaw in a popular MCP proxy and the first malicious MCP server on npm.
Every MCP tool is remotely triggered code execution, and your threat model should start there.
MCP does not replace APIs, and A2A does not replace MCP. Most enterprise agent programs will run all three.
Expose a system to application code written by developers. Best for deterministic system-to-system integration. A typical MCP server is a thin layer over an existing REST or GraphQL API, so if a system has no stable API, build that first.
Exposes tools, resources and prompts to AI models in a discoverable form, using JSON-RPC 2.0 and an OAuth 2.1 profile over HTTP. Use it when a model must choose and call tools at runtime. One server works across any compliant AI client.
Lets independent agents discover each other through agent cards, delegate tasks and return results. Use it when one agent must hand work to another. A planner agent calls specialists over A2A, and each specialist reaches its tools over MCP.
Learn hosts, clients, servers and primitives, and what the stateless revision changes for servers built on older versions.
Apply the OAuth 2.1 profile with per-server audiences, narrow scopes, step-up auth and no token passthrough.
Cover prompt injection, tool poisoning, confused deputy and supply chain risk with a gateway, registry and curated tool catalogs.
Follow a 13-step governance checklist and readiness scorecard, moving from read-only pilots to guarded write tools.
An open, JSON-RPC 2.0 based standard that lets AI applications connect to tools, data and workflows through a common interface. A host runs MCP clients that talk to MCP servers, which expose tools, resources and prompts. One server works across any compliant AI client.
An API exposes a system to code written by developers. MCP wraps that capability so an AI model can discover tools at runtime, read their schemas and call them, with a standard authorization flow. The API still does the work underneath.
Revision 2026-07-28. It removes protocol-level sessions and the initialize handshake, adds a server/discover call, deprecates Roots, Sampling, Logging and Dynamic Client Registration, and documents OpenTelemetry trace propagation.
A protected MCP server acts as an OAuth 2.1 resource server and your identity provider issues tokens. Clients send RFC 8707 resource indicators with PKCE, and servers must reject tokens not issued for them and never forward other tokens.
Not by default. Main risks are prompt injection through tool output, tool poisoning, confused deputy attacks, token passthrough and malicious community servers. With a gateway, a private registry, scoped OAuth, sandboxing and human approval for high-risk actions, it can be run safely.
Hidden instructions placed in a tool's description that steer the model to do something the user did not ask, such as reading SSH keys. A rug pull is when a server changes a description after approval. Hash pinning and change alerts are the direct countermeasures.
Once you run more than a few remote servers, yes. A gateway centralizes authentication, policy, rate limits, logging, tool filtering and egress controls. It must validate tokens for its own audience and obtain separate downstream tokens, never pass tokens through.
CTOs, CISOs and platform leaders connecting AI agents to internal tools and data, and the engineers who will build and operate MCP servers.
Drop your details and we'll send MCP in the Enterprise: Security and Integration Guide straight to your inbox - no spam, unsubscribe anytime.
Talk through your MCP gateway, registry and authorization design with our engineering leads. A working session, not a sales pitch. SECTION 7 - FAQ - 5 to 8 questions
Talk to our engineers