MCP Crosses 97 Million Installs: From Standard to Infrastructure
Anthropic's Model Context Protocol quietly became foundational plumbing for AI agents. Here's why everyone is shipping MCP support
From Spec to Standard
When Anthropic published the Model Context Protocol in late 2024, the pitch was modest: a small, open spec for how LLMs talk to external tools and data sources. A year and a half later, MCP crossed 97 million installs across servers, IDEs, agent frameworks, and developer tools. The protocol moved from experimental standard to the de-facto interface for agent-tool interaction.
The interesting thing about that growth is that it didn't come from a single buying decision. It came from individual maintainers shipping MCP servers for their own products — databases, ticket trackers, design tools, browsers, terminals — and from agent runtimes choosing to consume them.
Why It Won
It's Boring
The spec is intentionally narrow. Tools are described as JSON schemas. Resources are URIs. Prompts are templates. There is no opinion about which model you use or which orchestration layer sits on top. That narrowness is exactly what made it cheap to adopt.
It's Model-Agnostic
Although it came out of Anthropic, MCP doesn't require Claude. OpenAI, Google, Mistral, and the open-source agent frameworks all consume MCP servers natively now. For a tool vendor, writing one MCP server beats writing six bespoke integrations.
It Composes
Because every server speaks the same protocol, agents can compose tools across vendors without custom glue. Connect your Linear MCP, your Postgres MCP, and your filesystem MCP, and the agent sees them as a flat capability set.
What Changed at 97 Million
At experimental-protocol scale, you can break things. At nearly 100 million installs, you can't. The MCP ecosystem in May 2026 looks more like a real platform than a spec: stable transports, authenticated sessions, signed servers, registry tooling, and a growing catalog of certified integrations.
That maturity matters because enterprises are the next adoption wave. The questions an SRE asks about MCP — supply chain, sandboxing, secrets handling, audit — are now things the protocol and its tooling actually answer.
The Risks
Two failure modes are worth watching. The first is fragmentation: each major vendor extending the spec with private capabilities and breaking interoperability. So far the governance has resisted that, but the pressure increases as the stakes grow.
The second is security. An agent with shell access through one MCP server and database access through another is a credible attack surface. Expect more incidents over the next year and more tooling around server signing and capability scoping.
The lesson of MCP is the same lesson HTTP and SQL taught a generation ago: protocols win when they are simple, neutral, and good enough — not when they are perfect.
Tags: MCP • Anthropic • AI Agents