Model Context Protocol Goes Stateless as A2A Joins Its Foundation

From a connector spec to the base layer for AI agents

When Anthropic open-sourced the Model Context Protocol on November 25, 2024, the announcement was modest. It described an open standard for connecting AI assistants to the places where data is stored, such as content repositories, business tools and development environments.11 The launch package had three parts: the specification and SDKs, support for local MCP servers in the Claude Desktop apps, and an open-source repository of reference servers for systems such as Google Drive, Slack, GitHub, Git, Postgres and Puppeteer.11 Block and Apollo were named as early adopters. Developer-tool makers Zed, Replit, Codeium and Sourcegraph were also building against it.11

Twenty-three months later, that release looks like the starting point for the shared plumbing of agentic AI. Three things have changed since then. In July 2026 the protocol got its biggest technical overhaul so far. It now has a neutral governance home that it shares with Google's agent-to-agent protocol. And its security record has drawn attention from U.S. intelligence and cybersecurity agencies. Read together, the reporting supports a clear conclusion: MCP has won the agent-to-tool layer, and the open question now is whether enterprises can secure and govern it fast enough.

The original pitch: fixing the N×M problem

The core idea has not changed. Before MCP, every pairing of an AI model and an external tool needed its own connector, which Anthropic called an "N×M" integration problem.12 InfoQ's early coverage described the design as client-server. AI applications run MCP clients that connect to MCP servers, and those servers sit in front of data sources or tools. Messages are defined in JSON-RPC.20 Servers exposed three primitives: prompts, resources and tools. Clients exposed two, roots and sampling. Anthropic warned that a human should always be able to deny sampling requests.20 One technical review credited much of MCP's early momentum to a detailed spec, borrowed foundations from the Language Server Protocol, and Anthropic's heavy use of the protocol in its own products.17

The CIO.com coverage puts the enterprise case in simple numbers. If four assistants need to reach ten marketing systems, that used to mean as many as 40 custom integrations. Under a shared protocol, each assistant implements MCP once and each system publishes one server.30

Adoption: rivals signed on fast

The turning point came when competitors adopted the protocol. A timeline compiled by Tech Insider shows Microsoft adding MCP to Copilot Studio in March 2025. OpenAI built it into its Agents SDK days later, Google committed Gemini support in April, and AWS added MCP and A2A to Bedrock AgentCore in preview in July 2025.27 Wikipedia's entry records OpenAI's formal adoption in March 2025 and the later addition of MCP to ChatGPT apps.12

Not every account matches. A vendor explainer from Natoma, dated November 2025, said OpenAI, Microsoft and Google had not officially announced MCP adoption.19 That claim conflicts with the documented record, and it is a reminder that some MCP explainers are marketing material. Anthropic's own December 2025 numbers are the most-cited baseline: more than 10,000 active public servers, adoption by ChatGPT, Cursor, Gemini, Microsoft Copilot and VS Code, and more than 97 million monthly SDK downloads across Python and TypeScript.16 Later estimates are larger but harder to check. Tech Insider puts the count at about 15,930 public servers across four registries by August 2026, and cites survey data saying 78% of enterprise AI teams had MCP in production.27 The same report also cites a separate figure of 41% of enterprises in limited or broad production.27 That spread suggests the higher survey numbers should be treated as rough indicators of direction.

Neutral governance, then A2A joins

Anthropic gave up control in December 2025. It donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded with Block and OpenAI and supported by Google, Microsoft, AWS, Cloudflare and Bloomberg.16 MCP joined Block's goose and OpenAI's AGENTS.md as founding projects, and Anthropic said MCP's existing governance model would stay the same.16

In August 2026, Google's Agent2Agent (A2A) protocol moved into the same foundation. Forbes dates the AAIF announcement to August 17.3 Other outlets date the transfer to August 20.26 Forbes also adds an important caveat: Google had already handed A2A to a Linux Foundation project in June 2025, so the August move settled where the protocol is hosted, not who controls it.3 Pebblous adds that each protocol keeps its own maintainers, spec process and release schedule.7

On the division of labor, the coverage agrees. MCP covers the "vertical" link between an agent and its tools and data. A2A covers the "horizontal" link that lets one agent find another through a published agent card and hand it a task.23 AAIF now describes five projects as a single stack: AGENTS.md for instructions, goose as the runtime, MCP for connectivity, agentgateway for traffic mediation, and A2A for interoperability between agents.7

The reports diverge on how big the foundation is and how it got there. Flowhunt says membership grew from fewer than 40 at launch to more than 250 by August 2026.2 Times Now reports about 240 by late July.29 One developer blog claims more than 150 members at launch.8 Accounts of IBM's Agent Communication Protocol also conflict. Several sources say ACP merged into A2A in August 2025.17 One comparison guide treats it as a separate AAIF project.9 The merger account has more support. In practice, enterprise architects now face two layers that are designed to fit together, not three competing standards.

The July 2026 spec: built for enterprise infrastructure

The 2026-07-28 specification is the biggest technical change since launch. The maintainers removed the initialize handshake and the protocol-level session ID. Protocol version and client capabilities now travel with every request. As a result, a remote server that once needed sticky sessions and a shared session store can run behind an ordinary round-robin load balancer.21 The release also made extensions official, including MCP Apps for server-rendered interfaces and Tasks for long-running work. It tightened authorization to align with OAuth and OpenID Connect, and it set a lifecycle policy with at least twelve months between deprecation and removal.21 Roots, Sampling and Logging, which date back to the original client primitives, entered that deprecation queue.2728

The large platforms were quick to support it. Google called the release a watershed that turned MCP from a local integration layer into open infrastructure for enterprise AI.24 Cloudflare said MCP servers can now run in a single Worker with no stateful infrastructure.23 Times Now points to Enterprise-Managed Authorization, built with Okta, and argues that the guaranteed deprecation window may matter most to regulated finance.29 Its reporting also names Kraken, Coinbase and Binance among the trading platforms exposing services over MCP.29

This is the key change for autonomous agents in the enterprise. A stateless core means MCP traffic can be routed, cached and inspected with the same tools companies already use for HTTP APIs. The new roadmap's focus on agent identity reflects a known gap: authorization still assumes a person approving access in a browser, which does not fit software that runs without one.22

The security gap

The protocol's weakest point is the large population of servers built quickly on top of it. Tech Insider compiles third-party figures: independent scans finding exploitable flaws in 30% to 82% of public servers, more than 50 tracked vulnerabilities with 13 rated critical, and a CVSS 9.6 remote-code-execution bug in a widely downloaded package.27 It also cites a finding that only 8.5% of public servers implement OAuth.27 These numbers come from vendors and researchers using different methods, and the gap between 30% and 82% shows how uncertain they are. Even so, the direction is consistent across sources.

The government response is reported with slightly different details. Wikipedia cites a May 2026 NSA report saying MCP's spread had outpaced its security model.12 Tech Insider describes joint NSA–CISA design guidance published June 2.27 Either way, federal security agencies addressed the protocol within about 18 months of launch, which is fast by regulatory standards.

What it means

The 2024 announcement promised a single protocol to replace fragmented connectors.11 On that goal MCP has largely succeeded. The harder work is still ahead. Pebblous notes that shared standards define how agents connect, but each company still has to decide which agent can reach which data.7 Vendors are already filling that gap. This week's product launches include a read-only, scoped MCP server for compliance data.26 For enterprises deploying autonomous agents, interoperability is mostly settled. Identity, authorization and auditing across chains of MCP and A2A calls are now the main problems, and they will decide whether agentic systems are safe to run in production.