By ByteBot
Anthropic’s Model Context Protocol crossed 97 million installs on March 25, 2026, marking the protocol’s transition from experimental standard to foundational infrastructure for agentic AI. Launched just 16 months ago in November 2024, MCP now powers production AI agent systems across Fortune 500 enterprises, with every major AI vendor—OpenAI, Google, Microsoft, AWS, and Cloudflare—backing the protocol through the Linux Foundation’s newly formed Agentic AI Foundation.
MCP standardizes how AI agents connect to external tools and data sources—databases, APIs, CRMs, enterprise applications. It’s the plumbing layer that lets AI assistants actually do things beyond generating text: query databases, trigger workflows, integrate with business systems. And at 97 million installs, it’s no longer experimental. It’s infrastructure.
The Fastest Protocol Adoption in Years
MCP went from zero to 97 million installs in 16 months. For perspective, React took roughly three years to reach 100 million monthly downloads. The difference? Every major AI provider aligned around MCP immediately. Claude, GPT-5.4, Gemini—all ship MCP-compatible tooling. No fragmentation. No competing standards. The protocol wars never happened.
The ecosystem reflects this velocity: 5,800+ community and enterprise MCP servers now exist, covering databases, cloud providers, CRM systems, developer tools, analytics platforms. More than 10,000 active MCP servers run in production. Gartner predicts 40% of enterprise applications will include AI agents by the end of 2026, up from less than 5% today. Q1 2026 marked the quarter when Fortune 500 companies moved agentic AI from pilot programs to production deployment.
Industry Unity: Rare and Strategic
On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation. OpenAI and Block joined as co-founders. AWS, Google, Microsoft, Cloudflare, and Bloomberg signed on as platinum members. This isn’t just open source goodwill—it’s strategic alignment. Vendor-neutral governance signals that MCP isn’t Anthropic’s proprietary play. It’s the standard everyone agreed to build on.
The foundation hosts three projects: MCP (Anthropic’s agent-to-tool protocol), goose (Block’s local AI agent framework), and AGENTS.md (OpenAI’s coding agent guidance standard). The goal is clear: standardize the infrastructure layer before the next wave of AI applications fragments into incompatible ecosystems.
Security Reality Check: 30+ CVEs in 60 Days
Here’s the uncomfortable truth: between January and February 2026, security researchers filed over 30 CVEs targeting MCP servers, clients, and infrastructure. Vulnerabilities ranged from path traversals to a CVSS 9.6 remote code execution flaw. Research by Equixly found command injection vulnerabilities in 43% of tested MCP implementations.
This is the Log4j pattern repeating: infrastructure everyone depends on, security gaps discovered only after mass adoption. MCP won the adoption race but lacks production security hardening. No standardized audit trails. Authentication tied to static secrets instead of enterprise SSO. No defined way for security teams to answer: “What did this agent do, when, and with whose authorization?”
Production deployments keep running into the same walls. Enterprises need end-to-end visibility into what agents requested, what was executed, and what the outcome was. That’s a compliance requirement. MCP doesn’t define this today.
The 2026 Roadmap: Addressing the Gaps
MCP’s 2026 roadmap, published in March by lead maintainer David Soria Parra, makes enterprise readiness the top priority. The focus: moving from static secrets to SSO-integrated authentication, standardized audit trails, and defined gateway behavior. Other priorities include transport evolution, agent communication improvements, and governance maturation.
The roadmap acknowledges what the CVE flood already proved: rapid adoption exposed cracks. MCP needs production hardening. Deeper security work—DPoP (Demonstrating Proof of Possession), Workload Identity Federation—is “on the horizon,” which means it has active community proposals but isn’t prioritized for this cycle. That’s concerning. Security work should be foundational, not deferred.
MCP Won. Now What?
The AI competition shifted from model capabilities to infrastructure control. MCP won by standardizing the connection layer between AI agents and the real world. It’s the Android/iOS moment for agentic AI: one standard won, and the ecosystem aligned around it. That’s strategically significant. Whoever controls how agents talk to tools controls the AI application layer.
But 97 million installs doesn’t mean production-ready. It means widely adopted. Those aren’t the same thing. The security gaps, the missing compliance infrastructure, the deferred hardening work—these are the growing pains of infrastructure that scaled faster than it was battle-tested.
MCP is foundational now. That comes with responsibility. The 2026 roadmap needs to deliver on enterprise readiness, not just promise it. Because when you’re the standard everyone depends on, you don’t get to be experimental anymore.
