One Year of MCP — with David Soria Parria and AAIF leads from OpenAI, Goose, Linux Foundation
Summary
MCP’s first year turned an Anthropic-originated local protocol into an industry-backed communication layer, with the strongest adoption still largely hidden inside enterprises. Builders arrived around Thanksgiving and Christmas, Cursor and VS Code followed, and endorsements from Sam Altman, Satya Nadella, and Sundar Pichai produced April’s “big inflection point.” Soria Parra now sees MCP “everywhere” inside large companies, growing faster than public server counts imply.
The adoption question is giving way to a harder infrastructure question: can remote MCP preserve bidirectional agent behavior while scaling to millions of requests? March introduced streamable HTTP and an authentication design that wrongly combined OAuth authorization and resource servers; June separated them for enterprise identity providers. Meanwhile, optional return streams meant “no client does it because it’s optional,” disabling sampling and elicitation, while state shared across horizontally scaled pods created Redis, Memcache, or other shared-state complexity.
Programmatic tool calling and skills do not displace the protocol; they divide the stack into execution optimization, domain knowledge, and connectivity. Code mode composes several MCP calls into sandboxed code, which Soria Parra views “purely as a token optimization,” while MCP retains authentication, discovery, and self-documentation. Skills provide vertical expertise and scripts; MCP supplies the horizontal “communication layer,” remote execution, and integrations that can evolve independently.
Tasks and MCP Apps are the two expansion vectors beyond today’s context-heavy usage. Tasks formalize operations lasting an hour or multiple days, with polling now and webhook-style completion planned; the design must eventually expose intermediate results and tool provenance, not merely wrap an asynchronous RPC. MCP Apps add portable visual interaction for cases such as seat selection and shopping, though iframe styling and host integration remain unresolved.
Agent-directed discovery could become powerful, but only after registries establish trust, provenance, and regulated-data controls. The aspiration is that “the model knows what it wants,” selects an MCP server, installs it, and completes the job; a public registry alone remains a supply-chain “dumping ground.” Private registries, trust levels, possible provider signatures, legally required financial-data attribution, and session isolation for HIPAA data are therefore requirements the ecosystem will need to address.
Moving MCP into the Agentic AI Foundation reduces platform-ownership risk without reducing Anthropic’s commitment. Soria Parra remains lead core maintainer, the same product and SDK teams remain involved, and neutral ownership means MCP “will always stay open” and its name can remain safely usable. The Linux Foundation saw 50 companies participate on day one and what Jim Zemlin called unprecedented inbound interest across his 22 years there.
AAIF intends to curate proven, composable infrastructure rather than predict a universal agent stack or admit every fashionable protocol. MCP, Goose, and AGENTS.md establish the initial pattern: standards paired with concrete implementations that demonstrate utility, with technical governance separated from funding. Zemlin’s investor-like formulation is that open technology is “an implicit futures contract”: shared engineering can raise quality and adoption, while Brad Howes’s desired proof point is agents becoming asynchronous enough to run “20 agents working for me.”
Deep dive
1. MCP crossed from local experiment to broad industry adoption in one year
Soria Parra’s adoption timeline starts with local Claude Desktop servers, builder enthusiasm around Thanksgiving and Christmas, then major clients such as Cursor and VS Code. April brought the “big inflection point,” when Sam Altman, Satya Nadella, and Sundar Pichai announced plans for OpenAI, Microsoft, and Google to adopt MCP.
Four specification releases accompanied that growth rather than merely harvesting it: remote connectivity and initial authentication in March, an enterprise-oriented OAuth correction in June, and long-running tasks at the end of November. Soria Parra now sees “really solid foundations,” one remaining major primitive, and scalability work before the protocol stabilizes.
The visible ecosystem understates deployment. His read from large organizations is that “internally in companies, in big enterprises, you see MCP everywhere,” with growth occurring behind corporate boundaries rather than in public directories.
2. Remote MCP made OAuth unavoidable—and exposed an enterprise mistake
MCP is deliberately prescriptive: when an unfamiliar client and server authenticate, the protocol should offer one interoperable path. That made authentication inseparable from March’s move beyond standard I/O to remote servers using streamable HTTP.
The first design combined OAuth’s authorization server, which issues tokens, with the MCP resource server, which accepts them. That worked for a startup connecting its server to its own accounts, but not for enterprises where employees authenticate through a central identity provider.
Soria Parra’s candid diagnosis was that “enterprise authentication turns out not to be one of” his strengths. OAuth specialists joined the community, and June separated resource and authorization servers while addressing dynamic client registration and related flows; the MCP server now acts as the resource server while token acquisition is delegated to the authentication server.
Delegated agents remain unfinished territory. OAuth is largely human-centric, although an agent can pass a bearer token tied to a workload identity once it has one; enterprises can arrange this inside closed systems, but “if the client and the server don’t know each other,” MCP has no good general solution yet.
3. Streamable HTTP preserved agent sessions but complicated horizontal scale
The transport goal was an unusual middle ground: ordinary HTTP for a server exposing one simple tool, upgradeable to a long-lived bidirectional exchange for stateful agents. The team considered alternatives such as WebSockets and sought something simpler for basic servers while still supporting complex agent communication.
What worked was leaning on standard HTTP. What failed was optionality: clients may open a server-to-client return stream, but “no client does it because it’s optional,” so servers frequently cannot initiate sampling or elicitation despite those protocol primitives existing.
Streamable HTTP also leaves state on the server. Across Kubernetes pods, a tool call and its later elicitation result may land on different instances, forcing shared Redis, Memcache, or another shared-state system; at deployments “in the millions of requests,” Soria Parra said that becomes a problem.
Senior engineers from Google, Microsoft, AWS, Anthropic, and OpenAI spent two days on the next iteration. Soria Parra formally decides, but described the real job as agreeing on the actual problems, preserving a simple floor, and adding full bidirectionality without making large-scale operation unmanageable.
4. MCP governance accepts concentrated judgment to move at AI speed
The IETF analogy only goes so far. Its open, consensus-heavy process yields durable standards but can take three or four years on work such as OAuth 2.1; Soria Parra argued that the present AI cycle forces MCP into a smaller decision-making group.
About eight core maintainers accept proposals and contributions from the broader community but make the final calls. His intentionally uncomfortable description was “somewhat consensus based but also somewhat like a bit of a dictatorship,” a tradeoff he considers useful while the protocol must move quickly.
Foundation ownership does not replace that technical process. Soria Parra remains lead core maintainer, while his additional AAIF steering role concerns whether incoming projects are adopted, maintained, widely used, and complementary rather than destined to become abandoned inventory.
5. Progressive discovery lets model improvement shrink context pressure
Protocol primitives are only lightly shaped by model advances, according to Soria Parra. Post-training can test models against what he called the “MCP Atlas” and a broad set of real tools, but MCP does not continually redesign its core around each model release.
Tool bloat comes from naively placing every discovered tool into context—the same mistake as loading every skill’s Markdown at once. Progressive discovery instead gives the model limited information, lets it request more, and preserves context for the actual task.
Any tool-calling model can perform that sequence in principle; training makes it more reliable. That is where model providers possess useful foresight: they know progressive discovery is trainable even when the underlying mechanism remains model-agnostic.
Context selection still belongs to the application, not MCP. Agents may discard old tool results, compact a session, or ask a small model such as Haiku what must be retained; Soria Parra expects better learned policies and joked that a year ago everyone prescribed RAG, “that now apparently [is] dead.”
6. Programmatic tool calling optimizes execution without replacing the protocol
MCP technically connects an AI application to servers; the model is not itself a protocol participant. The application can expose every MCP tool directly, but that is only the simplest consumption pattern.
Programmatic tool calling—or “code mode,” though Anthropic’s post did not use that phrase—lets a model compose calls in advance. Instead of tool A, another inference, tool B, and a third call, it generates sandboxed code that feeds one result into the next.
Soria Parra views this “purely as a token optimization.” Authentication, interfaces suited to language models, automatic discovery, and self-documentation still come from MCP; code changes how the application orchestrates those capabilities, not how it connects to them.
As sandboxed execution becomes a normal application capability, he expects more such patterns. The infrastructure may evolve substantially, but “the value of a protocol that connects the model to the outside world” does not disappear when models become better programmers.
7. Skills provide vertical expertise while MCP supplies horizontal reach
Skills and MCP are “orthogonal” in Soria Parra’s framing. A skill teaches domain behavior—how to act as an accountant, engineer, or data scientist—while MCP provides the communication layer and concrete actions against external systems.
Skills can contain code and scripts, but they require a local or remote execution environment. MCP can put execution on the server, making the capability usable from web or mobile applications that do not expose a general-purpose machine to the model.
Authentication is the other dividing line. A script inside a skill does not inherently solve identity, while a Linear MCP server can own authentication and improve its implementation without every downstream skill freezing or maintaining that integration.
Soria Parra prefers shared MCP clients because pooling and discovery improve with centralization. A skill can loosely state what it needs, the application can search an approved registry, and MCP can connect the selected capability; he has already seen internal deployments combine role-specific skills with company data sources this way.
8. Anthropic’s dogfooding reveals a self-service enterprise pattern
Anthropic operates a purpose-built internal MCP gateway and wants it to integrate with its identity providers. Internal teams can launch a server with a command into a Kubernetes cluster, with the setup partially managed and designed around the company’s security requirements.
Internal examples range from a Slack server used to “summarize my Slack for me” to a server for querying company-survey results about Anthropic, AI, the future, and safety. Some wrap external systems that lack a first-party MCP implementation.
This is also MCP’s origin story: Soria Parra’s developer-tooling group could not scale as fast as the company, so it needed a format other teams could build against themselves. A year later, “I probably don’t even know 90% of the MCP servers” inside Anthropic because researchers and other groups create their own.
External infrastructure is converging on the same abstraction. FastMCP Cloud can deploy servers quickly, while gateways such as LiteLLM can expose standard-I/O servers remotely and centralize authentication—the platform handles difficult protocol work while individual developers implement the narrow capability.
9. Registry value will come from curation and machine discovery
The official registry was conceived as an npm- or PyPI-like publication layer after many different directories appeared. A common interface lets the GitHub registry, enterprise catalogs, and other curated views consume compatible metadata rather than inventing separate formats.
Soria Parra does not pretend the public registry is trustworthy: anyone can publish, so it inherits supply-chain attacks and uncertain provenance. Subregistries should filter and curate it, while companies combine approved public entries with their own private servers behind one API.
AI changes discovery because “the model knows what it wants.” The desired experience is for an agent to identify a needed server, install it, and complete the task almost magically—but autonomous installation belongs against a curated registry, not a public “dumping ground for everybody.”
Trust levels are essential. Soria Parra floated, explicitly as “just a random idea” that might never ship, signatures from providers such as Anthropic or OpenAI attesting that they scanned an MCP server and consider its tool descriptions safe; private enterprise registries are the likelier first proving ground.
10. Vertical deployments are forcing policy into the communication layer
Developer summits in San Francisco and London exposed requirements unavailable inside a model-lab bubble. London’s financial audience supplied the sharpest example, while community projects such as a Turkish Airlines server showed how broadly companies were already experimenting.
Financial data may be licensed from a third party under a contract requiring attribution every time a client displays it. Bloomberg is leading a financial-services interest group on what compliant MCP clients and servers must enforce.
One possible future is certified financial-services clients that prove they honor attribution before a server accepts them. Soria Parra presented this as an extension being explored, not a settled part of MCP’s core.
The discussion offered a healthcare example in which a server might require the client to disable every other MCP server during that session so HIPAA-protected information could not reach Slack or another destination accidentally—a cross-tool policy the client would need to guarantee.
11. Sampling has promise but little adoption without client support
Sampling lets an MCP server ask the client’s configured model for inference. It is most compelling for locally distributed servers, where the author does not know whether the user has Claude Desktop, VS Code, or another model and application combination.
The early design omitted a practical requirement: sampling calls often need temporary tools that are not exposed by the originating server. The latest iteration added that ability, and Soria Parra hopes it will unlock more useful deployments.
For remote servers, the host suggested it may be preferable for the operator to ship an SDK, control an API, and potentially charge for inference. Many clients still do not support sampling; Soria Parra is “still sad about it” but concluded, “you got to win some, you got to lose some.”
Actual MCP traffic remains overwhelmingly about retrieving context and data, with occasional Linear-style updates. Deep research and exposed agents are present but uncommon; MCP Apps are another visible direction, while sampling’s potential as an agent-to-agent mechanism remains largely prospective.
12. Tasks turn a synchronous RPC layer into agent infrastructure
Companies repeatedly asked for operations that finish in an hour—or perhaps not within a day. Ordinary tools can imitate this through polling, but the model must understand the workaround, making long-running agents awkward rather than a first-class protocol concept.
Soria Parra’s litmus test was whether a coding agent such as Claude Code could eventually be exposed through MCP. A simple asynchronous tool call was insufficient because clients should ultimately receive intermediate results, invoked tools, additional inputs, and the provenance behind the final answer.
A task is therefore a container, not a duplicate tool primitive. Calling a tool with specific metadata creates the task; that abstraction can later contain other operation types or tasks while SDKs hide most of the implementation complexity.
The baseline resembles an operating-system interface: create, poll until completion, then retrieve the result. A planned optimization will let the server send an event or webhook when done, avoiding both constant polling and the host’s “irresponsible but cool” idea of holding an HTTP connection open for days.
13. MCP Apps make visual interaction portable, with styling unresolved
MCP-UI and OpenAI’s related work are being combined into work on a common MCP Apps standard. The promise is “write once, run everywhere”: an interface built for ChatGPT could also render in Claude, Goose, or another compatible application.
Text is plainly inferior for selecting an airline seat, booking a theater, producing music, or navigating shopping interfaces refined through 20 years of A/B testing. MCP Apps let the model and human interact with the same visual surface instead of translating a spatial decision into prose.
Today the server sends raw HTML through an MCP resource into an iframe, communicating with the host through a bounded
postMessageinterface. The host can inspect the HTML first, and early versions should avoid external references; however, iframe style inheritance is absent, brands will care intensely, and host-to-app styling remains an open design question.
14. AAIF makes MCP neutral while pairing standards with implementations
Anthropic had long wanted a neutral home so the industry could adopt MCP without fearing unilateral control. Block approached while considering a Goose donation, OpenAI joined the discussions, and months of work with the Linux Foundation produced the Agentic AI Foundation.
Neutral ownership means MCP is intended to remain open rather than being reclaimed as proprietary infrastructure, and its name remains safely usable. Soria Parra stressed that Anthropic has not “taken its eye off the ball”: he remains lead maintainer, SDK support is unchanged, and MCP remains core to Anthropic’s products.
Goose supplies the concrete feedback loop. Its pre-MCP plugin system felt “awful,” Brad Howes became one of MCP’s first non-Anthropic contributors around day two, and Goose now gives proposals such as MCP Apps a real client in which their value and defects can be demonstrated.
Initial contributions include MCP, Goose, and OpenAI’s AGENTS.md, but there is no predetermined payments or commerce roadmap. Projects should already be healthy, maintained, adopted, and composable; speculative architectures and duplicate communication layers face a higher bar, while Cooper’s answer on ever donating Codex was simply, “We don’t know yet.”
15. The Linux Foundation separates funding from technical taste-making
Zemlin applies three tests: will a project matter to industry or society, does it require multiple organizations, and can an ecosystem fund and sustain it? AAIF drew 50 companies on day one and unprecedented inbound interest in his 22 years at the Linux Foundation, including Google, Microsoft, Amazon, Block, Bloomberg, Cloudflare, OpenAI, and Anthropic.
The directed fund owns and protects intellectual property, handles licensing, hires neutral leadership and developer-outreach staff, and supports convening. The Linux Foundation hosts more than 50,000 virtual meetings annually; its events, security practices, and community dashboards make the organization more than “a nice blog post and a bunch of logos.”
Money and technical control are deliberately separated to avoid pay-to-play standards. Zemlin called technology “an implicit futures contract”: a company might assign 10 engineers to a shared project, improving velocity and quality, which drives commercial adoption, market feedback, and another round of engineering investment.
His precedent is Google’s Kubernetes donation around 2014, before it was clear whether containers and Kubernetes would prevail over Mesos, PaaS, OpenStack, or virtual machines as the cloud abstraction. MCP may be moving “10 times faster”; the next evidence will be real enterprise impact, profitable MCP startups, and Howes’s desired jump from reading chat sessions to supervising “20 agents working for me.”