More than 97 million downloads a month were recorded for the Model Context Protocol’s (MCP) Python and TypeScript software development kits by December 2025, according to Anthropic. The company also reported over 10,000 active public MCP servers, about a year after introducing the standard.
Evidence of actual traffic growth came in Netskope’s July 2026 AI report: users accessing remote MCP servers increased 250% over ten weeks, while transactions rose 375%. The findings covered a subset of Netskope customers and internet-hosted servers, excluding connections running locally or within corporate networks.
MCP could reduce the repeated engineering work needed to connect AI applications to enterprise systems. It also gives assistants access to information and actions that can cause harm when misused.
MCP defines a common way for AI applications to communicate with software that exposes selected functions or data. An MCP server might provide a tool for retrieving an invoice or searching a document collection. The AI application’s client discovers those capabilities and sends requests to the server, which performs the operation and returns the result. Servers can also supply readable resources and reusable prompt templates.
The server often uses an existing application programming interface, or API, underneath. Developers still need to build or configure that connection. The benefit comes when several AI applications need the same business capability: a compatible MCP server can provide it through a shared interface. Teams can reuse that work instead of building another connector for every assistant they introduce.
That could change how companies purchase and develop AI software. An approved customer lookup could remain available as teams evaluate competing assistants. Internal business functions could become accessible through a consistent interface, reducing the cost of supporting additional AI applications. Compatibility testing and vendor-specific features would still affect switching costs, but the connection to company data would become less dependent on one product.
Stacklok surveyed 300 senior technical leaders in December 2025, including 100 in software companies, with respondents based in the United States, Canada, and the United Kingdom. Among the software respondents, 26% reported limited production use of MCP and 19% reported broad production use.
The survey also shows how much integration work remains. Among software respondents, 38% cited legacy system integration as an adoption obstacle, while 40% cited implementation or operating costs. MCP provides a common interface, but older applications may still need substantial development work before they can support useful tools.
Connecting more tools can itself create costs. In a November 2025 engineering article, Anthropic described an approach that reduced token use from 150,000 to 2,000, a 98.7% reduction, by letting agents discover tools as needed and interact with them through code. Tokens are the units of text models process.
Security was the largest adoption obstacle in Stacklok’s software sample, cited by 64% of respondents. There are concrete reasons for that concern. GitGuardian’s 2026 State of Secrets Sprawl research identified 24,008 unique secrets in MCP-related configuration files on public GitHub, including 2,117 credentials confirmed as valid.
An access token copied into a configuration file can become a route into the service it authorizes if that file is published. The resulting exposure may extend beyond the AI application to a database or internal business platform. Organizations need to keep credentials out of shared configuration files and replace exposed credentials promptly. Reviewing the model’s behavior would do little to address this kind of failure.
Other attacks exploit the assistant’s ability to use legitimate access. In May 2025, Invariant Labs demonstrated how malicious instructions inside a public GitHub issue could persuade an agent using the GitHub MCP integration to retrieve private repository information and publish it in a public pull request. The demonstration relied on sufficient permissions and permissive tool approvals. The attacker could influence the agent through content it had been asked to read.
This is prompt injection, i.e., when a document or support ticket contains instructions that the assistant mistakes for something it should obey. MCP can make the consequences more serious by placing additional tools within reach. A request to summarize customer feedback could lead to an unauthorized disclosure if the assistant can retrieve confidential records and send information outside the organization.
Tool descriptions create another entry point. Invariant’s tool-poisoning research showed that instructions embedded in a server’s descriptions could influence an assistant’s behavior, including its use of other connected tools. Reviewing a server therefore involves its code and the material it presents to the model. Changes to those descriptions can alter the risk after installation.
Local servers are another source of practical concern. Installing one means running software on a workstation, potentially with access to files and credentials. The official MCP guidance recommends isolating these programs and restricting their privileges.
Netskope also reported an increase in weekly downstream data policy violations from 12 to 31 over the preceding year. These occur when AI output breaks an organization’s access or use rules, and span several techniques, including retrieval systems and customized models. The figures show why businesses must inspect information coming back from connected AI services.
MCP does provide security mechanisms. Its authorization framework uses OAuth, and servers must validate that access tokens were issued for them. Passing those tokens unchanged to downstream services is prohibited. Correct implementation helps prevent credentials from being accepted across the wrong security boundaries. It cannot establish whether an otherwise permitted action serves the employee’s intended task.
The receiving business application must enforce the employee’s permissions. An assistant checking an invoice should receive access to the relevant record under those permissions. A broadly privileged service account can expose records the employee could never retrieve directly. Each requested operation needs an authorization check independent of the model’s explanation of why it wants to perform it.
Sensitive actions also need specific approvals. A payment approval should identify the recipient and amount, and execution should match those approved details. For information retrieval, returning only the fields needed for the task limits exposure. Read-only access still requires care because confidential information can leave through the assistant’s response without any database record being changed. The company should also verify where retrieved information is processed and how long the AI provider retains that data.
Organizations should test these restrictions with hostile documents and requests for records outside the user’s authority. Logs must allow investigators to connect the initiating request to the resulting action, with a practical way to stop the integration and revoke access. A successful demonstration of ordinary tasks provides little evidence about whether those controls will hold under attack.
Stacklok’s software respondents reported uneven coverage here: 67% said they applied role-based permissions and 60% reported audit logging and monitoring. A shared protocol could help companies apply these controls consistently across approved connections. That requires a maintained inventory of servers and someone accountable for their operation, including changes introduced through updates.
MCP can be secure enough for a restricted, tested enterprise workflow. Broad autonomous access to sensitive systems requires much stronger justification. Its potential to reduce duplicated integration work is credible, and the adoption figures warrant serious attention. Companies should approve each expansion of access against evidence from tests of the actual workflow.