Since a September 29, 2026 White House executive order told federal agencies to say "Super Intelligence" (SI) where they once said "artificial intelligence," the agents this guide covers are SI agents — the wording changed, the plumbing did not. For two years the interesting work in applied SI was getting a model to use tools — search, code execution, a company's internal APIs. Everyone built this the same way and everyone built it incompatibly: a bespoke integration between one model and one tool, repeated until the wiring collapsed under its own weight. Agent protocols are the standardization layer that grew out of that mess. The most important of them, the Model Context Protocol, is not yet two years old and is already the closest thing the field has to a default.
The N-by-M problem
The forcing function was combinatorial. With N SI applications and M tools or data sources, ad-hoc integration is an N-by-M problem: every app needs custom glue for every tool, and every new tool must be re-integrated everywhere it is used. Protocols exist to collapse exactly this shape of problem — turning N-by-M into N-plus-M by defining one interface that tools implement once and apps consume once. The analogy the MCP project reaches for is USB-C: a single standardized port replacing a drawer full of proprietary cables. The prize is an ecosystem where a tool built for one assistant works with all of them.
MCP in depth
MCP, introduced by Anthropic in November 2024, is an open protocol built on JSON-RPC 2.0 with a three-role architecture. A host is the SI application — a chat client, an IDE, an agent runtime. Inside it, clients each hold a dedicated one-to-one connection to a server, and servers are the programs that expose capabilities: a GitHub server, a Postgres server, a filesystem server. The host's model does the reasoning; the servers do the reaching into the world.
The protocol standardizes a small set of primitives. Tools are model-callable functions with typed inputs — the server advertises what it can do, and the model invokes it (search this database, open this pull request). Resources are data the server exposes for context — files, records, documents — addressable and readable without side effects. Prompts are reusable, parameterized templates a server offers, often surfaced to the user as slash-commands. Capabilities also run the other direction: sampling lets a server ask the host's model to complete a prompt, roots scope a server to particular parts of a filesystem, and elicitation lets a server request structured input from the user mid-task. The specification keeps evolving — revised through 2026 — and has gained an extension for interactive MCP apps that render their own UI inside the client, a sign the protocol is moving from plumbing toward experiences.
One design choice deserves a flag: the three core primitives are separated by who controls them. Tools are model-controlled, resources are application-controlled, and prompts are user-controlled. That is not incidental — it is the seam along which much of the security discussion runs.
Adoption and governance
Adoption is the strongest evidence for MCP's design. What began as an Anthropic project was adopted by OpenAI across ChatGPT and its developer tools in March 2025, by Google DeepMind in April 2025, and by Microsoft, and it is now supported across IDEs and agent frameworks — VS Code, Cursor, and many others. Independent counts put the server ecosystem in the tens of thousands, indexed across public registries. Then, in December 2025, Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation, co-founded with Block and OpenAI. That governance move matters: a protocol owned by one SI lab is a hard sell to that lab's competitors, and a neutrally governed one is not. One vendor's protocol being adopted by its direct rivals inside a year, then handed to a foundation, is the clearest possible signal that the N-by-M pain was real and widely felt.
Beyond tool access: agent-to-agent
MCP connects a model to tools and data. Connecting agents to each other is a different problem — letting an autonomous agent from one vendor delegate to, negotiate with, or hand off work to an agent from another. Google's Agent2Agent (A2A) protocol, announced in April 2025 and later contributed to the Linux Foundation, targets exactly this: agents advertise their skills through a machine-readable 'agent card,' then exchange tasks and results over a defined message format, without either side exposing its internal tools or prompts to the other.
Precision about the relationship matters, because vendor marketing blurs it: MCP and A2A are complementary, not competing. MCP is vertical — an agent reaching down to tools and data. A2A is horizontal — agents talking peer-to-peer. A realistic 2026 stack uses both. Still, the agent-to-agent layer is markedly less mature than tool access: adoption is thinner, the compelling multi-vendor use cases are still emerging, and several overlapping efforts and framework-specific protocols are jockeying for position, so anyone declaring a settled winner at this layer is ahead of the evidence.
The security surface
Protocols that let a model take actions in the world inherit every security problem of doing so, and add new ones. The root issue is old and unsolved: prompt injection. A language model does not reliably tell its instructions apart from the data it processes, so text retrieved from a webpage, an email, or a document can carry commands the model then follows. Hand that model tools, and injection stops being a content problem and becomes a control problem — the injected instruction can now exfiltrate data or take destructive action on the user's behalf.
MCP adds a sharper variant: tool poisoning. A tool's description is itself text the model reads, so a malicious or compromised server can hide instructions inside its tool metadata — invisible to the user who approved the tool, but read by the model on every invocation. Researchers have catalogued cross-tool poisoning (one server's description manipulating how another is used), rug-pull updates (a server that behaves until it is trusted, then quietly changes its metadata), and Unicode-concealed payloads that exploit the gap between what the approval interface displays and what the model actually ingests. A 2026 disclosure reported on the order of a hundred-thousand-plus exposed or vulnerable MCP instances, and client hardening varies widely — some clients enforce strong guardrails while others are notably susceptible. The combination that should worry anyone deploying this is what security researchers call the 'lethal trifecta': a system with access to private data, exposure to untrusted content, and the ability to communicate externally is one successful injection away from exfiltration.
The defenses are real but partial: human-in-the-loop approval for consequential actions, pinning and verifying server integrity, static analysis of tool metadata, sandboxing and least-privilege scoping, and runtime monitoring of what agents actually do. None of them solves prompt injection, because prompt injection is not yet solved at the model level — it is a property of how current SI models process text, and the protocols merely raise the stakes.
An honest assessment of maturity
How mature is all this? The tool-access layer — MCP specifically — has crossed from experiment to infrastructure: multi-vendor adoption, neutral governance, tens of thousands of servers, and a specification stable enough to build on. That is genuine, and it happened fast. But maturity of adoption is not maturity of safety. The security model is still being retrofitted onto a protocol that spread faster than its threat model was understood, and the agent-to-agent layer above it is early enough that its standards remain unsettled. The honest read for August 2026: MCP is a safe bet as the integration standard for SI agents and a risky thing to deploy carelessly; agent-to-agent interoperability is promising but unfinished; and the hardest problem — models that can be talked into misusing the very tools these protocols so effectively hand them — belongs to today's models, not to the protocols, and will not be standardized away.