← Default view

DRAWING SET · MCP / SESSION 3 / TALK PREP

Model Context Protocol

Architectural drawings, spec annotations, and security trifecta diagrams for a 1–2 hour deep-dive talk. Stateless core landing 2026-07-28; six primitives in flight; 110M+ SDK downloads/month under Linux Foundation governance.

SHEET01 / 01
SCALE1:1
REV.A · 2026-05-23
CITATIONS30
DRAWING NOMCP-2026-DD
PROTOCOLJSON-RPC 2.0
SPEC2025-11-25
NEXT REV2026-07-28
GOVERNANCELinux Foundation · AAIF [3]
▸ EXECUTIVE NOTE

MCP is a JSON-RPC 2.0 protocol that lets any LLM host call any tool / data source through a standard wire format. Anchor the talk on three pillars: (1) six primitives — tools / resources / prompts on the server, sampling / roots / elicitation on the client; (2) the 2025-11-25 spec + 2026-07-28 release candidate — stateless core, MCP Apps, Tasks; (3) the security session — tool poisoning and the lethal trifecta [22] are where this protocol is most interesting and least solved. [1] [4]

DWG · 01

System architecture

JSON-RPC 2.0 · capability-negotiated
▢ DETAIL A — HOST / CLIENT / SERVER
⌐ A1 HOST

The LLM application

Initiates connections, decides what the model sees, owns user consent. Claude Desktop, Cursor, VS Code, ChatGPT, Gemini. [5]

⌐ A2 CLIENT

One per server, inside host

Maintains the JSON-RPC session, negotiates capabilities at initialize. [5]

⌐ A3 SERVER

The integration

Separate process (stdio) or HTTP service that exposes primitives. Inspiration: LSP — one protocol, N×M ecosystem. [2]

DWG · 02

The six primitives

3 server-exposed · 3 client-exposed
▢ DETAIL B — DIRECTIONAL FLOW

▸ SERVER → HOST · P-01

Tools

Functions the model can call (name, JSON Schema args, handler). [5]

Headline primitive. Everything else is supporting cast.

▸ SERVER → HOST · P-02

Resources

Readable data exposed by URI — files, DB rows, API objects. [5]

Subscribable. Model or user pulls into context.

▸ SERVER → HOST · P-03

Prompts

Parameterised prompt templates the user can invoke. [5]

Slash-commands in disguise. Underused in practice.

▸ HOST → SERVER · P-04

Sampling

Server asks the host to run an LLM completion — no server-side API key needed. [8]

⚠ Deprecated in DRAFT-2026-v1. Supported ≥1 year. [9]

▸ HOST → SERVER · P-05

Roots

Filesystem / URI scopes the server is allowed to see (file:// only). [8]

The user's "you can look here, not there."

▸ HOST → SERVER · P-06

Elicitation

Server requests structured input from the user mid-call (schema-validated form). [8]

Fixes the "tool needs one more arg" UX gap.

⚐ TEACHING NOTE — 90% of real-world MCP servers implement Tools only. Demoing the other five is what makes a deep-dive different from a tutorial.

DWG · 03

Transports & authorization

stdio · streamable HTTP
SPEC · LOCAL · PROCESS-PIPE

stdio

Spawned by
Host as child process
Auth
Env vars · OS-level secrets
Demo cost
uv run server.py
Skips
OAuth entirely [11]
SPEC · REMOTE · HTTP-SINGLE-ENDPOINT

Streamable HTTP

Endpoint
One endpoint · POST + GET · optional SSE [10]
Auth
OAuth 2.1 resource-server · RFC 9728 · RFC 8707 · PKCE-SHA256 mandatory [11]
Demo cost
Container + reverse proxy + auth server
⚠ Deprecated
HTTP+SSE (2025-03-26 spec) — sunsetting 2026 [10]

⚐ 2026-07-28 RC removes the requirement for sticky sessions. A remote MCP server can finally sit behind a plain round-robin load balancer. [6]

SCHED · 01

Suggested agenda

60 min · 120 min
▢ DETAIL C — RUN OF SHOW (⚐ MARKS LOAD-BEARERS)
Block60 min120 minWhat lands
Why MCP exists5 min10 minThe N×M integration problem; pre-MCP fragmentation
Architecture & primitives10 min20 minHost / Client / Server; six primitives; capability negotiation
Transports & auth5 min15 minstdio vs Streamable HTTP; OAuth 2.1 resource-server model
Live demo 110 min15 minBuild a FastMCP tool, wire to Claude Desktop, inspect with MCP Inspector
2026 spec changes5 min15 minStateless core, Tasks, MCP Apps, deprecation policy
Ecosystem tour5 min10 minServers worth knowing; the registry; supply-chain provenance
Security15 min25 minTool poisoning, lethal trifecta, CVE timeline, host-side mitigations
Live demo 2—5 minReproduce tool-description injection against an unhardened host (sandbox!)
Q&A · outlook5 min5 minA2A vs MCP, registry monetisation, what to ship next
REV · LOG

Origin & governance

2024-11 → 2026-07
25·NOV·2024 Anthropic open-sources MCP. Creators: David Soria Parra & Justin Spahr-Summers. [1]
MAR·2025 OpenAI adopts. Altman: "people love MCP." [12]
APR·2025 Google DeepMind endorses. Hassabis: "rapidly becoming an open standard." [12]
25·NOV·2025 Spec 2025-11-25 released. [5]
9·DEC·2025 Donated to Linux Foundation's AAIF. [3]
26·JAN·2026 MCP Apps (SEP-1865) — first official extension. [26]
2–3·APR·2026 MCP Dev Summit NYC. ~1,200 attendees. 110M+ SDK downloads / month. [4]
28·JUL·2026 Target for next major release — stateless core. [6]

⚐ WHY THE DONATION MATTERS — governance is now multi-vendor under the Linux Foundation. That's the answer to "is this just an Anthropic thing?" — every audience asks it. [3]

110M+
monthly SDK downloads (reported at Dev Summit NA 2026) [4]
~14k
tracked MCP servers across registries by May 2026 [12]
9
founding members of the Agentic AI Foundation [3]
~1,200
attendees · MCP Dev Summit NYC 2026 [4]
REV · 2026

What's new in 2026

RC dated 2026-07-28
SEP · CORE

Stateless protocol core

Trades session ergonomics for horizontal scale. Kills the "MCP doesn't fit our load balancer" objection. [6]

SEP · FRAMEWORK

Extensions framework

Reverse-DNS-namespaced capabilities versioned separately from core. The model used by MCP Apps and Tasks. [6]

SEP · 1865

MCP Apps

Servers can ship interactive HTML in a sandboxed iframe. UI talks back via JSON-RPC so the host still owns consent & audit. [26] [27]

EXT · TASKS

Tasks extension

Long-running ops get explicit handles — tasks/get, tasks/update, tasks/cancel. The answer to "tool calls can't take 20 minutes." [28]

SEP · AUTH

Auth hardening — 6 SEPs

iss validation, clearer credential binding, tighter OAuth / OIDC alignment. [6]

POLICY

12-month deprecation

Formal lifecycle policy — at least one year between deprecation and removal. [6]

⚐ The 2026 roadmap reorganised around priority areas (transport, agent comms, governance, enterprise) rather than dates, with Working Groups owning delivery. [25]

CMP · 01

MCP vs A2A vs function calling

don't conflate · audience will ask

OPENAI · 2023

Function calling

Per-vendor JSON-schema tool definitions in the model API itself. [21]

▸ Quick prototypes · single-model apps

ANTHROPIC · 2024

MCP

Transport between LLM hosts and external tools / data — vendor-neutral wire format. [20]

▸ One integration → all models · agentic apps

GOOGLE · APR 2025

A2A

Transport between agents themselves — discovery, task delegation, results. [20]

▸ Multi-agent systems · framework-crossing

⚐ PUNCHLINE — MCP and A2A are complementary layers, not rivals. Both are now AAIF projects. [3]

HAZ · 01

Security — the part you cannot skip

load-bearing · 15 / 25 min
▲ HAZARD DETAIL — THE LETHAL TRIFECTA

"private data + untrusted instructions + an exfiltration vector → guaranteed exposure"

— Simon Willison's lethal trifecta. MCP makes that trifecta easy to assemble accidentally. Any host that connects (a) a server reading user files with (b) a server reading external content with (c) a server that can post outbound is one tool-poisoning payload away from data egress. [22]

▲ A 2026 internet scan found up to ~200,000 vulnerable MCP instances exposed across IDEs, internal tools, and cloud services. [24]

⚠ Incident log · Apr 2025 → Apr 2026 (pick 3-4 to walk through)

APR 2025WhatsApp MCP — exfiltration via tool poisoning · tool poisoning[23] AuthZed timeline
MAY 2025GitHub MCP — malicious issue leaks private repo data · indirect prompt injection[23] AuthZed timeline
JUL 2025mcp-remote CVE-2025-6514 — RCE, 437k+ downloads · OS command injection[23] AuthZed timeline
SEP 2025Postmark MCP supply-chain — BCC of every email · malicious package[23] AuthZed timeline
OCT 2025Smithery hosting breach — 3,000+ servers exposed · supply-chain (hosting)[23] AuthZed timeline
APR 2026Core stdio config-to-exec flaw — 150M+ downloads hit · design-level RCE[23] AuthZed timeline

▸ HOST-SIDE MITIGATIONS — THE SPEC CAN'T ENFORCE THESE

  1. Treat tool descriptions and annotations as untrusted unless the server identity is verified. [5]
  2. Pin server versions; check the registry's provenance metadata before install. [30]
  3. Per-tool consent UI, not blanket per-server approval. [5]
  4. Forbid mixing read-untrusted-content tools with read-private-data tools in the same session — the trifecta rule. [22]
  5. For HTTP transports: enforce aud / iss on tokens; never accept tokens not minted for this server. [11]
PARTS · LIST

Ecosystem snapshot

key components · ⭐ stars per canonical
PN · 14 · OFFICIAL
modelcontextprotocol/servers⭐ 86k
Official reference servers — fs, fetch, git, memory, time, and more. [14]
PN · 13 · COMMUNITY
punkpeye/awesome-mcp-servers⭐ 87k
Community discovery index — primary surface for browsing the ecosystem. [13]
PN · 17 · DOCS
upstash/context7⭐ 55k
Just-in-time library docs streamed into model context — alternative to RAG. [17]
PN · 15 · BROWSER
microsoft/playwright-mcp⭐ 33k
Microsoft's browser automation via accessibility tree — most popular browser MCP. [15]
PN · 16 · VENDOR
github/github-mcp-server⭐ 30k
GitHub-official: repos, PRs, issues, search — canonical vendor-built MCP. [16]
PN · 18 · FRAMEWORK
PrefectHQ/fastmcp⭐ 25k
Pythonic high-level framework. v3.0 (Jan 2026) — versioning, granular auth, OpenTelemetry. [18]
PN · 29 · TOOL
modelcontextprotocol/inspector⭐ 9.8k
Browser-based debugger — the standard live-demo tool. [29]
PN · 30 · REGISTRY
modelcontextprotocol/registry⭐ 6.8k
Canonical metadata backbone — Anthropic, GitHub, MS, PulseMCP. [30]
PN · 07 · SPEC
modelcontextprotocol/modelcontextprotocol⭐ 8.1k
SEPs, schema, governance — the spec repo. [7]
DEMO · RUNBOOK

Live-demo recipes

five candidates · pre-record each as fallback
01

"Hello, tool"

STACK · FastMCP server, one @mcp.tool, stdio transport, wired to Claude Desktop

▸ Build-to-call in under 5 minutes. [18] [19]

02

Inspect everything

STACK · same server + mcp-inspector in browser

▸ Visual JSON-RPC traffic. Great for teaching primitives. [29]

03

Tool poisoning ▲ SANDBOX ONLY

STACK · toy server whose tool description contains a hidden "exfiltrate" instruction

▸ The talk's most memorable 90 seconds — show the agent obeying it. [22]

04

Elicitation

STACK · tool that calls elicitation/create to ask the user for a missing arg mid-call

▸ Shows the consent loop the security section was warning about. [8]

05

MCP Apps (stretch)

STACK · server returning a ui:// resource rendered in a sandboxed iframe

▸ Demonstrates 2026's most ambitious extension. [27]

FUTURE · WORK

Outlook — three things to watch

leave-with-the-audience

▸ WATCH · 01

Stateless MCP at scale

Does the 2026-07-28 RC really let MCP run on the same infra as REST APIs? Production reports from Uber / Nordstrom say "yes, with caveats." [4]

▸ WATCH · 02

Registry-as-trust-root

Official registry provenance is the only realistic answer to supply-chain attacks like Postmark. [23] [30]

▸ WATCH · 03

MCP Apps adoption

If servers can ship trusted UI, the line between "tool" and "mini-app" blurs. New agent UX — or niche. [26]

XREF

Sibling sheets · session-3 set

▸ index drawing
SURVEY · DWG.02
Claude Code Skills

Markdown + scripts that Claude loads on demand. Now a cross-vendor open standard.
SURVEY · DWG.03
Plugins & the Marketplace

The packaging layer — and the trust footgun to flag.
RECON · DWG.04
Subagents, hooks & the rest of the harness

Isolation, determinism, substrate.
RECON · DWG.05
Comparison & decision framework

Score candidates on four axes; weights chosen first.
RECON · DWG.06
Session delivery plan

90-min run-of-show — 8–12 min active blocks, mid-session recap.
REF · 01

Sources / bill of materials

30 citations
[1]Anthropic — Introducing MCP
[2]Wikipedia — MCP
[3]Anthropic — Donating MCP to AAIF
[4]AAIF — Dev Summit NA 2026
[5]MCP Spec 2025-11-25
[6]MCP — 2026-07-28 RC
[7]MCP spec repo
[8]WorkOS — MCP features
[9]MCP — Sampling (draft)
[10]ChatForest — Transports
[11]MCP — Authorization
[12]Zuplo — One year of MCP
[13]awesome-mcp-servers
[14]MCP servers monorepo
[15]Microsoft — Playwright MCP
[16]GitHub MCP server
[17]Upstash — Context7
[18]PrefectHQ — FastMCP
[19]MCP — Build a server
[20]Merge — MCP vs A2A
[21]Zilliz — fn-call vs MCP vs A2A
[22]Simon Willison — Lethal trifecta
[23]AuthZed — Breach timeline
[24]DevSecOps — MCP vulns
[25]MCP — 2026 roadmap
[26]MCP — MCP Apps SEP-1865
[27]MCP Apps — ext-apps repo
[28]WorkOS — Async tasks
[29]MCP Inspector
[30]MCP Registry
▢ DRAWING MCP-2026-DD · REV. A · 2026-05-23 SHEET 01 / 01 · SCALE 1:1 ▸ canonical sheet · ▸ index drawing