1Anthropic releases MCP as open specification (November 2024)
2Google donates A2A to the Linux Foundation; MCP remains under Anthropic's open spec working group (2025-2026)
3HTTP+SSE transport deprecated in favor of Streamable HTTP (spec revision 2025-03-26)
4Cursor, Continue, and Zed adopt MCP as their tool connectivity standard (early 2025)
5OWASP-branded community MCP risk taxonomy emerges, cataloging tool poisoning, rug pulls, and confused-deputy threats (2025)
The order follows a simple cause and effect story. A standard has to exist before anyone can adopt it, and problems with a standard only surface once people actually use it.
**MCP** started when Anthropic published it as an open specification in November 2024. Because the spec was open, other tools could build on it, so Cursor, Continue, and Zed wired it into their editors in early 2025.
Real usage then exposed weaknesses. The original HTTP+SSE transport proved awkward for remote servers, so it was deprecated in favor of Streamable HTTP around mid-2025. Separately, security researchers catalogued the new attack surface, and the OWASP MCP Top 10 landed in 2025.
As the broader agent-protocol space matured, governance positions diverged. Google donated its A2A protocol to the Linux Foundation in 2025; MCP itself remained an open spec stewarded by Anthropic through the modelcontextprotocol working group. So the chain is: release, adoption, transport fix, security taxonomy, then governance maturation in the broader stack.
The timeline is a clean dependency chain, so the ordering logic matters more than memorizing dates.
**MCP** was released by Anthropic as an open specification in November 2024. That release is the root event. Nothing else can precede it. You cannot adopt or harden a protocol that does not yet exist. Early adopters followed in early 2025, when Cursor, Continue, and Zed standardized on MCP for tool connectivity.
Real-world use then drove two refinements during 2025. The original HTTP+SSE transport was deprecated in favor of Streamable HTTP, which handles remote servers more cleanly. The OWASP MCP Top 10 also formalized the risk taxonomy that year, covering threats like tool poisoning and rug pulls. Security work logically trails adoption, since you catalog attacks against a thing people actually deploy.
The capstone is governance maturation in the broader agent-protocol stack. A2A was donated by Google to the Linux Foundation in 2025; MCP itself continued under Anthropic's open spec stewardship via the modelcontextprotocol working group. The arc is release, adoption, transport revision, security taxonomy, then broader governance moves around MCP and its sibling protocols.
Quick reference
TL;DR
MCP: November 2024 release, early-2025 IDE adoption, March-2025 SSE-to-Streamable-HTTP transport, 2025 community security taxonomy, then a 2025-2026 split (A2A → Linux Foundation, MCP stays under Anthropic).
Picture how a new electrical plug shape catches on. First one company designs the plug and publishes the blueprint so anyone can build to it. Then a few gadget makers adopt it because it is convenient. As more devices use it, the original designers notice the early wiring was clunky, so they swap it for a cleaner version. Safety inspectors then write a checklist of ways the plug can be misused. Finally, once half the industry depends on it, no single company should own the standard, so it moves to a neutral committee. MCP followed that exact arc: release, early adoption, a transport upgrade, a security checklist, and shared governance.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
When a question asks for exact release dates rather than relative ordering This framing rewards the causal chain; precise dates beyond month level are easy to misremember and rarely the point.
When the interviewer wants a deep dive on a single milestone like the transport change The timeline view is breadth first; one milestone needs its own mechanism-level explanation instead.
When comparing MCP to other protocols like A2A or ACP Those have separate timelines; mixing them into one ordering confuses distinct standardization efforts.
Quick scan · 2–4 min
Everything important, quickly.
4 min: the five milestones, the causal chain that fixes their order, why security trails adoption, and why governance comes last.
Side-by-side
Step
Event
Why it sits here
1
Anthropic releases MCP open spec (Nov 2024)
Root event; nothing can precede the spec existing
2
Cursor, Continue, Zed adopt MCP (early 2025)
Adoption requires an existing open standard
3
HTTP+SSE deprecated for Streamable HTTP (mid-2025)
Transport pain surfaces only after real remote use
4
OWASP MCP Top 10 published (2025)
Security taxonomy follows a deployed attack surface
5
Governance maturation: A2A donated to Linux Foundation (2025); MCP stays under Anthropic's open spec (2025-2026)
Neutral foundation stewardship is the canonical move once a protocol matters to many vendors; A2A has made it, MCP has not yet
Real-world examples
Real products, models, and research that use this idea.
1Anthropic shipped MCP in November 2024 with reference servers for filesystem, Git, and Postgres, plus Claude Desktop as the first host.
2Cursor, Continue, and Zed adopted MCP in early 2025, so a server written once ran across all three editors without rewrites.
3The OWASP MCP Top 10, published in 2025, catalogued threats like tool poisoning, rug pulls, and the confused-deputy problem for remote servers.
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QWhy did the original HTTP+SSE transport get deprecated, and what does Streamable HTTP do better?
Sign in or go Pro to see the approach for this follow-up.
QWhy does moving governance to a neutral foundation matter for a protocol's longevity?
Sign in or go Pro to see the approach for this follow-up.
QWhy does security standardization logically follow adoption rather than lead it?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Putting adoption before the release, or assuming the security taxonomy came first. Tools could not adopt a spec that did not exist yet, and security work follows usage.