Practical guide
What MCP solves, and what it costs
lowtouch.ai engineering, September 2026
A practical guide to the Model Context Protocol: what it is, ten arguments each way, and when to leave it alone.
97MMonthly SDK downloads, March 2026
10,000+Active public servers, December 2025
67,300Tokens burned by seven servers before the first prompt
12.9%Indexed servers that rate high trust
1. What MCP is
The Model Context Protocol is an open standard, released by Anthropic in November 2024, for connecting AI applications to external systems: databases, tools, files and workflows. The usual analogy is a USB-C port. One standard connector replaces a custom cable per device, so an assistant that speaks MCP can reach any system that exposes an MCP server (modelcontextprotocol.io).
The architecture has three parts. A host is the AI application the user talks to. A client inside the host manages the connection. A server is the external service, exposing three primitives over JSON-RPC: tools the model can call, resources it can read, and prompts it can follow. Transport is stdio for local processes and Streamable HTTP for remote services (Google Cloud).
On 9 December 2025 Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation, with OpenAI, Google, Microsoft, AWS, Cloudflare and Bloomberg as platinum members. Since then it has been a multi-vendor standard steered by a technical committee, not one company's protocol (MCP 2026 roadmap).
2. Why it matters
Before MCP, every agent-to-tool pairing was custom glue. Ten agents and ten systems meant up to a hundred integrations, each with its own auth, retry and error handling. MCP collapses that to one connector per side, and lets an agent discover tools at runtime instead of shipping new client code when an endpoint changes (Future AGI).
Adoption has been unusually fast for an infrastructure standard. SDK downloads grew from roughly 100,000 a month at launch to 97 million by March 2026. A December 2025 Stacklok survey of 300 senior technical leaders found 41 to 45 percent reporting at least limited production use, and first-party support now spans Anthropic, OpenAI, Google, Microsoft, GitHub, VS Code and Cursor (adoption report).
The ecosystem is broad but shallow. An independent Q1 2026 census indexed 17,468 servers, of which 12.9 percent scored high trust on documentation, maintenance and reliability. Over half of listed projects are inactive or low value (Nerq census via Knak).
3. Ten pros, ten cons
| Pros |
Cons |
| One protocol, any client. A server built once works from Claude, Copilot Studio, Cursor, LangGraph and any other MCP host. |
The schema token tax. A well-documented tool costs 200 to 800 tokens of definition; measurements put the practical average near 1,000 per tool, injected every session. |
| Runtime discovery. Agents query tools/list and pick up new tools without a redeploy or new client code. |
It compounds fast. Seven connected servers measured 67,300 tokens of definitions, a third of a 200k context window, before the user typed anything. |
| Deterministic execution. The model fills a schema and picks a tool; server code makes the actual call, so there are no hallucinated HTTP requests. |
Single servers are heavy. GitHub's official server alone injects about 17,600 tokens; a 106-tool MySQL server measured roughly 54,600 on every initialization. |
| Neutral governance. Held by the Linux Foundation since December 2025 and steered by a multi-vendor committee, so no single company can deprecate it. |
Real money at scale. One cost model puts the overhead near $1,370 per developer per year at ten conversations a day, before any productive work. |
| A large ecosystem. Over 10,000 active public servers and 97 million monthly SDK downloads as of March 2026. |
Response bloat. Raw JSON tool outputs flow back through context and often cost more than the schemas, a side most optimizations ignore. |
| More than function calls. Resources and prompts let a server push reference data and workflows to the model, not just expose endpoints. |
Reasoning degrades. Cached or not, schemas occupy attention. Ten thousand tokens of definitions is working memory the model no longer has for the task. |
| Stateful sessions. A server can hold a browser session, a database connection or a notebook kernel across calls. |
A new attack surface. Tool poisoning hides instructions in tool metadata and results; OWASP ranks prompt injection the top LLM application risk. |
| Local and remote, one protocol. A filesystem tool on the laptop and a cloud database speak the same protocol; OpenAPI only covers HTTP services. |
Weak defaults in the wild. Roughly four in ten internet-facing servers ship with no authentication at all. |
| Enterprise auth is landing. The Enterprise-Managed Authorization extension is stable, so server access can be governed through an identity provider. |
Quality is thin. Only 12.9 percent of indexed servers meet a high-trust bar; more than half of listed projects are inactive. |
| It surfaces dormant APIs. Vendors expose endpoints that were documented for years but rarely used, and agents finally exercise them. |
Operational weight. You run and patch servers, manage consent and host policy, and track a spec that shipped a major revision in July 2026 with a 12-month migration window. |
4. When not to use MCP
MCP earns its overhead on complex, multi-step agent work across many systems. It does not earn it here:
- One stable integration. A single agent calling a small, fixed set of APIs is simpler and cheaper with direct function calling.
- Deterministic pipelines. Cron jobs, fixed reports and scripted workflows have no model choosing tools, so a discovery protocol adds nothing.
- High-frequency, low-complexity calls. When schema overhead dominates total token spend, the economics invert. Quick lookups never amortize the setup cost.
- Tight latency loops. Inside one application, an in-process function call beats a protocol round trip.
- No agent consumer. If no LLM will ever call the service, the added structure has no audience. Keep the OpenAPI spec.
- Sensitive data through unaudited servers. MCP is an integration protocol, not a security control. Third-party servers you have not reviewed are a supply-chain risk.
- Context-constrained sessions. Long agent runs that need every token of working memory cannot afford tens of thousands of tokens of standing schema.
At lowtouch.ai we stay away from MCP by default, and the reason is the token economics in section 3. Standing tool schemas are context our agents need for reasoning, and on high-frequency enterprise workloads the overhead never pays for itself.
Our agents use smart-tool injection instead. We generate compact tool definitions from a service's openapi.json and inject only the endpoints a task actually needs, at the moment it needs them. The agent gets the same governed access to the API estate without carrying a full tool catalog in every request.
When a vendor ships an MCP server, we use it directly. We keep measuring, and when a server's schemas or responses overuse tokens we switch that integration to our tool injection. The protocol is one option in the toolbox, not the default.
Our rule: MCP where it is available and efficient, smart-tool injection from openapi.json everywhere token use says otherwise.
Sources
- What is MCP, modelcontextprotocol.io, spec 2026-07-28.
- Introducing the Model Context Protocol, Anthropic, November 2024.
- MCP spec issue #2808: tool schema token overhead, May 2026.
- MCP context bloat fix 2026, MCP.Directory, May 2026.
- MCP token optimization: 4 approaches compared, StackOne, March 2026.
- MCP tool schema bloat: the hidden token tax, Layered System, January 2026.
- 10 strategies to reduce MCP token bloat, The New Stack, February 2026.
- MCP's context bloat crisis, AgentMarketCap, April 2026.
- State of enterprise MCP adoption 2026, Cybertize, August 2026.
- MCP adoption in 2026 (Nerq census), Knak, April 2026.
- MCP adoption statistics 2026, Affinco, August 2026.
- When MCP is not the right choice, Improving, March 2026.
- MCP tool poisoning, OWASP Foundation.
- Protecting against indirect prompt injection in MCP, Microsoft, April 2025.
- MCP vs OpenAPI: when do I need which, Blck Alpaca, June 2026.
- Learn MCP with me, part 1, Deaton, 2025.
