# MCP: the 11-Step Guide to the Protocol That Connects Agent to Everything
**作者**: 0xRafy
**日期**: 2026-08-13T14:31:39.000Z
**来源**: [https://x.com/0xRafy/status/2087909956754284865](https://x.com/0xRafy/status/2087909956754284865)
---
Before USB, every device had its own cable. MCP is USB for AI agents. 400M+ monthly SDK downloads. 10,000+ servers. Adopted by every major AI lab.
Before USB, every device had its own cable. Printers, scanners, keyboards, cameras. A drawer full of proprietary connectors that worked with exactly one device.
Then USB arrived and one port handled everything. MCP is that moment for AI agents. One protocol to connect Claude to any tool, any database, any API.
> Follow my Substack to get fresh AI alpha: [movez.substack.com](https://movez.substack.com/)
No more custom wrappers per service. No more rebuilding integrations per project. No more hardcoding tool calls in every agent. Anthropic open-sourced it in November 2024. By 2026: OpenAI, Google, Microsoft, and AWS all adopted it. 10,000+ servers in production. This is the complete guide.
<video controls preload="metadata" poster="/doc/4281/image/img_24f6a2663ec5.jpg" src="/videos/0056.mp4"></video>
Before MCP, a company that wanted its internal database, its ticketing system, and its CI pipeline all reachable by an AI agent had to write separate glue code for every combination of model and tool.
Different API shapes, different auth flows, different error handling. Every integration was custom. Every migration was a rewrite.
MCP replaces that with a single open standard. Build one server, any MCP-compatible client uses it. Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Amazon Bedrock, custom agents.
One integration, every client. On July 28, 2026, the biggest spec revision in MCP's history shipped: stateless core, extensions system, enterprise-grade auth. This guide covers all of it.
Before MCP: one integration per model per tool. After MCP: one server, every client.
# 01. What MCP actually is
MCP (Model Context Protocol) is an open standard that lets AI models connect to external tools, files, and data sources through a single interface.
Instead of writing custom glue code for every combination of model and service, you build one MCP server and any MCP client can use it.
The analogy: USB standardized how devices talk to computers. MCP standardizes how AI agents talk to the world. Before USB, every printer needed its own driver and its own cable.
After USB, one port handles everything. Before MCP, every agent needed custom code for every integration. After MCP, one server handles every client.
# 02. The timeline
- November 2024: Anthropic open-sources MCP. Quiet launch. Mostly used on personal laptops for local development.
- March 2025: OpenAI, Google, and Microsoft announce adoption. MCP goes from Anthropic side project to industry standard overnight.
- July 2025: Every major IDE supports it. Cursor, Windsurf, VS Code. Claude Code ships with MCP built in. SDK downloads cross 97 million/month.
- 2026: 10,000+ public servers in production. 400M+ monthly SDK downloads, 4x increase year-over-year. SDKs in 11 languages. Now governed by the Agentic AI Foundation under the Linux Foundation.
- July 28, 2026: Biggest spec revision in MCP history ships. Stateless core replaces the session-dependent model. Extensions system. Enterprise Managed Authorization. The protocol grows up.
# 03. The architecture
MCP has three roles: host, client, and server.
- The host is the application the user interacts with. Claude Desktop, Claude Code, Cursor, a custom app. One host can manage multiple clients.
- The client lives inside the host. Each client maintains a 1:1 connection with a single MCP server. The client translates between the host's internal protocol and MCP.
- The server exposes capabilities: tools, resources, and prompts.
A Postgres MCP server exposes run_query as a tool and database tables as resources. A GitHub MCP server exposes create_pr, list_issues, read_file as tools.
# 04. Three primitives
MCP servers expose three types of capabilities:
1. Tools are functions the model can call. run_query, create_pr, send_email. The model decides when to call them. You execute them and return the result. This is the most used primitive.
2. Resources are data the model can read. Files, database schemas, API docs, configuration. Resources provide context without requiring a function call. Think of them as files the model can access on demand.
3. Prompts are reusable templates the server can offer. Pre-built instructions for common tasks. The model or user can invoke them. Less used than tools and resources, but useful for standardizing workflows across teams.
```
# A minimal MCP server exposes tools, resources, or both
# Tool: a function the model can call
{
"name": "run_query",
"description": "Execute a read-only SQL query",
"inputSchema": {
"type": "object",
"properties": {"query": {"type": "string"}},
"required": ["query"]
}
}
# Resource: data the model can read
{
"uri": "postgres://mydb/schema",
"name": "Database Schema",
"mimeType": "application/json"
}
```
# 05. Build your first server
An MCP server is a program that exposes tools, resources, or both over a standard protocol. You can build one in TypeScript or Python using Anthropic's official SDKs.
The server below exposes one tool (run a SQL query) and one resource (the database schema).
```
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
const server = new McpServer({
name: "postgres-mcp",
version: "1.0.0"
});
// Tool: run a read-only query
server.tool(
"run_query",
"Execute a read-only SQL SELECT query",
{ query: { type: "string", description: "SQL SELECT query" } },
async ({ query }) => {
const rows = await db.query(query);
return { content: [{ type: "text", text: JSON.stringify(rows) }] };
}
);
// Resource: database schema
server.resource(
"schema",
"postgres://mydb/schema",
async () => ({
contents: [{ uri: "postgres://mydb/schema",
text: await getSchemaJSON() }]
})
);
server.listen();
```
That is a working MCP server. Claude Code, Claude Desktop, Cursor, or any MCP client can connect to it and use both the tool and the resource. One server, every client.
# 06. Connect to Claude
Three ways to connect your server to Claude:
1. Claude Desktop: add the server to your claude_desktop_config.json. Claude Desktop starts the server automatically and makes its tools available in Cowork and Chat.
```
{
"mcpServers": {
"postgres": {
"command": "npx",
"args": ["tsx", "server.ts"],
"env": {"DATABASE_URL": "postgres://..."}
}
}
}
```
1. Claude Code: use the claude mcp add command. The server is available immediately in your coding session.
2. Claude API: pass an mcp_servers parameter in your API call. The server runs remotely and Claude calls its tools as needed during the conversation.
# 07. The 2026-07-28 spec
On July 28, 2026, MCP shipped its biggest revision since launch. The core change: MCP went stateless. The old spec required a persistent bidirectional connection with session management.
The new spec uses a lightweight request/response model. No sessions, no handshakes, no persistent connections.
Why this matters: stateless servers can run behind load balancers, scale horizontally, cache responses, and deploy on standard cloud infrastructure. The old spec worked on laptops. The new spec works at enterprise scale.
Extensions replace what used to be baked into the core spec. Tasks (for long-running operations), Enterprise Managed Authorization, and other capabilities are now opt-in extensions. Your server includes what it needs and nothing more.
Enterprise Managed Authorization (EMA) is now stable. Organizations can centrally manage auth for all their MCP servers. End users log in once and access every connected server. Adopted by Anthropic, Microsoft, and Okta.
> If you built MCP servers before July 2026, they will still work for at least 12 months (deprecation guarantee).
> But new servers should target the 2026-07-28 spec. The stateless core is simpler to implement and deploy.
# 08. Security
MCP's rapid growth came with security problems. Independent scans found exploitable flaws in a large share of public servers. NSA and CISA issued formal guidance. Security is not optional.
- Auth. Every production MCP server needs authentication. The 2026-07-28 spec adds the iss (issuer) parameter for token validation. Use OAuth 2.1 for remote servers. Never ship a server without auth to production.
- Input validation. The model generates the tool inputs. That means the inputs can be anything. SQL injection, path traversal, command injection are all possible if you pass model-generated inputs directly to your system without validation. Treat every tool input like untrusted user input.
- Least privilege. A database MCP server should expose read-only queries, not full database access. A GitHub MCP server for code review should not have permission to delete repositories. Give each server the minimum permissions it needs.
```
# MCP Server Security Checklist
1. Auth on every endpoint (OAuth 2.1 for remote)
2. Validate all tool inputs (SQL injection, path traversal)
3. Read-only by default. Write access only when needed.
4. Rate limiting on tool calls
5. Log every tool invocation for audit
6. Pin SDK versions. Check changelogs before upgrading.
7. Never expose secrets in tool descriptions or error messages
```
# 09. Finding existing servers
Before you build a server, check if one already exists. 10,000+ public MCP servers are available. Most common services already have community or official servers.
- Official Anthropic servers: GitHub, Slack, Google Drive, Google Maps, Postgres, Puppeteer, filesystem, memory. These are maintained by Anthropic and follow the latest spec.
- Community servers: search GitHub for "mcp-server-[service]". Notion, Linear, Jira, Stripe, Supabase, MongoDB, Elasticsearch, and hundreds more. Quality varies. Check stars, recent commits, and whether auth is properly implemented before connecting to production data.
- Directories: [mcp.so](//mcp.so), Smithery, Glama all index public MCP servers with descriptions, install commands, and ratings.
> Evaluation checklist for community servers: Does it implement auth? Does it validate inputs? Is it actively maintained (commits in last 30 days)?
> Does it target the 2026-07-28 spec or an older revision? Does it follow least-privilege (read-only where appropriate)?
# 10. MCP in production
Running MCP locally on your laptop is step one. Running it in production with real users, real data, and real security requirements is step two.
- Deployment. With the 2026-07-28 stateless spec, MCP servers deploy like any other HTTP service. Docker, Kubernetes, AWS Lambda, Cloudflare Workers. No special infrastructure. Cloudflare's Agents SDK supports the new spec from day zero, so you can run MCP servers directly in Workers.
- Monitoring. Log every tool invocation: what was called, what inputs were sent, what was returned, how long it took. When something breaks at 3am, the logs are the only thing that tells you why.
- Scaling. Stateless servers scale horizontally behind a load balancer. No sticky sessions, no shared state between instances. This is the entire point of the 2026-07-28 revision. The old spec required persistent connections that made scaling painful.
# 11. What comes next
MCP started as a way to connect AI to tools. It is becoming the infrastructure layer for the entire agentic ecosystem.
<video controls preload="metadata" poster="/doc/4281/image/img_65eee2149ba3.jpg" src="/videos/0057.mp4"></video>
- Agent-to-Agent (A2A). Google's protocol for agents talking to other agents. MCP handles agent-to-tool. A2A handles agent-to-agent. They are complementary, not competing. An agent uses MCP to call a tool and A2A to coordinate with another agent.
- Agentic AI Foundation. MCP is now governed by the Linux Foundation's Agentic AI Foundation. Anthropic still maintains the spec, but governance is shared with AWS, Microsoft, Google, and the community. This means the protocol will outlive any single company's interest in it.
- Extensions ecosystem. The 2026-07-28 spec introduced a formal extensions system. Official extensions (like Tasks and EMA) come from the spec team. Custom extensions can be built by anyone. This is how MCP grows without bloating the core protocol.
> MCP's position in 2026 is similar to HTTP's position in 1995. The protocol is young, fast-growing, and not fully standardized.
> But the adoption curve is steep enough that betting against it is harder than betting on it. Every major AI lab is building on it. The question is not whether MCP wins. The question is how fast.
# 6 MCP servers to build or connect this week
1. Postgres MCP: Connect Claude to your database. Read-only queries, schema inspection, sample data. Claude writes SQL against your actual schema instead of guessing.
2. GitHub MCP: Create PRs, read issues, list files, search code. Claude Code uses this to interact with your repos beyond the local filesystem.
3. Slack MCP: Read channels, post messages, search history. Your agent can report status, ask questions, and share results in the channels your team already uses.
4. Notion MCP: Read pages, search content, create entries. Claude accesses your company knowledge base instead of relying on its training data.
5. Filesystem MCP: Read, write, search, and organize files on disk. The basic building block for any local agent. Ships with the official MCP server collection.
6. Your internal API: Wrap your company's internal tools as an MCP server. One server, every AI tool in your org gets access. The highest-leverage MCP server you can build.
# Five MCP mistakes
- x No auth on production servers. A public MCP server without authentication is an open door to your database. Every production server needs OAuth 2.1 or equivalent.
- x Trusting model-generated inputs. The model generates tool arguments. Those arguments can contain SQL injection, path traversal, or command injection. Validate everything.
- x Building before searching. 10,000+ servers exist. Check GitHub, [mcp.so](//mcp.so), and Smithery before writing your own. The Postgres, GitHub, and Slack servers are already production-grade.
- x Vague tool descriptions. Claude reads tool descriptions to decide when and how to call them. "Run a query" is vague. "Execute a read-only SQL SELECT query against the PostgreSQL database, max 1000 rows" is precise. Precision prevents wrong calls.
- x Targeting the old spec. The 2026-07-28 stateless core is simpler to implement and deploy than the old session-based model. New servers should target the new spec.
# Conclusion:
Before USB, a drawer full of cables. Before MCP, a codebase full of wrappers.
Every time you hardcode a tool call, you are writing a proprietary cable. It works for one model, one service, one project. When the model changes, the cable breaks. When the service updates its API, the cable breaks. When you move to a new project, you write the cable again.
MCP replaces the drawer with one port. Build the server once. Every client gets it. Add a new model? Zero new integrations. Add a new tool? One new server. N+M instead of NxM.
The protocol is 18 months old. It already has 400 million monthly downloads, 10,000+ servers, and adoption from every major AI lab. The question is not whether to learn MCP. The question is how long you wait.
One server. Every client. That is the entire pitch. That is why it won.
## 相关链接
- [0xRafy](https://x.com/0xRafy)
- [@0xRafy](https://x.com/0xRafy)
- [4.5K](https://x.com/0xRafy/status/2087909956754284865/analytics)
- [movez.substack.com](https://movez.substack.com/)
- [mcp.so](https://mcp.so/)
- [mcp.so](https://mcp.so/)
- [Upgrade to Premium](https://x.com/i/premium_sign_up)
- [10:31 PM · Aug 13, 2026](https://x.com/0xRafy/status/2087909956754284865)
- [4,555 Views](https://x.com/0xRafy/status/2087909956754284865/analytics)
- [View quotes](https://x.com/0xRafy/status/2087909956754284865/quotes)
---
*导出时间: 2026/8/14 09:31:56*
---
## 中文翻译
# MCP：连接智能体与万物的协议，11步完全指南
**作者**: 0xRafy
**日期**: 2026-08-13T14:31:39.000Z
**来源**: [https://x.com/0xRafy/status/2087909956754284865](https://x.com/0xRafy/status/2087909956754284865)
---
在USB出现之前，每个设备都有自己的连接线。MCP就是AI智能体的USB。每月超过4亿次SDK下载。超过10,000个服务器。所有主要AI实验室均已采用。
在USB出现之前，每个设备都有自己的连接线。打印机、扫描仪、键盘、相机。抽屉里塞满了只能用于一种设备的专有连接器。
然后USB出现了，一个端口搞定一切。MCP之于AI智能体，正如USB之于设备。一个协议，让Claude连接到任何工具、任何数据库、任何API。
> 关注我的Substack获取最新AI前沿资讯：[movez.substack.com](https://movez.substack.com/)
不再需要为每个服务编写自定义包装器。不再需要为每个项目重建集成。不再需要在每个智能体中硬编码工具调用。Anthropic于2024年11月将其开源。到2026年：OpenAI、Google、Microsoft和AWS均已采用。超过10,000个服务器投入生产。这是完整的指南。
<video controls preload="metadata" poster="/doc/4281/image/img_24f6a2663ec5.jpg" src="/videos/0056.mp4"></video>
在MCP出现之前，一家公司如果希望其内部数据库、工单系统和CI流水线都能被AI智能体访问，就必须为每种模型和工具的组合编写单独的胶水代码。
不同的API形态、不同的认证流程、不同的错误处理。每次集成都是定制的。每次迁移都是一次重写。
MCP用一个开放标准取代了这一切。构建一个服务器，任何兼容MCP的客户端都能使用它。Claude Code、Claude Desktop、Cursor、Windsurf、VS Code、Amazon Bedrock、自定义智能体。
一次集成，所有客户端通用。2026年7月28日，MCP历史上最大规模的规范修订发布：无状态核心、扩展系统、企业级认证。本指南涵盖所有内容。
MCP之前：每个模型×每个工具都需要一次集成。MCP之后：一个服务器，所有客户端通用。
# 01. MCP到底是什么
MCP（模型上下文协议）是一个开放标准，允许AI模型通过统一接口连接到外部工具、文件和数据源。
无需为每种模型和服务的组合编写自定义胶水代码，只需构建一个MCP服务器，任何MCP客户端都可以使用它。
打个比方：USB标准化了设备与计算机的通信方式。MCP标准化了AI智能体与世界的通信方式。USB之前，每台打印机都需要自己的驱动和连接线。
USB之后，一个端口搞定一切。MCP之前，每个智能体都需要为每次集成编写自定义代码。MCP之后，一个服务器处理所有客户端。
# 02. 发展时间线
- 2024年11月：Anthropic开源MCP。低调发布。主要用于个人笔记本电脑上的本地开发。
- 2025年3月：OpenAI、Google和Microsoft宣布采用。MCP一夜之间从Anthropic的副项目变成行业标准。
- 2025年7月：所有主流IDE都支持它。Cursor、Windsurf、VS Code。Claude Code内置MCP。SDK下载量突破每月9700万次。
- 2026年：超过10,000个公共服务器投入生产。每月SDK下载量超过4亿次，同比增长4倍。提供11种语言的SDK。现在由Linux基金会旗下的Agentic AI Foundation管理。
- 2026年7月28日：MCP历史上最大规模的规范修订发布。无状态核心取代了依赖会话的模型。扩展系统。企业托管授权。协议走向成熟。
# 03. 架构
MCP有三个角色：主机、客户端和服务器。
- 主机是用户交互的应用程序。Claude Desktop、Claude Code、Cursor、自定义应用。一个主机可以管理多个客户端。
- 客户端位于主机内部。每个客户端与单个MCP服务器保持1:1连接。客户端在主机内部协议和MCP之间进行转换。
- 服务器暴露能力：工具、资源和提示词。
一个Postgres MCP服务器将run_query暴露为工具，将数据库表暴露为资源。一个GitHub MCP服务器将create_pr、list_issues、read_file暴露为工具。
# 04. 三个原语
MCP服务器暴露三种类型的能力：
1. 工具是模型可以调用的函数。run_query、create_pr、send_email。模型决定何时调用它们。你执行它们并返回结果。这是最常用的原语。
2. 资源是模型可以读取的数据。文件、数据库模式、API文档、配置。资源提供上下文而无需函数调用。可以把它们想象成模型可以按需访问的文件。
3. 提示词是服务器可以提供的可重用模板。针对常见任务的预构建指令。模型或用户可以调用它们。使用频率低于工具和资源，但对于跨团队标准化工作流程很有用。
```
# 一个最小的MCP服务器暴露工具、资源或两者
# 工具：模型可以调用的函数
{
"name": "run_query",
"description": "执行只读SQL查询",
"inputSchema": {
"type": "object",
"properties": {"query": {"type": "string"}},
"required": ["query"]
}
}
# 资源：模型可以读取的数据
{
"uri": "postgres://mydb/schema",
"name": "数据库模式",
"mimeType": "application/json"
}
```
# 05. 构建你的第一个服务器
MCP服务器是一个通过标准协议暴露工具、资源或两者的程序。你可以使用Anthropic的官方SDK用TypeScript或Python构建。
下面的服务器暴露一个工具（运行SQL查询）和一个资源（数据库模式）。
```
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
const server = new McpServer({
name: "postgres-mcp",
version: "1.0.0"
});
// 工具：运行只读查询
server.tool(
"run_query",
"执行只读SQL SELECT查询",
{ query: { type: "string", description: "SQL SELECT查询" } },
async ({ query }) => {
const rows = await db.query(query);
return { content: [{ type: "text", text: JSON.stringify(rows) }] };
}
);
// 资源：数据库模式
server.resource(
"schema",
"postgres://mydb/schema",
async () => ({
contents: [{ uri: "postgres://mydb/schema",
text: await getSchemaJSON() }]
})
);
server.listen();
```
这就是一个可用的MCP服务器。Claude Code、Claude Desktop、Cursor或任何MCP客户端都可以连接到它并使用工具和资源。一个服务器，所有客户端通用。
# 06. 连接到Claude
将你的服务器连接到Claude的三种方式：
1. Claude Desktop：将服务器添加到你的claude_desktop_config.json中。Claude Desktop会自动启动服务器，并在Cowork和Chat中提供其工具。
```
{
"mcpServers": {
"postgres": {
"command": "npx",
"args": ["tsx", "server.ts"],
"env": {"DATABASE_URL": "postgres://..."}
}
}
}
```
1. Claude Code：使用claude mcp add命令。服务器在你的编码会话中立即可用。
2. Claude API：在API调用中传递mcp_servers参数。服务器远程运行，Claude在对话过程中根据需要调用其工具。
# 07. 2026-07-28规范
2026年7月28日，MCP发布了自推出以来最大规模的修订。核心变化：MCP变为无状态。旧规范要求带有会话管理的持久双向连接。
新规范使用轻量级的请求/响应模型。没有会话，没有握手，没有持久连接。
为什么这很重要：无状态服务器可以运行在负载均衡器后面，水平扩展，缓存响应，并部署在标准云基础设施上。旧规范适用于笔记本电脑。新规范适用于企业级规模。
扩展取代了以前内置于核心规范中的内容。任务（用于长时间运行的操作）、企业托管授权和其他能力现在是可选扩展。你的服务器只包含它需要的内容，不多不少。
企业托管授权（EMA）现已稳定。组织可以集中管理其所有MCP服务器的认证。最终用户登录一次即可访问所有连接的服务器。Anthropic、Microsoft和Okta均已采用。
> 如果你在2026年7月之前构建了MCP服务器，它们至少还能再运行12个月（弃用保证）。
> 但新服务器应针对2026-07-28规范。无状态核心更易于实现和部署。
# 08. 安全性
MCP的快速增长伴随着安全问题。独立扫描发现大量公共服务器存在可利用的漏洞。NSA和CISA发布了正式指南。安全不是可选项。
- 认证。每个生产级MCP服务器都需要身份验证。2026-07-28规范增加了iss（签发者）参数用于令牌验证。远程服务器使用OAuth 2.1。切勿将没有认证的服务器部署到生产环境。
- 输入验证。模型生成工具输入。这意味着输入可以是任何内容。如果不经验证就将模型生成的输入直接传递给系统，SQL注入、路径遍历、命令注入都可能发生。将每个工具输入都视为不可信的用户输入。
- 最小权限。数据库MCP服务器应暴露只读查询，而不是完整的数据库访问权限。用于代码审查的GitHub MCP服务器不应有删除仓库的权限。给每个服务器分配其所需的最低权限。
```
# MCP服务器安全检查清单
1. 每个端点都有认证（远程使用OAuth 2.1）
2. 验证所有工具输入（SQL注入、路径遍历）
3. 默认只读。仅在需要时授予写权限。
4. 工具调用限流
5. 记录每次工具调用以供审计
6. 锁定SDK版本。升级前检查变更日志。
7. 切勿在工具描述或错误消息中暴露密钥
```
# 09. 寻找现有服务器
在构建服务器之前，先检查是否已存在。已有超过10,000个公共MCP服务器可用。大多数常见服务已有社区或官方服务器。
- Anthropic官方服务器：GitHub、Slack、Google Drive、Google Maps、Postgres、Puppeteer、文件系统、内存。这些由Anthropic维护，遵循最新规范。
- 社区服务器：在GitHub上搜索"mcp-server-[服务名]"。Notion、Linear、Jira、Stripe、Supabase、MongoDB、Elasticsearch以及数百个更多。质量参差不齐。在连接到生产数据之前，检查星标数、最近的提交以及认证是否实现正确。
- 目录站：[mcp.so](//mcp.so)、Smithery、Glama都索引了公共MCP服务器，包含描述、安装命令和评分。
> 社区服务器评估清单：是否实现了认证？是否验证输入？是否积极维护（最近30天内有提交）？
> 是否针对2026-07-28规范或更旧的修订版？是否遵循最小权限原则（适当情况下只读）？
# 10. 生产环境中的MCP
在本地笔记本电脑上运行MCP是第一步。在生产环境中以真实用户、真实数据和真实安全要求运行是第二步。
- 部署。借助2026-07-28无状态规范，MCP服务器可以像任何其他HTTP服务一样部署。Docker、Kubernetes、AWS Lambda、Cloudflare Workers。无需特殊基础设施。Cloudflare的Agents SDK从第一天起就支持新规范，因此你可以直接在Workers中运行MCP服务器。
- 监控。记录每次工具调用：调用了什么、发送了什么输入、返回了什么、花了多长时间。当凌晨3点出问题时，日志是唯一能告诉你原因的东西。
- 扩展。无状态服务器在负载均衡器后面水平扩展。无需粘性会话，实例之间无需共享状态。这就是2026-07-28修订的全部意义。旧规范要求持久连接，使扩展变得痛苦。
# 11. 未来展望
MCP最初是连接AI与工具的一种方式。它正在成为整个智能体生态系统的基础设施层。
<video controls preload="metadata" poster="/doc/4281/image/img_65eee2149ba3.jpg" src="/videos/0057.mp4"></video>
- 智能体到智能体（A2A）。Google的协议，用于智能体与其他智能体通信。MCP处理智能体到工具。A2A处理智能体到智能体。它们是互补的，而不是竞争的。智能体使用MCP调用工具，使用A2A与其他智能体协调。
- Agentic AI Foundation。MCP现在由Linux基金会的Agentic AI Foundation管理。Anthropic仍然维护规范，但治理权与AWS、Microsoft、Google和社区共享。这意味着该协议将超越任何单一公司的利益而存在。
- 扩展生态系统。2026-07-28规范引入了正式的扩展系统。官方扩展（如Tasks和EMA）来自规范团队。任何人都可以构建自定义扩展。这就是MCP在不膨胀核心协议的情况下成长的方式。
> MCP在2026年的地位类似于HTTP在1995年的地位。该协议年轻、增长迅速，尚未完全标准化。
> 但采用曲线足够陡峭，押注它失败比押注它成功更难。每个主要AI实验室都在基于它构建。问题不是MCP是否会赢。问题是它赢得多快。
# 本周值得构建或连接的6个MCP服务器
1. Postgres MCP：将Claude连接到你的数据库。只读查询、模式检查、样本数据。Claude根据你的实际模式编写SQL，而不是猜测。
2. GitHub MCP：创建PR、读取issue、列出文件、搜索代码。Claude Code使用它来与本地文件系统之外的仓库交互。
3. Slack MCP：读取频道、发布消息、搜索历史。你的智能体可以在你的团队已经使用的频道中报告状态、提问和分享结果。
4. Notion MCP：读取页面、搜索内容、创建条目。Claude访问你的公司知识库，而不是依赖其训练数据。
5. 文件系统MCP：读取、写入、搜索和组织磁盘上的文件。任何本地智能体的基本构建块。随官方MCP服务器集合一起提供。
6. 你的内部API：将你公司的内部工具封装为MCP服务器。一个服务器，你组织中的每个AI工具都能访问。这是你能构建的杠杆率最高的MCP服务器。
# 五个MCP常见错误
- x 生产服务器没有认证。没有身份验证的公共MCP服务器就是通往你数据库的敞开大门。每个生产服务器都需要OAuth 2.1或同等方案。
- x 信任模型生成的输入。模型生成工具参数。这些参数可能包含SQL注入、路径遍历或命令注入。验证一切。
- x 先构建再搜索。已有超过10,000个服务器。在编写自己的服务器之前，先检查GitHub、[mcp.so](//mcp.so)和Smithery。Postgres、GitHub和Slack服务器已经是生产级的。
- x 模糊的工具描述。Claude阅读工具描述来决定何时以及如何调用它们。"运行查询"很模糊。"针对PostgreSQL数据库执行只读SQL SELECT查询，最多1000行"很精确。精确性可以防止错误调用。
- x 针对旧规范。2026-07-28无状态核心比旧的基于会话的模型更易于实现和部署。新服务器应针对新规范。
# 结论：
USB之前，抽屉里塞满了连接线。MCP之前，代码库里塞满了包装器。
每次你硬编码一个工具调用，你就是在编写一根专有连接线。它适用于一个模型、一个服务、一个项目。当模型改变时，连接线就断了。当服务更新其API时，连接线就断了。当你转向新项目时，你又要重新编写连接线。
MCP用一个端口取代了抽屉。构建一次服务器。所有客户端都能获得。添加新模型？零新增集成。添加新工具？一个新服务器。N+M而不是N×M。
该协议才18个月大。它已经有每月4亿次下载、超过10,000个服务器，以及所有主要AI实验室的采用。问题不是是否要学习MCP。问题是你还要等多久。
一个服务器。所有客户端。这就是全部卖点。这就是它获胜的原因。
## 相关链接
- [0xRafy](https://x.com/0xRafy)
- [@0xRafy](https://x.com/0xRafy)
- [4.5K](https://x.com/0xRafy/status/2087909956754284865/analytics)
- [movez.substack.com](https://movez.substack.com/)
- [mcp.so](https://mcp.so/)
- [mcp.so](https://mcp.so/)
- [升级到Premium](https://x.com/i/premium_sign_up)
- [2026年8月13日 晚上10:31](https://x.com/0xRafy/status/2087909956754284865)
- [4,555次浏览](https://x.com/0xRafy/status/2087909956754284865/analytics)
- [查看引用](https://x.com/0xRafy/status/2087909956754284865/quotes)
---
*导出时间: 2026/8/14 09:31:56* 
