The Model Context Protocol (MCP) is the USB port of AI tooling: one open standard that lets any AI agent talk to any external tool — databases, GitHub, browsers, ticketing systems — without a custom integration for each pair. Anthropic introduced it in November 2024; by December 2025 it had grown big enough that Anthropic donated it to the Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI and backed by AWS, Google, Microsoft, Salesforce, and Snowflake. In under two years it went from one company's spec to neutral, industry-governed infrastructure.
The numbers behind the standard
- The official MCP Registry counted roughly 9,700 registered servers (≈29,000 server/version records) as of May 2026, with nearly 16,000 GitHub repositories tagged
mcp-server. - MCP SDKs see about 97 million downloads per month.
- Anthropic, OpenAI, Google, Microsoft, GitHub, VS Code, Cursor, and ChatGPT all ship first-party MCP support — and so does Cortex, since v2.8.0.
- The protocol keeps moving: the July 28, 2026 specification release candidate adds a stateless protocol core, an Extensions framework, Tasks, MCP Apps, and hardened authorization.
Translation: MCP won. Integrations you configure today will outlive whatever tool you configure them in — which is exactly why an acquisition-proof toolchain should be built on it.
With ~10,000 servers, which ones matter?
For day-to-day development work, a shortlist beats the catalog. These are the categories (and canonical picks) that earn their place:
- GitHub — the single highest-value connection: the agent can read issues, inspect PRs, and check CI status while it works, instead of you copy-pasting context into chat.
- A database server (Postgres, SQLite, MySQL) — lets the agent inspect real schemas and query real data when writing migrations or debugging ORM code. Read-only credentials, always.
- Web fetch / search — pulls live documentation and error-message research into the loop.
- Browser automation (Playwright-based servers) — the agent can drive and verify the web app it's building, not just claim it works.
- Error tracking (Sentry) — "fix the top crash from production" becomes a one-line instruction when the agent can read the stack traces itself.
- Team tools (Slack, Linear, Notion) — useful for context ("what did we decide about auth?"), best connected read-only.
Official servers also exist for Stripe, Figma, Cloudflare, Shopify, Salesforce, and hundreds more — add them when a task actually needs them, not because they exist.
The security rules (read before connecting anything)
An MCP server is code that runs with access to your data, feeding content into an agent that edits your files. Three rules keep that safe:
- Only run servers you trust — official vendor servers or widely-used open-source ones you can read. A malicious server can inject instructions into your agent's context.
- Least privilege — read-only tokens wherever possible, scoped API keys always, never an admin credential in an
mcpServersconfig. - Keep the agent's own guardrails on — tool results are untrusted input. Cortex's loop treats them that way: dangerous commands stay hard-blocked and diffs still pass the reviewer gate no matter what a connected tool says.
Connecting MCP servers in Cortex
Cortex speaks the same standard mcpServers JSON config used by Claude Desktop and Cursor — paste any server's config into Settings → MCP Servers and the agent can use its tools directly in chat and in agentic loops. Connections retry automatically on flaky networks, and the panel shows live status per server. MCP connections are part of the Pro subscription ($10/month) alongside hosted web search, embeddings, and OCR — the BYOK IDE itself stays free. Setup details are in the docs.