MCP joins the Linux Foundation: tool access becomes infrastructure

On December 9, Anthropic donated the Model Context Protocol to the Agentic AI Foundation, a new directed fund under the Linux Foundation co-founded by Anthropic, Block, and OpenAI, with Google, Microsoft, AWS, Cloudflare, and Bloomberg in support. MCP arrives as a founding project alongside Block’s goose and OpenAI’s AGENTS.md. The protocol this archive called the integration layer a quant platform needed, back when it was a vendor’s open-source project, is now nobody’s product, which is precisely what lets everybody build on it.

The adoption numbers explain why the governance question became urgent. MCP runs at 97 million monthly SDK downloads across roughly 10,000 active servers, with client support spanning ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code. A wire protocol at that scale is infrastructure whatever its legal home says, and infrastructure whose roadmap one vendor controls is a risk every adopter carries silently. The original MCP analysis here flagged single-vendor stewardship as the open question two years ago. December 9 is the answer arriving.

The governance design is the part worth reading closely, because it follows the pattern that has worked for critical open infrastructure for thirty years. The foundation board owns strategic investment, budget, membership, and new-project approval. The projects keep technical autonomy, and MCP’s existing maintainer structure continues unchanged, with Anthropic still investing in core development. That split, money and politics upstairs, technical direction with the maintainers, is the Linux Foundation recipe that carried Kubernetes from a Google project to the substrate everyone ships on. Anthropic and OpenAI co-founding the same standards body is the tell: tool access is being deliberately moved out of the competitive layer.

Why a desk should care about a foundation

The practitioner reading runs through procurement, because that is where vendor-controlled dependencies actually bite. A bank’s architecture review can approve a protocol governed by a neutral foundation with multi-vendor backing in a way it structurally cannot approve a competitor’s product, however open the license. The questions that stall those reviews, what happens if the vendor pivots, gets acquired, deprecates the spec, now have institutional answers. Neutral governance is not a technical feature. It is the feature that converts cautious pilots into standardization decisions, the same dynamic that made fully open releases the model-risk argument rather than the research argument.

Bloomberg’s name on the member list is the financial-infrastructure signal worth a sentence of its own. The firm that runs the terminal every desk leases is backing the protocol that connects agents to data sources, which points one direction: market data, research, and analytics surfaces exposed as MCP servers, with the integration tax of wiring agents to financial systems collapsing toward configuration. Every bespoke connector a platform team maintains today is a candidate for retirement. The build-vs-integrate ledger this archive has tracked across self-hosted models and durable orchestration gains a standardized bottom layer.

The server count also changes where integration work happens. Under bespoke connectors, every firm wires every data source separately, the same engineering repeated behind a hundred different firewalls. Under a protocol with critical mass, the work moves upstream: a data vendor ships one official MCP server and every client on every desk gains the integration simultaneously. Protocols convert N-squared integration problems into N, which is the entire economic argument for standards. The 97 million monthly downloads say the conversion is already underway.

The agent stack, viewed from year-end, has quietly assembled itself into something an engineering organization can plan around: open weights at the model layer, a stable orchestration runtime, kernel-level observability, and now neutrally governed tool access. Eighteen months ago every layer of that sentence was a vendor bet. The remaining gaps are real, identity and authorization for agents acting across systems being the loudest. A foundation with this membership is where that work plausibly lands next.

The two sibling projects round out the donation and the division of labor. Block’s goose is an open-source agent framework, the consumer of protocols like MCP; OpenAI’s AGENTS.md is the emerging convention for repo-level agent instructions, the documentation layer agents read before acting. A foundation holding the tool protocol, an agent that speaks it, plus the instruction format agents consume is assembling the neutral commons one layer at a time, which is more coherent than the three-logo press release suggests.

The identity gap deserves the longest look from anyone in a regulated shop, because it is the control that does not exist yet. An agent calling an MCP server acts with credentials, and today those credentials are whatever the integrator wired in, typically a service account whose permissions outlive any single task. Wholesale delegation is exactly what an access-review committee exists to prevent. Until agent-scoped, task-scoped delegation lands in the standard, the compensating controls are unglamorous: narrowly scoped credentials per server, short-lived tokens where the backend allows them, plus the out-of-process audit trail that records what the agent actually did with the access. That is workable for read-heavy research workloads and genuinely insufficient for write access to systems of record, which is the honest boundary of agent deployment this quarter.

The playbook for the next two quarters follows directly. Inventory the bespoke connectors the platform team currently maintains and rank them by maintenance pain. Stand up one internal MCP server against a read-only research source, the corpus the retrieval stack already serves being the natural first candidate, and measure the integration delta honestly. And put an engineer in the working groups, because the firms present while the identity and authorization layer gets designed will get a spec that fits their compliance reality, while the firms that wait will get whatever shipped.

Two cautions keep the reading honest. Foundations are necessary rather than sufficient: plenty of donated projects have stagnated under neutral governance when the founding vendor’s energy faded, and MCP’s health still depends on Anthropic’s continued investment plus the maintainers it arrived with. And standardization concentrates risk even as it removes vendor risk, since a protocol everyone builds on makes its design flaws everyone’s flaws, which argues for the independent supervision layer staying outside the standardized path. Both cautions are arguments for engagement rather than distance: the firms that join the working groups get the spec their workflows need.

The verdict for the model-risk file: the dependency classification of MCP just improved from “vendor project, monitor quarterly” to “neutrally governed standard, treat as infrastructure.” That reclassification, mundane as it reads, is what December 9 actually shipped. Standards are boring precisely when they win; the interesting phase of tool-calling is over, leaving the building phase as what remains.

MCP’s donation to the Linux Foundation converts tool access from a vendor bet into governed infrastructure: 97 million monthly downloads, both frontier labs at the same table, and Bloomberg signaling where financial data is headed.