Short answer: the Model Context Protocol (MCP), the open standard that lets AI agents call outside tools, had its largest revision since launch in July 2026. It is now stateless, it has a formal deprecation policy, and its authorization rules were tightened. For buyers, that means MCP is easier to run in production, but you should still ask each vendor which version they support, how access is controlled and how tool calls are logged.
This is a trend explainer, not a ranking. For tool picks in nearby areas, see our posts on AI agent frameworks in 2026, search APIs for AI agents and workflow automation for developers and AI agents. The broader AI & ML buyer guide lists the tools themselves.
What is MCP, in one paragraph?
MCP defines how an AI application discovers and calls tools such as a database query, a calendar action or a search API. Anthropic open-sourced it in November 2024, and in December 2025 it was contributed to the Agentic AI Foundation (AAIF), which sits under the Linux Foundation. Anthropic is listed on ProductListo; most of the tools below are the kind of thing an agent reaches through a protocol like this.
Quick comparison: what changed and why a buyer cares
| Change (July 2026) | What it means in plain words | Question to ask a vendor |
|---|---|---|
| Fully stateless design | Servers can sit behind ordinary load balancers; no sticky routing or shared session state | Do you run MCP servers on standard cloud infrastructure, and how do you scale them? |
| Formal deprecation policy | At least 12 months between deprecating a feature and removing it | Which spec version do you support, and how will you handle removals? |
| Extensions framework | Features can evolve outside the core release cycle | Which extensions do you use, and are they official? |
| Hardened authorization | Matches how OAuth 2.0 and OpenID Connect are deployed in practice; iss validation is now mandatory |
How do you authenticate, and can access be tied to our identity provider? |
| Enterprise Managed Authorization | The organization's identity provider decides who can use which MCP server | Does your product support central access control? |
| MCP Tasks (now official) | Long jobs return a handle, so clients can check progress and fetch results after reconnecting | How do you handle long-running jobs and failures? |
| MCP Apps (official extension) | Servers can deliver their own interactive interfaces | Do you ship UI inside the agent, and how is it secured? |
The facts in this table come from the AAIF's own announcement, written by an MCP core maintainer, which calls this the largest revision of the protocol since its launch. It does not give a version number, and it reports no adoption or performance figures, so treat any such number you see elsewhere with care.
Why does "stateless" matter?
Before this change, scaling an MCP server often meant keeping a user's requests pinned to one machine, or sharing session data between machines. That is awkward for any team that already runs Kubernetes or a managed cloud platform. A stateless design lets a server be copied behind a load balancer like any other web service.
The current draft tools specification adds a practical design note. MCP has no protocol-level session, so a tool that needs memory across calls, such as a shopping cart, should return an explicit handle and accept it on later calls. It also says the set of tools a server returns must not vary per connection, although it may vary with the authorization presented on a request.
Our read: this is good news for teams that have been nervous about running agent tooling in production. The remaining risk is not the protocol but how carefully each vendor implements it.
Why does the deprecation policy matter?
A guarantee of at least twelve months between formal deprecation and earliest removal is a procurement-friendly promise. It gives you time to plan upgrades, and it gives vendors a clear rule to follow. If you sign a one-year contract for an agent product, ask what protocol version it targets and what the vendor's upgrade plan is.
What should you check about security?
Two security changes stand out. First, the authorization rules were aligned with how OAuth 2.0 and OpenID Connect are used in real deployments, and checking the iss parameter is now mandatory, which the AAIF says closes a class of mix-up attacks. Second, Enterprise Managed Authorization lets an organization use its own identity provider as the authority for who can reach an MCP server.
The draft tools specification also lists baseline duties. Servers must validate all tool inputs, implement access controls, rate limit tool calls and sanitize outputs. Clients should ask for user confirmation on sensitive operations, show tool inputs before calling, set timeouts and log tool usage for audit. It also says there should always be a human in the loop who can deny a tool call. That draft may change, so read the current version before you rely on it.
A buyer's checklist that follows from this:
- Identity: can the product sign in through your identity provider, and can you remove a person's access in one place?
- Least privilege: can each agent be given only the tools it needs?
- Approval: are sensitive actions, such as sending money or deleting records, held for a human to approve?
- Logs: does every tool call leave a record with the tool name, inputs, outputs and time?
- Input checks: does the vendor validate tool inputs against a schema? Developers can try this themselves; UrwaTools has a step-by-step guide on writing and checking a JSON schema for an AI agent tool.
Where do the tools in our directory fit?
MCP is a connection layer, so it touches almost every category we cover. These are the groups worth watching, each linked to its listing page. We have not verified MCP support for every product, so check each vendor's documentation.
Agent frameworks. LangChain, LlamaIndex, CrewAI, AutoGen and DSPy are the libraries teams build agents with. If you are choosing between them, start with LangChain vs LlamaIndex, AutoGen vs LangChain or CrewAI vs LangChain.
Search and data for agents. Tavily, Exa and the Brave Search API are examples of services agents call to get fresh information. Our search APIs post compares them.
Workflow and integration platforms. n8n, Zapier, Make, Pipedream, Activepieces, Workato and Boomi connect agents to business apps. For a migration view, see best Zapier alternatives in 2026.
Business apps agents will touch. Slack and Salesforce are typical targets for agent actions, which is why access control and logging matter most there.
For the infrastructure side of running servers, see the cloud and infra guide and the AI & ML topic page.
What did IBM and Microsoft announce this week?
On November 10, 2026, IBM and Microsoft announced Imagine Enterprise, an agent platform for industry-specific work. According to the announcement, IBM Consulting contributes more than 6,000 pre-built agents and assets, and Microsoft contributes parts of its AI, data, cloud and security stack, including Foundry, Copilot Studio, Fabric, Entra, Purview and Defender. It starts with frameworks for financial services, insurance and retail, with manufacturing, energy, public sector and mobility planned later. The release stresses controls, observability and AI-compliance support.
The announcement does not name MCP or the Agent2Agent (A2A) protocol, so we cannot say how the platform connects to outside tools. That is a good example of the question to ask any large vendor: which open standards do you support, and which version?
Our read: big bundled platforms are arriving at the same time as open standards. Buyers get more choice, but also more ways to end up locked in. An open protocol is your exit plan, so ask for it in writing.
What should US teams check?
The US has no single federal AI statute, so requirements vary by state and use case. We covered Colorado's changing law in our agent frameworks explainer. The practical checks for US buyers of MCP-connected tools are:
- Identity provider fit: confirm the product works with the single sign-on system you already use, since MCP's managed authorization is built around the organization's identity provider.
- Record keeping: ask how long tool-call logs are kept, who can read them and whether you can export them.
- Approval steps: confirm you can require a human to approve high-impact actions.
- App connectors: check that the connectors you need, such as Slack, Salesforce or Stripe, exist and are supported.
This is general information, not legal advice. Confirm current rules with counsel.
For teams in South Korea
South Korea's AI Basic Act and its Enforcement Decree took effect on January 22, 2026. The US International Trade Administration's market intelligence page summarizes duties such as advance notice that AI is in use, labels for realistic generated content, and risk management, human oversight and record keeping for high-impact systems. It also notes a grace period of at least one year in 2026 during which administrative fines are generally deferred, except for serious harm. Our buyer's checklist for the AI Basic Act goes deeper.
For MCP-connected tools, the practical steps are to test Korean-language output and notices, ask whether the vendor can provide tool-call logs and documentation on request, and confirm cloud region and data-handling terms before deployment. We have not verified Korean-region availability for the tools above, so ask each vendor directly.
A short plan for the next 30 days
- List your agent tools. Write down every tool an agent can call today, and who owns each one.
- Ask four questions. Which MCP version do you support, how is access controlled, how are calls logged, and how do you handle long-running jobs?
- Test one tool end to end. Pick a low-risk tool, validate its inputs, and read the log it produces.
- Add approval to risky actions. Anything that spends money or changes records should need a human click.
- Review again in a quarter. The 12-month deprecation window gives you time, but only if someone is watching.
Which big names are missing from our directory?
Several widely used options in this area are not listed on ProductListo yet, including Microsoft Copilot Studio, Microsoft Foundry and IBM's agent products. We name them so you can include them in your own evaluation, but we have not reviewed them.
Related reading
- AI agent frameworks in 2026: what changed
- Search APIs for AI agents: what changed in 2026
- Retrieval-augmented generation, explained
- Best Cloud & Infra tools in 2026
Do you make an agent tool?
If you build an MCP server, agent framework or tool that agents rely on and want it considered for the directory, submit it here. If you are interested in a sponsored placement or a guest article, see write for us.
A plain JSON log works until it doesn't
Tool calls and results are JSON, so a few free browser tools go a long way while you prototype. A JSON schema validator, a JSON formatter and a JSON diff tool cover most early debugging. UrwaTools also has guides on writing and checking a JSON schema for an agent tool and on keeping an audit log of agent tool calls. When several people need to search and replay runs, move to a proper tracing platform.
Sources and further reading: AAIF: MCP graduates to enterprise infrastructure, MCP draft specification: tools, IBM newsroom: Imagine Enterprise, US ITA: South Korea's AI Basic Act. This article is general information, not legal advice.