The Model Context Protocol, almost always shortened to MCP, is an open standard defining how an artificial intelligence application discovers and calls software that sits outside it. A language model on its own produces text. MCP gives the application wrapped around that model a documented way to ask a remote system which operations it offers, invoke one of them, and receive a structured answer. In advertising, it is the layer through which an assistant such as Claude, ChatGPT or Gemini reads a campaign report and, on a growing number of platforms, creates a campaign.

The standard exists to collapse an integration problem. Wiring a dozen AI applications to a dozen data sources without a shared protocol requires 144 bespoke connections, each with its own authentication, error handling and schema. One protocol turns that into 24: every client implements the standard once, every system exposes it once.

How a tool call works

Three roles are defined. The host is the AI application. The client is the connection manager running inside it. The serveris the local process or remote service exposing capabilities. Each client holds a one-to-one relationship with a single server, and a host may run many clients simultaneously, which is what keeps a security boundary between connected systems.

Servers expose three primitives. Tools are executable functions a model can invoke. Resources are read-only data the host attaches as context. Prompts are reusable templates a person selects. Each primitive carries a discovery method, written as tools/list, resources/list and prompts/list, and tools add tools/call for execution. Every tool definition includes a JSON Schema describing its arguments, which is how a model knows what to send and what comes back.

Messages travel as JSON-RPC 2.0. Two transports exist: stdio for a local process, and Streamable HTTP for a remote endpoint. Authorisation is built on OAuth 2.1, with MCP servers classified as OAuth resource servers and clients required to implement the resource indicators described in RFC 8707, a rule added so a malicious server cannot obtain an access token minted for somewhere else.

The X advertising server, documented in detail on August 25, 2026, shows the shape in production. It sits at ads-api.x.com/mcp and exposes 23 tools: nine read accounts and inventory, two return analytics, two search the targeting taxonomy, and ten write to live accounts funded by real payment instruments. Authentication runs on the signed-in person's own OAuth token, so an agent sees only the accounts that person could already open. Campaigns an agent creates arrive paused, and activation needs a separate call.

Origin and evolution

Anthropic published MCP in November 2024, the first specification revision dated 2024-11-05. Four revisions have followed, each identified by date rather than number.

The 2025-03-26 revision introduced the OAuth 2.1 authorisation framework and replaced the original HTTP-plus-server-sent-events transport with Streamable HTTP. On 2025-06-18 batched JSON-RPC support was dropped, structured tool output and elicitation arrived, and the resource indicator requirement landed alongside a dedicated security best practices page.

Governance shifted next. The official MCP Registry, an open catalogue of publicly available servers, launched in preview on September 8, 2025. On December 9, 2025 Anthropic donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded with Block and OpenAI and supported by Google, Microsoft, Amazon Web Services, Cloudflare and Bloomberg. Anthropic counted more than 10,000 active public servers at that point.

The 2026-07-28 revision is the sharpest break so far, and it forced a rebuild of production infrastructure across the vendors that had adopted the protocol early. SEP-2575 removed the initialize handshake that opened every session, moving protocol version and client capabilities into per-request metadata and adding a server/discover method for clients wanting capabilities up front. SEP-2567 removed the Mcp-Session-Id header and the protocol-level session with it, so any request can now land on any server instance behind an ordinary round-robin load balancer. List results gained ttlMs and cacheScope fields, letting clients cache a tool list instead of polling for changes. Roots, sampling and logging were deprecated under a new lifecycle policy guaranteeing at least twelve months between deprecation and removal. Maintainers David Soria Parra and Den Delimarsky reported close to half a billion monthly downloads across the four Tier 1 software development kits.

Why the protocol reached media buying

Advertising adopted MCP early and without much hesitation. Google's Ads API team disclosed that it was exploring a server on July 7, 2025, and an experimental Google Analytics server followed weeks later. The open-source Google Ads API server arrived on October 7, 2025, read-only, exposing three tools and unable to pause a campaign or change a budget. Amazon Ads opened a closed beta on November 13, 2025 supporting Claude, ChatGPT, Amazon Q and Amazon Bedrock, moving to open beta on February 2, 2026.

Write access changed the stakes. Meta opened its ad system to Claude and ChatGPT on April 29, 2026, the first time a major platform let third-party agents create and edit campaigns, then opened the same ads server to any developer holding a Meta app on July 16, 2026. Adform went the other way, publishing 29 skills against its FLOW demand-side platform on July 11, 2026, every one read-only and described repeatedly as a design choice. Microsoft's Advertising server reached open pilot on June 17, 2026, also read-only. TikTok launched its own on May 13, 2026.

The protocol also connects vendors to each other rather than only to assistants. AdRoll and PubMatic linked buy-side and sell-side agents over MCP on April 23, 2026 to diagnose underdelivering deals without log exports and support tickets. Prebid.js merged a DevTools MCP module in early August 2026, making header bidding auction state readable by coding agents inside the browser. The protocol is also the substrate beneath the transaction standards above it: the Ad Context Protocol, launched by six companies on October 15, 2025, defines nine core tasks built on MCP.

Limitations and disputes

Security arrived as a problem early. PPC Land documented weaknesses in MCP implementations on July 20, 2025, including tool poisoning attacks that target the client-server communication layer by injecting instructions into tool responses. The structural issue is that tool descriptions and tool outputs both enter a model's context, and a model that cannot separate passive data from active instruction will act on whichever arrives. Cloudflare responded at the network layer, adding MCP traffic classification to its Gateway product using the MCP-Protocol-Version header so organisations can block agent calls routed outside approved portals.

Cost is the second constraint, and it is poorly understood. Draft Digital's Lars Postmus collapsed twelve MCP calls into a single buyer agent in July 2026 precisely because twelve endpoints queried by five buying functions produce twelve context loads, twelve authentication paths and twelve rounds of instruction, each metered in tokens.

Platform policy is a third. Google's revised developer policies of August 31, 2026 prohibited programmatic proxies and named MCP servers among the intermediate layers covered, while leaving Google's own server and single-agency internal implementations outside the restriction.

Governance postures also diverge in ways buyers must track platform by platform, since an identical instruction may edit a live Meta campaign and return nothing but a report elsewhere. And the standards layer above MCP remains contested: IAB Tech Lab chief operating officer Shailley Singh counted thirteen overlapping functions between the Agentic Advertising Management Protocols and the Ad Context Protocol on August 20, 2026, rejecting the idea that the two occupy complementary layers.

Not the same as

AdCP, the Ad Context Protocol, is an advertising-specific specification built on MCP, covering inventory discovery, media buy creation and signal activation. MCP is the transport and tool-calling layer beneath it.

A2A, Google's Agent2Agent protocol, standardises how one autonomous agent talks to another. MCP standardises how an agent talks to a tool.

AAMP, the Agentic Advertising Management Protocols named by IAB Tech Lab on February 26, 2026, is an umbrella containing the Agentic Real-Time Framework, an Agent Registry and buyer and seller agent kits. It maps to existing standards including OpenRTB and AdCOM.

A REST API exposes endpoints for developers to read documentation and write code against. An MCP server describes its own capabilities at runtime so a model can select among them without a developer writing integration code first.

In unrelated fields the same three letters mean multi-currency pricing, and within search advertising MCP is frequently mistyped for MCC, the Google Ads manager account formerly called My Client Center.

Recent developments

Adoption has broadened past the large platforms. Cint reported on September 1, 2026 that Potloc had used its MCP server to set up a 20-market consumer banking study in a single automated run, covering 20 target groups each with its own locale, feasibility check and bid. Dreamdata shipped a server built so that connected models cannot alter its account-based numbers. Gracenote, Nielsen's content intelligence unit, added a Sports MCP Server to its roadmap on September 9, 2026, extending a video server it launched a year earlier to ground model answers in verified metadata.

Timeline

  • November 2024: Anthropic publishes MCP as an open standard, first specification revision dated 2024-11-05
  • March 26, 2025: Revision adds an OAuth 2.1 authorisation framework and replaces HTTP plus server-sent events with Streamable HTTP
  • June 18, 2025: Revision removes JSON-RPC batching, adds structured tool output and elicitation, and requires RFC 8707 resource indicators
  • July 7, 2025: Google Ads API team discloses it is exploring an MCP server
  • July 20, 2025: Security researchers document tool poisoning and related weaknesses in MCP implementations
  • September 8, 2025: The official MCP Registry launches in preview
  • October 7, 2025: Google releases a read-only open-source MCP server for the Google Ads API
  • October 15, 2025: The Ad Context Protocol launches, built on MCP, with six founding companies
  • November 13, 2025: Amazon Ads opens a closed beta of its MCP server
  • December 9, 2025: Anthropic donates MCP to the Agentic AI Foundation under the Linux Foundation, citing more than 10,000 active public servers
  • February 26, 2026: IAB Tech Lab names its umbrella agentic initiative AAMP
  • April 29, 2026: Meta opens its ad system to third-party agents with write access from day one
  • May 13, 2026: TikTok launches an Ads MCP server
  • June 17, 2026: Microsoft's Advertising MCP server reaches open pilot, read-only
  • July 11, 2026: Adform publishes 29 read-only skills for its FLOW demand-side platform
  • July 16, 2026: Meta opens its ads MCP server to any developer holding a Meta app
  • July 28, 2026: The 2026-07-28 revision ships, removing protocol-level sessions and the initialize handshake
  • August 24, 2026: X launches an ads MCP server with 23 tools, ten of them write-capable
  • August 31, 2026: Google prohibits programmatic proxies, naming MCP servers among the covered intermediate layers

Summary

Who. Anthropic created the protocol and donated it to the Agentic AI Foundation, where maintainers David Soria Parra and Den Delimarsky lead the specification alongside a community process. Platform operators including Google, Amazon, Meta, Microsoft, TikTok, X, Adform, PubMatic, Prebid, Cint and Gracenote run servers. Advertisers and agencies consume them through assistants and custom agents.

What. An open standard, built on JSON-RPC 2.0, describing how an AI application discovers and invokes tools, reads resources and fetches prompt templates from an external server, with OAuth 2.1 authorisation and two defined transports.

When. Published in November 2024. Specification revisions followed in March and June 2025, November 2025 and July 2026, the last removing protocol-level sessions entirely. Advertising adoption began in mid-2025 and accelerated through 2026.

Where. Inside AI applications and their connections to advertising platforms, analytics systems, demand-side and supply-side platforms, header bidding libraries, research panels and metadata catalogues.

Why. The protocol matters because it determines what an autonomous system can reach and what it can change. Read-only servers expose reporting; write-capable servers expose budgets. The same standard carries both, which leaves the governance decision with each platform rather than with the specification, and leaves buyers tracking capability differences one platform at a time.