A shared connector is not a trust policy.

The documented moment

Anthropic introduced the Model Context Protocol in November 2024 as an open standard for connecting AI applications to data sources and tools. The announcement described servers exposing capabilities and clients connecting to them, alongside specifications, SDKs, and initial integrations. This case file records that announcement. It does not freeze the evolving protocol at its initial version or imply that every implementation has equivalent security.

The transferable practice

A conversational interface needs an explicit trust boundary wherever external content or a tool result enters the system. Decide which server identities may connect, which capabilities each user may invoke, and which writes require confirmation. Inspect the operation and its parameters before execution. A uniform transport is helpful plumbing; it cannot decide whether a retrieved instruction is legitimate, whether the user owns the target resource, or whether a destructive operation is appropriate.

A useful prototype test

Offer a read-only server and a server capable of changing a record. Verify that their permissions remain distinct after discovery, reconnection, and an account switch. Put a misleading instruction inside a retrieved document and check that the application treats it as data rather than authority. These are proposed checks, not claims of complete protection against prompt injection. For implementation details, use the current specification and a threat model for the actual deployment.

Keep the evidence attached

Source and limits

Introducing the Model Context Protocol ↗ · Anthropic · 2024-11-25. Product status and documentation may have changed since this dated announcement. The design lessons are our editorial synthesis.

Source imagery is included for local owner review only. Copyright remains with the respective rights holders; public reuse is not cleared.