When every vendor speaks MCP
The protocol checkbox has arrived on the RFP template. What the box means, what it doesn't, and the three questions that separate an integration from a press release.
You can date the moment a standard wins: it is when the salespeople stop explaining it. Nobody on a vendor call this autumn explains what MCP is. The deck just shows the logo, the way decks once showed "REST API" and, a wave before that, "SOAP compliant". (I still own a mug from a vendor who printed that on mugs. The mug outlived the product.)
The Model Context Protocol earned the logo fair and square. The spec went final in July with the unglamorous enterprise parts in place, and the piece your security team actually cares about, letting your identity provider rather than each employee decide what an agent may touch, grew up this year too. The standard is real. The checkbox, though, is doing the work checkboxes always do: compressing a range from "our product is genuinely operable by agents" down to "an intern wrapped three endpoints in a weekend". Both tick the box.
So when the box appears, I ask three questions, and I ask them in writing.
First: show me the manifest. Not the announcement, the actual list of tools the server exposes. Count the verbs. A server that can read tickets but not open them, or search records but not update them, is a demo with a certificate. The gap between what their UI can do and what their MCP server can do is the gap you will be paying humans to fill.
Second: whose identity does the agent carry? If the answer is "a service account with admin rights", that is the shadow IT problem you spent 2024 stamping out, now with better tooling. The right answer names your identity provider, scopes per user, and an audit log that shows which person's agent did what. If the vendor hesitates here, the box was marketing.
Third: which revision of the spec, and who owes the upgrade? MCP is young and moves quickly. A vendor pinned to last year's draft has bought an integration debt on your behalf; the contract should say whose sprint pays it off.
None of this is cynicism about the protocol. A shared standard beats forty bespoke connectors, and I have written the cheque for the forty connectors. It is the ordinary caution owed to any checkbox that became mandatory faster than it became uniform. The logo means the conversation can start. The manifest, the identity story and the version clause are the conversation.