The most consequential AI news of the past year came from a standards body. In December 2025, Anthropic donated the Model Context Protocol to the newly formed Agentic AI Foundation, a directed fund under the Linux Foundation cofounded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, Cloudflare, and Bloomberg. Six months earlier, Google had handed its Agent2Agent protocol to the same foundation family. Companies that compete fiercely on models are now cooperating, formally and under neutral governance, on the interfaces between them.过去一年中最具影响力的 AI 新闻来自一个标准制定机构。2025年12月，Anthropic 将“模型上下文协议”（Model Context Protocol，简称 MCP）捐赠给了新成立的智能体 AI 基金会（Agentic AI Foundation）。该基金会是 Linux 基金会旗下的一个定向基金，由 Anthropic、Block 和 OpenAI 共同创立，并获得了谷歌、微软、AWS、Cloudflare 和彭博社的支持。六个月前，谷歌已将其 Agent2Agent 协议移交给了同一个基金会家族。这些在模型领域激烈竞争的公司，如今正在中立治理框架下，就模型间的接口问题开展正式合作。
For three years, the agent story has centered on capability: Models got better at planning, tool use, and long tasks. Integration improved more slowly. Every agent was still wired to its tools, data sources, and host application with custom glue, leaving even successful systems difficult to move or reuse. Standard interfaces change the economics of that work. Networking became an ecosystem when machines could agree on interfaces; programming tools followed the same path with the Language Server Protocol. In my judgment, the standardization now underway will influence what engineering teams ship over the next three years as much as further gains in model capability.三年来，关于智能体的叙事一直聚焦于能力：模型在规划、工具使用和长任务处理方面不断进步。但集成方面的进展却相对缓慢。每个智能体仍然需要通过定制的胶水代码与工具、数据源和宿主应用程序相连，这使得即使是成功的系统也难以迁移或复用。标准接口改变了这项工作的经济性。当机器能够就接口达成一致时，网络便形成了一个生态系统；编程工具也遵循了同样的路径，即语言服务器协议（Language Server Protocol）。在我看来，目前正在进行的标准化工作，对未来三年工程团队开发成果的影响，将不亚于模型能力的进一步提升。
The Model Context Protocol (MCP) standardizes how an AI application connects to tools and context. It uses JSON-RPC messages between hosts, clients, and servers. Servers can expose tools that a model invokes, resources containing context and data, and prompts that describe templated workflows. The spec credits the Language Server Protocol as an inspiration. Language servers replaced a separate integration for every editor-language pair with one interface on each side; MCP applies the same idea to AI applications and integrations. The current spec is dated July 28, 2026, the fifth dated protocol revision since the project launched in November 2024. That pace reflects active governance and warns implementers to expect movement.模型上下文协议（MCP）标准化了 AI 应用程序连接工具和上下文的方式。它在宿主、客户端和服务器之间使用 JSON-RPC 消息进行通信。服务器可以公开模型调用的工具、包含上下文和数据的资源，以及描述模板化工作流的提示词。该规范将语言服务器协议视为灵感来源。语言服务器用统一的接口取代了每个编辑器与语言对之间独立的集成方式；MCP 将同样的理念应用于 AI 应用程序和集成。目前的规范版本日期为2026年7月28日，这是自2024年11月项目启动以来的第五个协议修订版。这一节奏反映了活跃的治理状态，也提醒开发者预见到未来的变动。
Adoption has spread across competing hosts. The MCP maintainers’ December 2025 announcement cited more than 97 million monthly SDK downloads, over 10,000 active servers, and first-class client support across ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code. Any individual count can be debated. Cross-vendor implementation is harder to dismiss, because a shared interface becomes infrastructure when rivals support it independently.采纳范围已扩展至各竞争宿主平台。MCP 维护者在2025年12月的公告中提到，SDK 每月下载量超过9700万次，活跃服务器超过10,000台，且在 ChatGPT、Claude、Cursor、Gemini、Microsoft Copilot 和 Visual Studio Code 中均获得了原生客户端支持。任何单一统计数据都可能存在争议，但跨厂商的实现则难以忽视，因为当竞争对手独立支持某个共享接口时，它就成为了基础设施。
MCP covers the boundary between an application and its tools. The Agent2Agent protocol (A2A) addresses the next boundary: agents discovering and communicating with one another across vendors. It reached v1.0 in April 2026 with more than 150 supporting organizations, signed Agent Cards for verifiable identity, SDKs in five languages, and general availability in Microsoft Copilot Studio, Azure AI Foundry, and Amazon Bedrock AgentCore. A2A is younger and less proven in production than MCP, but its governance and adoption are moving agent-to-agent communication beyond the confines of a single platform.MCP 涵盖了应用程序与其工具之间的边界。Agent2Agent 协议（A2A）则解决了下一个边界：智能体如何在不同厂商之间发现彼此并进行通信。该协议于2026年4月达到 v1.0 版本，拥有超过150家支持机构，支持用于可验证身份的智能体卡片（Agent Cards），提供五种语言的 SDK，并在 Microsoft Copilot Studio、Azure AI Foundry 和 Amazon Bedrock AgentCore 中实现通用可用。A2A 比 MCP 更年轻，在生产环境中的验证也较少，但其治理和采纳进程正在将智能体间的通信推向单一平台的局限之外。
The emerging stack extends beyond those two protocols. AGENTS.md, OpenAI’s convention for giving coding agents repository-level instructions, joined MCP as a founding project of the Agentic AI Foundation. The OpenTelemetry generative AI semantic conventions are developing a shared vocabulary for traces and metrics from model and tool calls, though that work has yet to reach stable status. Connection, cooperation, instruction, and telemetry are beginning to acquire common interfaces.新兴的技术栈不仅限于这两个协议。OpenAI 用于向编码智能体提供仓库级指令的约定 AGENTS.md，已作为智能体 AI 基金会的创始项目加入 MCP。OpenTelemetry 的生成式 AI 语义约定正在为模型和工具调用的追踪与指标开发共享词汇，尽管这项工作尚未达到稳定状态。连接、协作、指令和遥测技术正开始获得通用接口。
For an engineering organization, the immediate consequence is reuse. An MCP server for an internal ticketing system can serve every compatible IDE, chat application, and agent. Models and hosts will keep changing; the interface contract, server implementation, schemas, and authorization wiring can endure. The integration becomes an asset shared across applications. Language servers followed the same path as editors came and went around them. Agent integrations deserve the same treatment as libraries and services, with owners, versions, tests, and upgrade policies.对于工程组织而言，最直接的影响是复用。一个用于内部工单系统的 MCP 服务器可以服务于所有兼容的 IDE、聊天应用程序和智能体。模型和宿主会不断更迭，但接口契约、服务器实现、架构和授权连接可以保持不变。集成工作成为跨应用程序共享的资产。语言服务器遵循了同样的路径，即使编辑器在它们周围不断更迭。智能体集成应当像库和服务一样得到同等对待，配备所有者、版本号、测试和升级策略。
Reuse also concentrates attention on a common security boundary. Custom integrations tend to receive separate reviews, when they receive them at all. A shared protocol creates a recognizable seam where teams can specify identity, permissions, data flow, and audit behavior, then apply those controls across many tools and hosts. The MCP authorization specification builds that seam from established IETF work, including OAuth 2.1, protected resource metadata, authorization server metadata, and resource indicators. It requires Proof Key for Code Exchange (PKCE) to protect authorization codes from interception. MCP servers must also reject tokens issued for another audience and must not forward them downstream. The value comes from familiarity: Teams can draw on years of OAuth deployment experience instead of rediscovering its failure modes inside a new protocol.复用也将注意力集中在共同的安全边界上。定制集成往往需要单独审查，甚至根本没有审查。共享协议创建了一个可识别的接缝，团队可以在此明确身份、权限、数据流和审计行为，然后将这些控制措施应用于众多工具和宿主。MCP 授权规范基于既有的 IETF 工作构建了这一接缝，包括 OAuth 2.1、受保护资源元数据、授权服务器元数据和资源指示符。它要求使用代码交换证明密钥（PKCE）来防止授权码被拦截。MCP 服务器还必须拒绝为其他受众签发的令牌，且不得将其转发至下游。其价值在于熟悉感：团队可以利用多年的 OAuth 部署经验，而不必在新的协议中重新发现其失效模式。
The spec is equally useful when it states what metadata cannot prove. Tools can carry behavioral annotations describing them as read-only, destructive, idempotent, or open-world. Those terms give hosts a vocabulary for policy. The tools specification still requires clients to treat annotations as untrusted unless they come from a trusted server. Self-description can inform a security decision; it cannot establish the trust on which that decision rests.当规范明确指出元数据无法证明什么时，它同样有用。工具可以携带行为注释，将其描述为只读、破坏性、幂等或开放世界。这些术语为策略提供了词汇表。工具规范仍然要求客户端将注释视为不可信，除非它们来自受信任的服务器。自描述可以为安全决策提供信息，但不能建立决策所依赖的信任。
Once servers share an interface, they also become discoverable. The MCP Registry is an open catalog and API for public servers, designed to feed downstream marketplaces and private catalogs. Its role resembles npm or PyPI as a discovery mechanism, with an important difference: It stores standardized server metadata and leaves package distribution elsewhere. The registry remains in preview, with possible breaking changes and no durability guarantee.一旦服务器共享接口，它们也就变得可被发现。MCP 注册中心（MCP Registry）是一个面向公共服务器的开放目录和 API，旨在为下游市场和私有目录提供数据。它的角色类似于 npm 或 PyPI 这种发现机制，但有一个重要区别：它存储标准化的服务器元数据，而将包分发留给其他渠道。该注册中心目前仍处于预览阶段，可能存在破坏性变更，且不保证持久性。
Discovery brings familiar supply-chain risks to components with unusually powerful access. Typosquatting, abandoned packages, malicious updates, and uncertain provenance now concern software that may hold live credentials and act on production systems. The registry provides namespace verification and moderation, and its downstream model allows organizations to build curated catalogs. An internal subregistry or allowlist is therefore a sensible first control. The standard interface makes that curation practical across multiple hosts.发现机制为具有强大访问权限的组件带来了熟悉的供应链风险。拼写抢注（Typosquatting）、废弃包、恶意更新和来源不明等问题，现在困扰着那些可能持有实时凭据并在生产系统上运行的软件。注册中心提供了命名空间验证和审核，其下游模型允许组织构建精选目录。因此，内部子注册中心或白名单是合理的初步控制手段。标准接口使得这种精选工作在多个宿主之间变得切实可行。
The same contract improves testing. MCP tools declare a JSON Schema for their inputs and may declare one for structured outputs. Under the current tools specification, servers that declare an output schema must return conforming structured results, and clients should validate them. Teams can test a server without putting a model in the loop, mock it with recorded or synthetic behavior, and contract-test both sides as they would a REST or gRPC boundary.同样的契约也改善了测试。MCP 工具为其输入声明 JSON Schema，并可能为结构化输出声明一个。根据当前的工具规范，声明输出模式的服务器必须返回符合结构的正确结果，客户端应对其进行验证。团队可以在不将模型纳入循环的情况下测试服务器，使用记录或合成行为进行模拟，并像处理 REST 或 gRPC 边界一样对双方进行契约测试。
This separates two kinds of uncertainty that agent evaluations often mix together. Protocol tests can determine whether an integration exchanged valid messages and enforced its contract. Model evaluation can focus on whether the agent chose the right tool and interpreted the result well. OpenTelemetry’s emerging conventions extend this approach to runtime evidence by giving systems a common language for tool calls. Teams will still have to absorb changes as those conventions mature.这区分了智能体评估中经常混淆的两种不确定性。协议测试可以确定集成是否交换了有效消息并执行了契约。模型评估则可以专注于智能体是否选择了正确的工具并正确解读了结果。OpenTelemetry 的新兴约定通过为系统提供工具调用的通用语言，将这种方法扩展到了运行时证据。随着这些约定的成熟，团队仍需适应随之而来的变化。
These benefits stop at the edge of what the interfaces describe. A schema captures the shape of a tool’s arguments, while its meaning still lives largely in a free-form description that a model must interpret. A schema cannot tell an agent when a tool is appropriate, how its effects interact with other tools, or whether two similarly named operations have equivalent semantics. Portability makes a server available across hosts; behavior can still vary across models and contexts.这些优势仅限于接口所描述的边界内。Schema 捕捉了工具参数的形式，而其含义在很大程度上仍存在于模型必须解读的自由文本描述中。Schema 无法告诉智能体何时使用工具是合适的，其影响如何与其他工具交互，或者两个名称相似的操作是否具有等效的语义。可移植性使服务器可在不同宿主间使用，但行为在不同模型和上下文中仍可能存在差异。
The semantic gap leads to a trust gap. MCP can carry a server’s claims, and an A2A Agent Card can carry a digital signature, but a signature only ties a statement to an identity. Engineering organizations still need a basis for deciding which identities, publishers, code, and claims deserve authority. The protocol can carry that decision through a system. It does not make the decision for the organization.语义鸿沟导致了信任鸿沟。MCP 可以承载服务器的声明，A2A 智能体卡片可以携带数字签名，但签名只能将声明与身份绑定。工程组织仍然需要一个基础来决定哪些身份、发布者、代码和声明值得信任。协议可以在系统中传递这一决定，但它不会替组织做出决定。
Delegation makes the problem harder. MCP’s authorization model handles a client calling a server with an audience-bound token. Production systems increasingly involve an agent calling another agent, which calls a tool or a third agent. Preventing token passthrough closes a serious hole, yet each downstream hop still needs a narrower grant derived from the user’s original authority. No common mechanism defines how those rights should attenuate across an arbitrary chain. Platforms currently solve this locally or leave too much authority in place.授权委托让问题变得更加复杂。MCP 的授权模型处理的是客户端使用受众绑定令牌调用服务器的情况。生产系统越来越多地涉及一个智能体调用另一个智能体，进而调用工具或第三个智能体。防止令牌透传弥补了一个严重漏洞，但每一次下游跳跃仍然需要从用户最初的授权中派生出更窄的权限。目前还没有通用的机制来定义这些权利应如何在任意链条中衰减。平台目前是在本地解决这个问题，或者留下了过多的授权。
All of this work is unfolding on young infrastructure. The registry is in preview, the telemetry conventions are unstable, and MCP has produced five dated protocol revisions in less than two years. Revision is how standards mature, so teams should version-pin, keep protocol code behind thin internal adapters, and budget for migrations. Some abstractions will prove wrong because the standards and the underlying practice are developing at the same time.所有这些工作都在年轻的基础设施上展开。注册中心处于预览阶段，遥测约定尚不稳定，MCP 在不到两年内已经发布了五个版本。修订是标准成熟的方式，因此团队应该锁定版本，将协议代码置于轻量级内部适配器之后，并为迁移做好预算。一些抽象可能会被证明是错误的，因为标准和底层实践是在同步发展的。
A sensible response begins with ownership and containment. Each internal server needs a durable owner, and its protocol surface should be treated as an architecture decision. Schema validation, conformance tests, and protocol mocks put that seam under contract. Third-party servers belong behind an allowlist or private catalog, with provenance requirements and corroboration for their annotations. An internal abstraction around the emerging telemetry vocabulary can limit exposure to draft revisions.合理的应对措施始于所有权和隔离。每个内部服务器都需要一个明确的负责人，其协议接口应被视为一项架构决策。模式验证、一致性测试和协议模拟将该接缝纳入契约管理。第三方服务器应置于白名单或私有目录之后，并对其注释进行来源要求和佐证。围绕新兴遥测词汇的内部抽象可以限制对草案修订的暴露。
Organizations with a large stake in agents should also participate in the standards work. The Agentic AI Foundation and the A2A project are young enough that engineering teams outside the founding companies can still influence what becomes portable, observable, and enforceable. The rules written now will become assumptions embedded in future products.在智能体领域投入巨大的组织也应参与标准制定工作。智能体 AI 基金会和 A2A 项目还很年轻，创始公司之外的工程团队仍能影响哪些内容变得可移植、可观察和可执行。现在编写的规则将成为未来产品中嵌入的假设。
Model improvements will continue to generate the headlines. Standards determine whether those models can participate in an ecosystem. Ethernet mattered because it became an interface that many implementers could agree on, and language servers mattered because editors and language tools no longer needed to be designed in pairs. Agent systems now have their first interfaces that competitors jointly govern and independently implement. Engineering teams should build on them with two expectations: The interfaces are likely to last, and their current forms will change.模型改进将继续占据头条。标准决定了这些模型是否能参与生态系统。以太网之所以重要，是因为它成为了许多实现者都能达成一致的接口；语言服务器之所以重要，是因为编辑器和语言工具不再需要成对设计。智能体系统现在拥有了首批由竞争对手共同治理并独立实现的接口。工程团队在构建这些接口时应抱有两个预期：这些接口很可能会持续存在，且其当前形式将会发生变化。
