Model Context Protocol (MCP)

TL;DR — MCP (Model Context Protocol) is a standard way for AI apps like Claude or ChatGPT to plug into outside tools and data — your files, a database, a search API — so an AI agent can actually use them. Its creators call it “a USB-C port for AI applications.” It’s not the same as llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it. (a static file that just lists pages), and it isn’t a Google ranking factor.

What MCP is, in one sentence

Model Context Protocol is an open protocol for connecting AI applications to external data sources and tools. Evidence for this claim Model Context Protocol is an open protocol for connecting AI applications to external systems. Scope: The MCP specification and official documentation; individual host and server implementations vary. Confidence: high · Verified: 2026-07-14 MCP: Introduction Its architecture defines hosts, clients, and servers plus server primitives including resources, prompts, and tools. Evidence for this claim MCP defines host, client, and server roles and server primitives including resources, prompts, and tools. Scope: Current MCP architecture; negotiated capabilities determine which features a connection supports. Confidence: high · Verified: 2026-07-14 MCP: Architecture

The Model Context Protocol is an open standard that lets AI applications connect to external tools and data sources through one common plug, instead of a custom integration for every combination. Anthropic — the company behind Claude — created it and released it as open source in November 2024.

The analogy everyone uses (including Anthropic) is a USB-C port for AI. Before USB-C, every device had its own connector. MCP is trying to be the one connector that any AI app and any tool or data source can agree on.

Why it matters right now

You’re probably hearing “MCP” because of the surge in AI agents — AI that doesn’t just answer a question but goes and does something: looks up your calendar, queries a database, files a ticket, checks a product’s live price. For an agent to do any of that, it needs a reliable way to reach the outside world. That’s what MCP provides.

Ahrefs, in its guide to agentic SEO, puts the point bluntly:

“MCP (Model Context Protocol) is how your agent reaches the outside world. It’s the standard plug that connects an agent to data and actions.”

and, memorably:

“Without MCPs, your agent is just a chatbot with opinions.”

The part people get confused about

MCP is not llmsA large language model (LLM) is a deep-learning model trained on massive text corpora to predict the next token and generate human-like text. LLMs use the transformer architecture and power AI search features like Google's AI Overviews (Gemini) and Bing Copilot (GPT-4)..txt. This site has a separate llms.txt explainerllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it., and the short version is: llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it. is a static file you put on your site that lists pages for an AI to read — a one-way pointer. MCP is a live protocol that lets an AI agent call functions, pull data, and take actions in real time. One is a map; the other is a set of controls.

And setting up an MCP server won’t boost your rankings. There’s no evidence MCP is a search or AI-answer ranking signal. What it can do is make your data and tools usable by agents performing tasks. That’s a real and growing use case — but it’s a different thing from showing up in search results or getting cited in an AI answer.

Want the architecture, the history, the security caveats, and where this touches SEO workflows? Switch to the Advanced tab.

TL;DR — MCP is an open, JSON-RPC-based protocol (Anthropic, open-sourced Nov 25, 2024) for connecting AI applications to external tools and data. It runs host → client → server, with servers exposing tools, resources, and prompts. It solves the N×M integration problem (turn it into N+M). It’s a protocol, not “function calling,” and not llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it.. OpenAI adopted it in March 2025; Anthropic donated it to the Linux Foundation’s Agentic AI Foundation in Dec 2025. There is no Google/Bing “MCP for SEO” guidance — exposing an MCP server serves agents doing tasks, not search visibility — and it carries real, unresolved prompt-injection and tool-poisoning risks.

The problem MCP solves

MCP standardizes a communication boundary between an AI host and external capabilities; it does not make connected data trustworthy or authorize every action automatically. Evidence for this claim Model Context Protocol is an open protocol for connecting AI applications to external systems. Scope: The MCP specification and official documentation; individual host and server implementations vary. Confidence: high · Verified: 2026-07-14 MCP: Introduction The specification assigns distinct roles to hosts, clients, and servers and documents capability negotiation. Evidence for this claim MCP defines host, client, and server roles and server primitives including resources, prompts, and tools. Scope: Current MCP architecture; negotiated capabilities determine which features a connection supports. Confidence: high · Verified: 2026-07-14 MCP: Architecture

Before MCP, wiring an AI application to a data source meant a bespoke integration for that specific pairing. Connect N AI apps to M tools and you’re on the hook for roughly N×M custom integrations — the combinatorics get ugly fast. MCP standardizes the interface so each app implements MCP once and each tool implements MCP once, collapsing the problem to N+M. It’s the same argument that made protocols like HTTP or the Language Server Protocol worth having.

At launch, the Block CTO framed the “why” this way:

“Open technologies like the Model Context Protocol are the bridges that connect AI to real-world applications, ensuring innovation is accessible, transparent, and rooted in collaboration.”

The architecture: host, client, server

MCP runs on a host–client–server model. Three roles:

• Host — the AI application itself (Claude Desktop, Claude Code, an IDE-based coding agent, a chat app with connectors).
• Client — the host spins up one MCP client per server it connects to. The client manages that one connection.
• Server — a program that exposes some capability or data. One server might wrap your file system; another your database; another a web-search API.

The host can connect to many servers at once, each through its own client. Local servers typically communicate over STDIO (standard input/output, one client); remote servers typically use Streamable HTTP (many clients), with OAuth as the recommended way to authenticate. Under the hood it’s JSON-RPC 2.0, and the protocol is stateful: there’s an initialization/capability-negotiation handshake, discovery methods that let a client ask a server what it offers, and notifications when things change. Streamable HTTP servers issue a session ID to track that state — the current spec is explicit that a session ID is for state, not identity: it must not be used as a stand-in for authenticating the caller.

The three server primitives

Each MCP server exposes its capabilities through three core building blocks:

• Tools — executable functions the agent can call to do something (run a query, send a message, fetch a live price).
• Resources — contextual data the agent can read (a file, a database record, an API response).
• Prompts — reusable interaction templates that package a common workflow.

Each primitive type has its own discovery, read, and execution semantics, and they aren’t interchangeable — a client lists what’s available with a */list call (tools/list, resources/list, prompts/list), then reads or invokes a specific one by name (tools/call to run a tool; a get/read style call for a resource or prompt). Treating every server capability as “a tool” glosses over that a resource is meant to be read, not executed, and a prompt is a template to insert, not an action to run.

There are also client-side primitives (for example sampling, elicitation, and logging) that let a server ask the client’s model or user for input, plus a newer experimental Tasks primitive for durable, long-running operations — but tools/resources/prompts are the server-side ones to know first.

MCP vs llms.txt vs function calling vs WebMCP

These four get conflated constantly. Keeping them apart is most of the value of this page:

Two distinctions worth spelling out:

• MCP is not “function calling.” Function calling is a model-level feature: a model is told which functions exist and picks one to call. MCP is the cross-vendor protocol that standardizes how tools and data get discovered, described, and invoked across many apps and many servers, independent of any single model. MCP servers often implement their tools using function-calling-style definitions — but MCP is the interoperability layer on top, not a synonym.
• WebMCP is not MCP. WebMCP is a separate, browser-native proposal that uses MCP-like concepts to expose a specific website’s functionality — add-to-cart, checkout, form submission — to an agent already in the browser. MCP is the broader, older protocol for connecting AI applications to external tools and data in general. For the identity/discovery side of this same landscape, see the llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it. article, plus entity SEOEntity SEO is the practice of helping search engines and AI systems clearly identify, classify, and trust the entities you represent — your brand, your people, your products — rather than just matching keyword strings. The goal is to be an unambiguous, well-corroborated entity in machine knowledge systems so AI can cite you with confidence. and schema markup for AISchema markup (structured data) is machine-readable code — usually JSON-LD — that labels what your content means using the schema.org vocabulary. For AI search it's infrastructure for entity disambiguation, not a direct citation lever: controlled studies found no meaningful uplift in AI citations from adding it..

A brief timeline

• November 25, 2024 — Anthropic open-sources MCP, with early partners and pre-built servers (Google Drive, Slack, GitHub, Git, Postgres, and more).
• March 26, 2025 — OpenAI announces it’s adopting MCP, saying support was arriving in its Agents SDK with the ChatGPT desktop app and Responses API to follow. Google DeepMind also moved to support it. That’s the moment MCP stopped being an Anthropic thing and became a de facto industry standard.
• December 9, 2025 — Anthropic donates MCP to the newly formed Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded with Block and OpenAI, with other major vendors as supporting members — explicitly to keep the protocol open and vendor-neutral rather than owned by any one company.

Is MCP a Google or Bing ranking factor?

No — and it’s important to say so plainly. Google has not issued formal Search Central guidance on MCP. There is no “MCP for SEO” document from Google Search Central, no Search Off the Record episode, no Search Essentials page addressing it. What exists is a general Google Cloud explainer aimed at developers, which is a vendor overview, not a ranking-signal document.

On the Microsoft side, the picture is similar: Microsoft has adopted MCP heavily as a platform vendor — it documents MCP on Windows, maintains a catalog of MCP servers, and partnered with Anthropic on the official C# SDK. But that’s infrastructure support, not Bing WebmasterMicrosoft's free portal for monitoring and improving how a site appears in Bing search — the peer to Google Search Console, plus IndexNow instant indexing, richer backlink data, and keyword volumes. Because Bing's index also feeds Microsoft Copilot, it doubles as a window into AI-search visibility. Guidelines telling you MCP affects search rankings. It doesn’t.

The closest thing to an official Google signal in SEO-adjacent territory is WebMCP (again: not MCP itself). Commenting in a discussion about llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it., Google’s John Mueller said he prefers the WebMCP approach because it has concrete, well-scoped goals:

“I like the WebMCP approach, as well as the commerce integrations – they have clear goals & processes: ‘Given the agent is already on your site, how can it properly do task X?’ (for example, determine the final price of a product, including all fees & potential discounts).”

So: the honest answer to “does MCP help my SEO?” is that exposing an MCP server can make your data and actions usable by agents doing tasks, which is a genuinely different value proposition from search or AI-answer visibility. Don’t file it under ranking factors.

How MCP shows up in SEO and marketing workflows

Where MCP does touch our world today is on the practitioner side — letting AI agents query the tools we already use:

• Ahrefs has an MCP connector, letting an AI agent pull Ahrefs data directly rather than you exporting and pasting it. Ahrefs’ own agentic SEO guide walks through this (that piece is by Mateusz Makosiewicz, reviewed by Ryan Law — not me).
• Google Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results. MCP servers exist in the ecosystem so an agent can read your GSC performance data as part of a workflow.
• A Bing Search MCP server exposes Bing web/news/image search as tools an agent can call.

The mental model: MCP is the “should we build an API?” question of the agent era. Exposing your data through an MCP server is about making it actionable by agents, not about ranking. If your audience increasingly works through agents, that usability may matter — but treat it as a distribution/integration decision, not an SEO one. This is the “capability/action” bet, where llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it. is the “identity/discovery” bet.

Security: real, unresolved risks

Don’t assume MCP is safe just because it’s an open standard from a reputable company. The moment you give an AI agent tools that can act and expose it to untrusted input, you’ve opened an attack surface. Simon Willison — one of the more credible independent voices on LLM tooling and security — laid it out:

“Any time you mix together tools that can perform actions on the user’s behalf with exposure to potentially untrusted input you’re effectively allowing attackers to make those tools do whatever they want.”

He’s careful to note this isn’t a flaw unique to MCP:

“These vulnerabilities are not inherent to the MCP protocol itself—they’re present any time we provide tools to an LLM that can potentially be exposed to untrusted inputs.”

Documented risks in the MCP context include prompt injection, tool poisoning (malicious instructions hidden in a tool’s description), and “rug pulls” (a tool that changes behavior after you’ve installed it). As of this writing these are live issues, not solved ones — so if you’re deploying or connecting MCP servers, treat them like any other untrusted integration: least privilege, human approval for consequential actions, and care about which servers you trust.

The MCP spec’s own security-best-practices guidance (current as of the 2025-11-25 revision) names five specific attack categories server and client builders are expected to defend against — worth knowing even if you’re just evaluating a third-party server, not building one:

• Confused deputy — a proxy MCP server using a single static OAuth client ID can be tricked into skipping per-user consent for a third-party API it fronts.
• TokenA token is the smallest unit of text (or image/audio/video) an LLM processes — roughly 4 characters, or about ¾ of an English word. A context window is the maximum number of tokens (input plus output) a model can hold at once, like its short-term memory. passthrough — a server that accepts a client’s token and forwards it to a downstream API unchecked breaks audit trails and security controls; the spec says servers must not do this.
• Server-side request forgery (SSRF) — a malicious server can point OAuth discovery at internal IPs or cloud metadata endpoints, tricking a client into fetching them.
• Session hijacking — a guessable or non-random session ID lets an attacker impersonate a client; the spec requires servers to use sessions only for state, never as a substitute for authentication.
• Local server compromise — a locally installed MCP server runs with the user’s own privileges, so a malicious or compromised one can read files, exfiltrate credentials, or run arbitrary commands; the mitigation is sandboxing, least-privilege launch configuration, and reviewing what a “one-click install” actually runs before approving it.

None of this is solved by “it’s an open standard” or by turning on OAuth. Protocol compliance, using an official SDK, enabling authorization, or sandboxing a server each close off specific attack paths — none of them, alone or together, guarantees an integration is safe, that a model will use a tool correctly, or that a server will be widely adopted. Authorization support itself is optional and version-scoped in the spec, not a blanket security guarantee.

Common myths

1. “MCP and llms.txt are the same / they compete.” No — llms.txt is a static, one-way file; MCP is a live, bidirectional protocol. Different problems.
2. “MCP is just function calling rebranded.” No — function calling is a model capability; MCP is a cross-vendor protocol layered on top of that idea.
3. “MCP is a Google or OpenAI standard.” No — Anthropic created it (Nov 2024). OpenAI and Google DeepMind adopted it later; it’s now governed by the vendor- neutral Agentic AI Foundation.
4. “Setting up an MCP server boosts my rankings.” No evidence supports that. It serves agents doing tasks, not search visibility.
5. “MCP replaces APIs.” No — MCP servers are usually thin wrappers exposing existing APIs and data in a standard way for AI consumption.
6. “It’s from Anthropic, so it’s secure by default.” No — real prompt-injection and tool-poisoning risks exist and aren’t fully solved.

Where this sits in the AI-search picture

MCP is the action layer of the agentic stack. Around it, the discovery and identity layers — llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it., entity SEOEntity SEO is the practice of helping search engines and AI systems clearly identify, classify, and trust the entities you represent — your brand, your people, your products — rather than just matching keyword strings. The goal is to be an unambiguous, well-corroborated entity in machine knowledge systems so AI can cite you with confidence., schema markup for AISchema markup (structured data) is machine-readable code — usually JSON-LD — that labels what your content means using the schema.org vocabulary. For AI search it's infrastructure for entity disambiguation, not a direct citation lever: controlled studies found no meaningful uplift in AI citations from adding it., and how agentic searchAgentic search is an AI system that autonomously plans, runs, and synthesizes a multi-step research or browsing task — dozens to hundreds of searches and real page reads — instead of returning one answer to a single query. All agentic search is AI search; not all AI search is agentic. actually plans and runs tasks — round out the map. Keep the layers distinct and the hype gets a lot easier to reason about.

AI summary

A condensed take on the Advanced version:

• MCP = an open protocol (Anthropic, open-sourced Nov 25, 2024) for connecting AI applications to external tools and data. “A USB-C port for AI applications.”
• Architecture: host → client → server. The host runs one client per server; servers expose tools (actions), resources (data), and prompts (templates). Built on JSON-RPC 2.0; stateful.
• The problem it solves: turns an N×M custom-integration mess into N+M.
• Not llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it. (a static, one-way file listing pages) and not function calling (a model capability). MCP is the cross-vendor interoperability protocol. WebMCP is a separate, browser-scoped proposal for exposing a website’s own in-page actions to an agent.
• Timeline: launched Nov 2024 → OpenAI adopted it Mar 26, 2025 → Anthropic donated it to the Linux Foundation’s Agentic AI Foundation Dec 9, 2025.
• Not a ranking factor: Google has issued no Search Central guidance on MCP; Bing/Microsoft support it as a platform, not as SEO guidance. Exposing an MCP server serves agents doing tasks, not search visibility.
• Security: real, unresolved prompt-injection, tool-poisoning, and rug-pull risks — not “safe by default.” The spec itself names confused-deputy, tokenA token is the smallest unit of text (or image/audio/video) an LLM processes — roughly 4 characters, or about ¾ of an English word. A context window is the maximum number of tokens (input plus output) a model can hold at once, like its short-term memory. passthrough, SSRF, session hijacking, and local-server compromise as attack categories; OAuth/authorization is optional and version-scoped, not a blanket safety guarantee.

Official documentation

Primary-source documentation on MCP.

Anthropic / MCP project

• Introducing the Model Context Protocol — the original November 2024 announcement: the N×M problem, launch partners, and the USB-C framing.
• Donating the Model Context Protocol and establishing the Agentic AI Foundation — the December 2025 governance move to the Linux Foundation.
• What is the Model Context Protocol (MCP)? — the official getting-started intro.
• Architecture overview — host/client/server, primitives, data and transport layers, JSON-RPC mechanics.
• MCP Specification (2025-11-25) — the formal spec.

Google

• What is Model Context Protocol (MCP)? A guide — Google Cloud’s general developer explainer (not a Search-ranking document).

Microsoft / Bing

• Model Context Protocol (MCP) on Windows overview — the Windows On-Device Agent Registry.
• microsoft/mcp — Microsoft’s catalog of MCP server implementations.
• Microsoft partners with Anthropic to create the official C# SDK — the official C# SDK.

Quotes from the source

On-the-record statements. Deep links jump to the quoted passage where the source page supports it.

Anthropic / launch partners — why MCP

• “Open technologies like the Model Context Protocol are the bridges that connect AI to real-world applications, ensuring innovation is accessible, transparent, and rooted in collaboration.” — Dhanji R. Prasanna, CTO, Block, in Anthropic’s launch announcement. Jump to quote

OpenAI — adopting a rival’s standard

• On March 26, 2025, OpenAI’s Sam Altman announced OpenAI would add MCP support across its products, starting with the Agents SDK and with ChatGPT desktop and the Responses API to follow. TechCrunch coverage (Paraphrased from Altman’s public post as reported by TechCrunch — I’m not quoting his exact wording verbatim here.)

Google — WebMCP (not MCP itself)

• “I like the WebMCP approach, as well as the commerce integrations – they have clear goals & processes: ‘Given the agent is already on your site, how can it properly do task X?’ (for example, determine the final price of a product, including all fees & potential discounts).” — John Mueller, Google Search Advocate. Jump to quote Relayed via Roger Montti’s Search Engine Journal write-up; note WebMCP is a browser-scoped proposal distinct from MCP.

Security — an independent voice

• “Any time you mix together tools that can perform actions on the user’s behalf with exposure to potentially untrusted input you’re effectively allowing attackers to make those tools do whatever they want.” and “These vulnerabilities are not inherent to the MCP protocol itself—they’re present any time we provide tools to an LLMA large language model (LLM) is a deep-learning model trained on massive text corpora to predict the next token and generate human-like text. LLMs use the transformer architecture and power AI search features like Google's AI Overviews (Gemini) and Bing Copilot (GPT-4). that can potentially be exposed to untrusted inputs.” — Simon Willison. Jump to quote

For an SEO audience

• “MCP (Model Context Protocol) is how your agent reaches the outside world. It’s the standard plug that connects an agent to data and actions.” and “Without MCPs, your agent is just a chatbot with opinions.” — Ahrefs Blog, “What Is Agentic SEO?” (Mateusz Makosiewicz, rev. Ryan Law). Read the piece

MCP server review checklist

• Define the user task and why MCP is preferable to a static page, API call, or built-in function integration.
• Classify each capability correctly as a tool, resource, or prompt.
• Give every capability a narrow, factual description with explicit inputs and outputs.
• Apply least privilege to credentials, filesystem access, network access, and write operations.
• Require confirmation before destructive, financial, publishing, or external messaging actions.
• Treat server-provided descriptions and retrieved content as untrusted input; test prompt-injection and tool-poisoning paths.
• Validate arguments server-side instead of trusting model-generated parameters.
• Log tool selection, sanitized inputs, outcomes, and errors without storing secrets or unnecessary personal data.
• Test failure, timeout, cancellation, and partial-result behavior.
• Document ownership, versioning, revocation, and an incident-disable path.

MCP at a glance — cheat sheet

The four things people confuse

The architecture in three words: host → client → server. One client per server; a host can hold many.

The three server primitives

• Tools — executable actions (do something).
• Resources — contextual data (read something).
• Prompts — reusable interaction templates.

Fast facts

• Created by Anthropic, open-sourced Nov 25, 2024.
• Built on JSON-RPC 2.0; stateful, with capability negotiation.
• Local servers: STDIO. Remote servers: Streamable HTTP (+ OAuth).
• OpenAI adopted it Mar 26, 2025; Google DeepMind too.
• Governed by the Agentic AI Foundation (Linux Foundation) since Dec 9, 2025.
• No Google/Bing “MCP for SEO” guidance exists.
• Real, unresolved prompt-injection / tool-poisoning risks — not safe by default.

The mental models

1. Map vs. controls. llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it. is a map — a static list of pages pointing an AI at what to read. MCP is a set of controls — a live interface an agent uses to call functions and take actions. If you only remember one thing, remember which is which.

2. Capability vs. protocol. Function calling is a capability baked into a model. MCP is a protocol that standardizes how that capability reaches many tools across many apps. MCP servers often use function-calling-style definitions internally, but the protocol is the interoperability layer on top — don’t equate the two.

3. N×M → N+M. Every point-to-point AI-to-tool integration is one of N×M. Implement MCP once on each side and you’re at N+M. That collapse is the reason the standard exists.

4. Agent capability ≠ search visibility. Exposing an MCP server makes your data usable by agents doing tasks. That is a distribution/integration decision, not a ranking one. Filing MCP under “SEO tactics that boost rankings” is a category error.

5. Tools + untrusted input = attack surface. The instant an agent can both act and read untrusted input, prompt injection is on the table. Treat any MCP server you connect like an untrusted integration: least privilege, human approval for consequential actions, and scrutiny of which servers you trust.

MCP mistakes to avoid

Calling MCP a ranking factor

MCP makes data and actions available to compatible agents at runtime. It does not make the server a Google or Bing ranking signal.

Giving a server broad credentials by default

An agent does not need unrestricted access to complete a narrow task. Scope tokensA token is the smallest unit of text (or image/audio/video) an LLM processes — roughly 4 characters, or about ¾ of an English word. A context window is the maximum number of tokens (input plus output) a model can hold at once, like its short-term memory., resources, hosts, and write permissions to the minimum required.

Trusting tool descriptions as safe instructions

Descriptions and retrieved content can be poisoned or contain prompt injection. Pin trusted servers, review capability changes, and keep policy enforcement outside model text.

Hiding consequential writes behind vague tool names

Names such as “manage” or “process” obscure impact. State whether a tool reads, creates, updates, publishes, charges, or sends, and require confirmation where needed.

Exposing an MCP server when a document would do

Static public information does not automatically need an executable integration. Use MCP when runtime discovery, retrieval, or action creates real user value.

Resources worth your time

My related writing

• The Beginner’s Guide to Technical SEO — where AI-search topics fit into the fundamentals.
• Meet the New Web Crawlers: AI Bots Are Closing in on Search Engine Bots — the broader shift toward AI systems fetching and using the web, which MCP is a piece of.

My speaking

• How Search Works (SlideShare) — my walkthrough of crawlingCrawling is how search engines use automated bots (like Googlebot and Bingbot) to discover URLs and download pages. A page has to be crawlable to be indexed, but crawling on its own isn't a ranking factor., renderingTurning HTML, CSS, and JavaScript into the final visual page and DOM., indexingStoring a crawled page in the search index so it can appear in results. Crawled is not the same as indexed — Google selects what to keep, and indexing isn't guaranteed., and ranking, for context on how the search side works alongside the agent side. (My standing disclaimer applies: “This is my understanding of systems… not going to be 100% complete or accurate.”)

From around the industry

• Introducing the Model Context Protocol (Anthropic) — the original announcement and the N×M framing.
• Model Context Protocol — official docs and the architecture overview — the canonical technical reference.
• OpenAI adopts rival Anthropic’s standard for connecting AI models to data (TechCrunch) — the March 2025 adoption moment.
• How Model Context Protocol is shaping the future of AI and search marketing (Search Engine Land, Constance Chen) — the main SEO-industry MCP piece (predates the WebMCP commentary and the AAIF donation).
• What Is Agentic SEO? (Ahrefs, Mateusz Makosiewicz, rev. Ryan Law) — MCP as one ingredient of agentic SEO, plus Ahrefs’ own MCP connector.
• Model Context Protocol has prompt injection security problems (Simon Willison) — the security caveats, from a credible independent voice.
• 11 Emerging AI Security Risks with MCP (Checkmarx Zero) — a fuller catalog of the risk surface.
• Model Context Protocol (Wikipedia) — neutral overview with the timeline and the AAIF donation.

Test yourself: Model Context Protocol (MCP)

Five quick questions on what MCP is and isn’t. Pick an answer for each, then check.

Model Context Protocol (MCP)

MCP is an open protocol, created and open-sourced by Anthropic in November 2024, that standardizes how AI applications connect to external tools and data at runtime. It runs on a host–client–server architecture and lets agents call functions, read data, and take actions — the opposite of a static file like llms.txt.

Related: llms.txt, Agentic Search

Model Context Protocol (MCP)

The Model Context Protocol (MCP) is an open standard for connecting AI applications — assistants, IDE-based coding agents, and autonomous agents — to external data sources, tools, and workflows. Anthropic created it and open-sourced it on November 25, 2024. Instead of building a custom integration between every AI app and every data source, developers implement MCP once on each side; its creators describe it as “a USB-C port for AI applications.”

MCP uses a host–client–server architecture. The host is the AI application; it spins up a dedicated client for each server it connects to, and each server exposes context and capabilities through three core primitives: tools (executable functions the agent can call), resources (contextual data like files or database records), and prompts (reusable interaction templates). It’s built on JSON-RPC 2.0 and is stateful, with a capability-negotiation handshake and discovery methods.

MCP is not the same thing as llms.txt. llms.txtllms.txt is a proposed (not adopted) Markdown file at /llms.txt that gives AI systems a curated map of a site's most important pages. Proposed by Jeremy Howard in 2024, it's read mostly by coding agents like Claude Code — not search crawlers — and Google ignores it. is a static, advisory Markdown file that points an AI system at pages to read — a one-way pointer. MCP is a live, bidirectional, runtime protocol that lets an agent actually do things. In December 2025, Anthropic donated MCP to the Agentic AI Foundation, a Linux Foundation project, to keep it vendor-neutral. For SEOs, MCP matters because it’s how agents reach and act on data — not because it’s a documented ranking or citation signal.

Related: llms.txt, Agentic Search

Changelog