AgentGrade

MCP — Model Context Protocol

Capability · MCP project (open) · Updated 2026-07-19

Status: Open specification with broad multi-vendor adoption; originated by Anthropic in late 2024 · Authoritative source

The protocol that turns a website into a callable tool: a JSON-RPC 2.0 server declares named, schema-described tools that any MCP-speaking agent can discover and invoke — the closest thing the agentic web has to a universal capability layer.

An MCP server exposes three things over JSON-RPC 2.0: an initialize handshake (protocol version, server identity, capabilities), a tools/list catalog of named tools with JSON-Schema inputs, and tools/call execution. An agent that has never seen your service can hold the entire conversation programmatically: connect, list, call.

Adoption is the protocol’s argument: Claude, Cursor, Windsurf and a growing set of agent runtimes speak it, and server registries list tens of thousands of endpoints. For discovery, sites publish a /.well-known/mcp.json manifest (a convention, not part of the spec — and not IANA-registered; see RFC 8615) that points at the real server, which usually lives on a subdomain like mcp.example.com.

The handshake

POST /mcp HTTP/1.1
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"initialize",
 "params":{"protocolVersion":"…","clientInfo":{"name":"agent"}}}

→ {"jsonrpc":"2.0","id":1,"result":{"serverInfo":{"name":"acme"},…}}

How AgentGrade checks it

The scanner probes your MCP endpoint end-to-end: follows /.well-known/mcp.json to the real server, completes the initialize handshake, lists tools, and checks CORS for browser-based agents. The MCP Server Tester runs the same sequence interactively. Scan your site to see where you stand.

Related

All standards

RFC 9421 · Web Bot Auth · RFC 8615 · MCP · A2A · x402 · WebMCP · llms.txt · RFC 9309 · RFC 9110 · Index