Short answer: Anthropic donated the Model Context Protocol (MCP) to the Linux Foundation at the end of 2025, meaning it is no longer governed by a single vendor with its own commercial incentives, and that is the single biggest reason it is safe to build a long-term business integration on top of it in 2026.
Why "Who Governs the Protocol" Matters
Businesses that build an integration on a vendor-controlled standard take on a real risk: the vendor can change the rules, deprecate features, or shift priorities in a direction that serves their product roadmap over the ecosystem. That risk mattered for MCP specifically because it started as an Anthropic project. Moving it to the Linux Foundation, a neutral home that also stewards Kubernetes and other foundational infrastructure, removes that single-vendor risk.
What Changed in Practice
- Multi-vendor adoption accelerated. Google integrated MCP into Gemini, OpenAI adopted it across ChatGPT and its API, and Microsoft added support in Copilot and Azure OpenAI, all building on the same protocol rather than competing variants.
- Governance is now a foundation process, not a single company's roadmap decision, which means breaking changes go through a more deliberate, cross-vendor review rather than one team's release cycle.
- The protocol itself matured, with clearer expectations forming around rate limiting, authorization, error handling, and service discovery as more vendors contribute real-world usage back into the spec.
What This Means If You Are Deciding Whether to Build on MCP
A year ago, building a business-critical integration on MCP meant betting on one vendor's continued investment. Today it means betting on a protocol with the same kind of neutral governance and multi-vendor backing that made adopting something like Kubernetes or OpenAPI a safe long-term decision. That does not make MCP the right tool for every integration, but it removes "what if the vendor changes direction" as a reason to avoid it.
What It Does Not Solve
Vendor-neutral governance does not automatically make your specific MCP server well-designed, secure, or performant. That still depends on the implementation, the same way a project being open source does not make it bug-free. The protocol being safe to build on is a different question from your integration being built well.
We build MCP servers that expose real business systems safely to AI agents. See our API development services, or get in touch about connecting your tools to an AI agent.
Frequently Asked Questions
Who governs MCP now?
The Linux Foundation, after Anthropic donated the Model Context Protocol to it at the end of 2025. It is no longer controlled by a single vendor.
Is it safe to build a business integration on MCP in 2026?
Vendor-neutral governance removes the risk of a single company unilaterally changing direction on the protocol. Google, OpenAI, and Microsoft have all integrated MCP support into their major AI products on the same shared spec.
Does Linux Foundation governance mean any MCP server is secure and well-built?
No. The protocol being vendor-neutral is separate from whether a specific MCP implementation is well-designed and secure. That still depends on how it is built.
What changed for developers after the Linux Foundation handoff?
Clearer, more cross-vendor-reviewed expectations have formed around rate limiting, authorization, error handling, and discovery, as more vendors contribute production usage back into the spec.