Navigating the Hurdles: Where Does Model Context Protocol Fall Short Today?

Model Context Protocol (MCP) is an open standard that lets large language models (LLMs) interact with external tools and data sources through a single, standardized interface. Introduced by Anthropic in November 2024, MCP gives applications a common way to expose capabilities and context, which simplifies how teams build sophisticated AI agents and workflows. But the protocol is still young, and it has real gaps. Several of them are active areas of focus for ongoing development, and they shape how teams should approach MCP today.

The key shortcomings of MCP highlighted within this article include:

• Significant security concerns

• Limitations and standardization gaps

• Adoption and development challenges

While CData Connect AI does not resolve every challenge facing MCP development and adoption, we highlight how it mitigates some of these issues later on in the article.

Significant security concerns

MCP's main security concerns fall into three areas: malicious actor exploits, data exfiltration, and identity management. In the near-term, the protocol's current maturity level creates risks for organizations deploying MCP-based solutions without additional measures.

Malicious actors

The top malicious-actor threats to MCP are prompt injection, tool poisoning, and tool shadowing, each exploiting the protocol's ability to grant LLMs access to external systems:

• Prompt injection, where malicious instructions embedded in user inputs or tool descriptions could lead to unintended actions by the LLM.

• Tool poisoning, where attackers modify tool definitions, or rug pulls (like tool poisoning but occurs post-installation).

• Tool shadowing, where a malicious server creates a tool with the same name as a legitimate tool from another server to intercept calls.

Ultimately, these types of attacks can compromise data or redirect actions, which is why organizations need to be discerning when it comes to the MCP tooling their teams are using.

Data exfiltration

Data exfiltration is a serious MCP risk because compromised tools can extract sensitive data and poorly implemented servers can enable remote code execution. Critics note that MCP itself lacks inherent security enforcement mechanisms, relying heavily on external implementations for authentication and authorization, which were not initially well-defined within the protocol. MCP servers requesting excessive permissions can also escalate the risk if a server is breached. The consensus is that while MCP offers considerable capabilities, strong security practices are essential and not built into the protocol itself.

Identity management

MCP's identity management challenge is attribution: it is hard to tell whether a request came from the end user, the AI agent, or a shared system account, and the protocol does not yet define this clearly. This ambiguity poses risks for organizations deploying MCP-based solutions, particularly concerning auditing, accountability, and access control. Without a standardized way to attribute actions, it can be challenging to track who or what initiated a specific operation.

Limitations and core design challenges within the protocol

Beyond security, MCP has three core design limitations: transport and scalability, context scaling, and error handling.

Transport and scalability

MCP's transport layer has evolved quickly. The protocol's early HTTP+SSE transport was stateful, which created significant complexities when integrating with inherently stateless REST APIs and required developers to manage state externally. The March 2025 specification replaced HTTP+SSE with Streamable HTTP, a more proxy-friendly model that resolves much of this. Even so, remote deployments still have to manage sessions at scale, and the protocol's Transport Working Group continued refining stateless, enterprise-scale operation through late 2025. Persistent connections consume server resources and can complicate load balancing and horizontal scaling, so scalability remains an area of ongoing work.

Context scaling

There are also concerns that exposing many MCP tools and their definitions to an LLM can consume significant tokens in its context window. This can directly impact an LLM's performance, slow down responses and potentially hinder its ability to maintain focus and reason effectively over extended or complex interactions. Large context windows are resource-intensive, and managing their consumption across many concurrent connections presents a notable challenge for LLM efficiency.

Error-handling

MCP now defines both protocol errors and tool execution errors; the latter is designed to give models actionable feedback they can self-correct from. Even so, implementations still vary in how consistently and comprehensively they surface those errors to AI clients, which can lead to uneven behavior across servers. Broader operational concerns, such as tool governance and lifecycle management across an organization's MCP ecosystem, also extend well beyond error handling itself. Trust and reliability remain considerations too, given the fallibility of LLMs and the potentially significant consequences of giving them control over critical systems via MCP.

Adoption and ecosystem maturity

MCP adoption has grown rapidly, reaching roughly 97 million monthly SDK downloads and more than 10,000 active servers in 2025, with support across platforms such as ChatGPT, Claude, Cursor, Gemini, and Microsoft Copilot. However, the ecosystem is still maturing, and many applications have yet to offer MCP servers, limiting integration options for some enterprise environments.

Documentation and community support also remain less mature than established integration approaches. As a result, teams may face a steeper learning curve and additional complexity when moving from traditional APIs to MCP.

Risk of obsolescence

The evolving nature of the standard introduces a degree of uncertainty. In the fast-paced AI space, there is always a possibility that the protocol could evolve so drastically that previous development is rendered obsolete, or that a completely new, competing protocol emerges and gains dominance, effectively overtaking MCP.

Vendor neutrality and governance

As an initiative originally led by Anthropic, MCP raised early concerns about vendor lock-in and questions about fragmentation. More recent developments have significantly mitigated these concerns. On December 9, 2025, the Linux Foundation announced the formation of the Agentic AI Foundation (AAIF), and Anthropic donated MCP to it as one of the foundation's inaugural projects, alongside goose and AGENTS.md.

Under the AAIF, MCP now operates within vendor-neutral, community-driven governance, with platinum members including Amazon Web Services, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI. This points toward a more collaborative and standardized future, with the protocol's direction no longer set by a single company.

Where CData Connect AI can (& can't) help

CData Connect AI is a managed platform that provides AI agents and LLMs with governed access to hundreds of data sources through MCP, covering widely adopted tools like Salesforce, Workday, and HubSpot, among many others. It does not address every limitation noted above, but it does mitigate several of the concerns raised, particularly around governance, standardization, and adoption.

Governance, access control, and audit logging

Some of the strongest reasons to use a managed platform are the identity and access controls that MCP itself leaves open. Connect AI applies governance to every request, while its connectors support enterprise authentication methods such as OAuth, SAML/SSO, API keys, and JWT, with TLS encrypted transport.

Connect AI also provides fine-grained access controls and audit logging. Requests can run using each user's credentials and inherit existing source permissions, while administrators can control access to specific tables, columns, and operations. Every request is logged for auditing and compliance. The platform is independently certified for SOC 2 Type II and ISO 27001, supports GDPR requirements, encrypts data in transit with TLS 1.2+, and does not store source data.

Limitations & standardization

Performance, reasoning, and token consumption across multiple MCP connections are challenges tied to the MCP standard and the LLMs using it. These are areas that will continue to evolve as the protocol and model providers mature.

While Connect AI cannot eliminate differences in how MCP implementations surface errors, its connector technology helps make them more consistent by presenting data from different sources as SQL compliant relational tables. When an LLM generates an invalid query, the connector can return a standard SQL error before the request reaches the source API. This gives the LLM a chance to correct the query, reducing unnecessary API calls and providing clearer error feedback.

Adoption & development

CData aims to address ecosystem fragmentation and integration complexity through CData Connect AI, a single managed platform covering our extensive portfolio of hundreds of supported data sources. Rather than installing and maintaining a separate server for each system, teams connect through one platform, with connection setup, authentication, and data modeling handled centrally. The same governance and access controls apply regardless of which source an agent queries from, and new sources join the same governed layer as coverage grows.

Finally, CData's model-agnostic approach should allay vendor lock-in concerns, and major players like Google and OpenAI have indicated support for MCP, suggesting growing adoption beyond a single vendor.

MCP's path forward

MCP enables AI models to interact dynamically with digital tools and data. While discussions around security, standardization, and ecosystem maturity are important, they highlight areas of active development and opportunity, and MCP's move into vendor-neutral governance has already steadied much of the ground. Some challenges remain inherent to the current state of MCP, but Connect AI helps mitigate key risks and ease adoption.

Key takeaways

• MCP is now openly governed under the Linux Foundation's AAIF, which lowers vendor lock-in risk.

• Its main open risks are security (prompt injection, tool poisoning, and data exfiltration) and identity attribution.

• Error handling is defined at the protocol level, but consistency still depends on each implementation.

• Adoption is broad, though ecosystem coverage and documentation are still maturing.

• A managed platform like Connect AI centralizes governance, access control, and audit logging across hundreds of sources.

Frequently asked questions

Connect your AI to governed enterprise data

Connect AI gives your LLMs governed, real-time access to the enterprise data they need to act. Explore how CData Connect AI can securely connect your LLMs to the data they need.