What happens when a chatbot gets a tool
For a long time a chatbot was a text machine with a good memory. It knew a lot and could do nothing. That no longer holds. In Claude and in ChatGPT you can now plug in outside services: a calendar, a ticketing system, a product database, an analysis tool. The user types a sentence, the assistant calls the service and carries on with what comes back.
The protocol behind it is called the Model Context Protocol, MCP for short. Anthropic put it in the open in November 2024, and the major providers carry it today. In Claude these connections are called custom connectors, available all the way down to the free plan according to the vendor’s own documentation. OpenAI documents how to build such a server for ChatGPT in its own developer docs.
For two years everything about AI and websites came down to one question: does the AI mention your business? Now a second one arrives. Can it book an appointment with you, pull a price, place an order?
The July revision throws out what used to be mandatory
MCP is not yet two years old and moves at a pace you do not normally see in infrastructure. The current specification revision is dated 28 July 2026; the one before it was 25 November 2025. Between those two revisions, three things every earlier implementation relied on were cut: the connection handshake, the session identifier and an entire transport. In their place, every server must now implement a call named server/discover.
Translated: anyone selling you a finished MCP integration in the summer of 2026 is selling you something that may look different by autumn. Build today if you have a reason to, but budget for the rework.
Nobody has settled how an assistant finds you
This is where it gets uncomfortable. Before an assistant can use your service, it has to find it. For that exact step there is still no agreed rule.
The official proposal has been sitting as a draft in the protocol’s repository since January 2026, number 2127, titled “MCP Server Cards”. It proposes a file at /.well-known/ai-catalog.json. The draft is open, not accepted, and the proposed path has already changed once during the discussion.
A look at the registration body completes the picture. IANA maintains the list of file paths below /.well-known/ that are officially assigned. On 19 August 2026 that list held 104 entries. Exactly one of them concerns AI agents: agent-card.json, permanently registered since August 2025, change controller the Linux Foundation. For MCP itself there is nothing. For the server card there is nothing.
So when you read somewhere that your website urgently needs an mcp.json, there is no standard behind that advice. There is one vendor’s house rule, and it may read differently tomorrow.
Two numbers the guides leave out
In April 2026 Cloudflare scanned the 200,000 most visited domains on the internet, looking for exactly these signals. The finding is in the report verbatim: MCP server cards and API catalogues together appear on fewer than 15 sites in the entire dataset.
Fifteen. Out of two hundred thousand.
The second number I measured myself. On 20 August 2026 I read out the official MCP registry in full, the directory where providers list their servers. It holds close to 24,000 current entries, a good half of them with an address reachable on the internet. Eight of those sit on an Austrian domain.
Not eight per cent. Eight.
The names tell you the stage things are at: a company-register lookup, a radio project, a handful of developer tools. No retailer, no law firm, no bank, no industrial company.
That is the honest state of play. Anyone telling you your competitors have had this for ages has not looked.
Online retail is the one place where this looks different
One group has the socket anyway, mostly without knowing: shops on the large commerce platforms. The systems ship the agent connection switched on.
I measured this on two shops. Both publish a file at /.well-known/ucp that tells an assistant cleanly which route to take for catalogue, cart and shipping rules. No effort by the merchant, no project, no invoice. The shop system decided.
If you run a shop like that, this is the most important line in this article: the socket may already be live on your side, and you should know what hangs off it.
Nine in ten audited servers required no authentication
Now the other side. At the end of July 2026 a research group actively tested what openly reachable MCP servers allow, rather than merely counting them. The study reports over 21,000 server instances detectable on the public internet. Of 414 servers audited dynamically, 91.8 per cent required no authentication at all. Across the confirmed servers, 687 tools could execute shell commands with no access control in front of them.
One detail from the same paper says even more about maturity: 41.6 per cent of the confirmed servers had vanished by the next measurement run three days later.
That does not make MCP unsafe. An open endpoint can be a deliberate choice, and the specification explicitly permits one. The difference is whether somebody made that call or whether it simply happened. If an agency puts such an endpoint in front of your business, the question about access control belongs in the same meeting as the question about the price.
What assistants actually read today
Here is the part I consider most important.
As long as there is no widely used socket, assistants work with what is already there: your page. Google describes this remarkably openly in its own developer documentation for WebMCP. An agent simulates mouse clicks and typing as if it were the human user, and it has to inspect each element to work out what that element is for. WebMCP itself, incidentally, is a proposal rather than a standard, and it has been running as an origin trial since Chrome 149.
An agent that has to inspect an element to understand it reads exactly what a screen reader reads. Labelled form fields. Buttons that say what they do. Headings in the right order. A table marked up as a table rather than shipped as an image.
Here is the pleasant part. The work that makes your website usable for AI agents is already on your list. Clean semantic HTML and accessibility. It is the dullest advice in the industry and, right now, the only kind with evidence behind it. Anyone who has made their site accessible over the past few years has already solved most of the agent question without reading a single protocol.
What I would do now
In order.
First, check what you already have. If your site runs on one of the large shop systems, the endpoint is probably there. Call /.well-known/ucp on your own domain. If JSON comes back instead of an error page, the socket is live.
Then the groundwork. Semantic markup, proper form labels, a correct heading structure, solid structured data. That works three ways at once: classic search, accessibility, agents.
Then the access question. Check whether your site lets through the bots that are supposed to cite you. That is a topic of its own, and it goes wrong regularly: plenty of businesses block the very bots they depend on.
A server of your own only when you have a service somebody actually wants to call. A calendar with open appointments. A price lookup. An availability query. A shipment status. For a website made of service pages and a contact form there is nothing to call, and an endpoint with nothing behind it adds attack surface and little else.
For my own analysis product I took that step in August 2026, because there is something to fetch: an assistant can start the website check directly and gets the findings back into the conversation. How that is built is described in the Scrutor case study.
Before investing in agent technology, find out where you stand
Most of the websites I look at lose their AI visibility to three or four very tangible things, and none of them is called MCP. A sober website assessment shows you what the AI services currently say about your business, where your site trips machines up, and which lever actually moves something in your case. After that you can decide whether a socket of your own makes any sense for you.
Frequently asked questions
What is MCP in one sentence?
An openly published protocol that lets AI assistants such as Claude or ChatGPT plug in outside services as tools and call them. Anthropic released it in November 2024; the current specification revision is dated 28 July 2026.
Does my website need an MCP server now?
In the vast majority of cases, no. An MCP server makes sense when you offer a service somebody wants to query or trigger: appointments, prices, availability, an analysis. A classic company website has nothing to offer there.
Should I publish an mcp.json or an agent card?
There is no officially registered path for MCP; the proposal is an open draft. The only assigned path is /.well-known/agent-card.json from the A2A protocol. Publishing a file with no running service behind it achieves nothing.
How many websites have this at all?
Very few. In April 2026 Cloudflare found fewer than 15 sites with a server card or API catalogue among the 200,000 most visited domains. In the official MCP registry, eight of nearly 24,000 current entries sat on an Austrian domain on 20 August 2026 (my own count).
What is the difference between MCP and WebMCP?
MCP connects an assistant to a service in the background, independently of the browser. WebMCP aims to offer tools inside the open web page, so an agent in the browser does not have to guess what a form does. WebMCP is a proposal in trial, not an agreed standard.
Is an open MCP endpoint a security problem?
It can be intentional; the specification allows endpoints without authentication. It becomes dangerous when the tools behind it can change or execute something. A study from July 2026 found no authentication at all on 91.8 per cent of the servers it audited dynamically, plus hundreds of tools with command execution and no access control.
What helps my website most with AI agents today?
Clean semantic HTML and accessibility. As long as no socket is widespread, agents read your page the way a person would operate it, and they trip over the same places a screen reader does.