Model Context Protocol for Brands

TL;DR — Key takeaways

The Model Context Protocol is the de facto standard for connecting AI agents to enterprise tools — 78% of enterprise AI teams have at least one MCP-backed agent in production as of April 2026.
MCP is not an IT project: it determines whether AI shopping agents like Amazon Rufus, ChatGPT, and Perplexity can actually find and recommend your products.
43% of public MCP servers contain command injection vulnerabilities; tool poisoning attacks succeed 84.2% of the time when auto-approval is enabled — security governance is non-negotiable.
Brands with catalog attribute completeness above 85% are indexed by AI shopping agents at 3× the rate of those below 60% — Epinium internal data from brand catalog audits.
The Agentic Catalog Stack framework gives brand managers a three-layer model to sequence MCP readiness without leading the dev implementation themselves.

Picture your product catalog — years of careful work, rich attributes, certifications, multilingual descriptions, competitive pricing. Now picture an AI agent helping a procurement manager shortlist skincare suppliers. It queries dozens of context sources simultaneously, compares structured data, and returns a ranked list in three seconds. If your catalog isn’t reachable via the Model Context Protocol, your products simply don’t appear. Not ranked lower. Not penalized. Invisible.

That’s the commercial reality that every developer-focused MCP guide published in the last 18 months has missed entirely.

What the Model Context Protocol Actually Does

MCP was introduced by Anthropic in November 2024 as an open standard for how AI models exchange context with external data sources and tools. Think of it as USB-C for AI integrations: one standardized connector rather than dozens of custom cables.

The architecture has three roles. The host is the AI application — Claude, ChatGPT, a custom enterprise agent. The client manages the session between host and external services. The server — the part your organization controls — exposes capabilities: product data, inventory, CRM records, pricing, API actions. The model reads your server, reasons over it, responds.

What surprises me is how many enterprise guides treat MCP as if it were production-ready from day one. It wasn’t. As of early 2025, the protocol lacked standardized OAuth support, had no audit trail specification, and used authentication tied to static secrets — none of which passes enterprise security review. The 2026 roadmap published by Anthropic names these as priority fixes, which is a direct signal they weren’t solved before. What changed the trajectory was the coalition: by Q1 2026, OpenAI, Google DeepMind, Microsoft, and Cloudflare had adopted MCP natively, transforming it from Anthropic’s standard into the industry’s standard.

97 Million SDK Downloads — And the Number That Actually Matters

The headline adoption metrics are striking. MCP SDKs hit 97 million monthly downloads by April 2026. The public server registry expanded from 1,200 entries in Q1 2025 to over 9,400 by April 2026 — roughly 7× growth in 15 months, still tracking +18% month-over-month. According to CData’s 2026 State of AI Data Connectivity Report, 78% of enterprise AI teams have at least one MCP-backed agent running in production.

78%

of enterprise AI teams have at least one MCP-backed agent in production (April 2026)

Source: CData 2026 State of AI Data Connectivity

But here’s the number that should concern brand managers more than any SDK download count: 43% of public MCP servers contain command injection vulnerabilities, and Zuplo’s production readiness audit found that tool poisoning attacks — where hidden instructions in server metadata manipulate agent behavior — succeed at an 84.2% rate when auto-approval is enabled. Brands standing up MCP servers without security governance are building an attack surface between their live data and autonomous AI agents making real decisions at scale.

Rapid adoption almost always precedes a visible incident that resets the conversation. MCP won’t be different. The window to build properly is before that incident, not after.

Here’s the contrarian position worth defending: the most important MCP decision your brand will make in 2026 isn’t technical. It’s organizational — specifically, who owns it.

In a project with a cosmetics brand, we found excellent Amazon listing optimization and strong Google Shopping performance alongside zero visibility on Perplexity shopping results and ChatGPT product recommendations. When we traced the failure, it had nothing to do with content quality or pricing. The brand’s data existed in four siloed systems — ERP, PIM, Amazon Seller Central, and a legacy DAM — none of which spoke any form of MCP-compatible protocol. The CTO considered it an integration ticket. The CMO had never heard of MCP. No one owned the gap between them.

SAP’s storefront MCP server for Commerce Cloud, Adobe Commerce’s equivalent commitment, and Feedonomics’ Agentic Catalog Export product all signal the same structural shift: in agentic commerce, product content is operational infrastructure, not marketing copy. It either works at the protocol level or it doesn’t work at all.

Epinium data

In the brand catalog audits we run at Epinium before onboarding, those with product attribute completeness above 85% are indexed by AI shopping agents at a rate 3× higher than catalogs with completeness below 60% — even when both sets carry similar price positioning and comparable traditional search volume. The gap widens significantly as agent queries grow more specific and multi-attribute.

What we see at Epinium is that the brands moving fastest on MCP aren’t those with the best developers. They’re the ones where a senior commercial leader — a CMO or VP of Ecommerce — decided this was their problem to own, then brought IT in to execute.

MCP vs. Traditional API Integration: A Side-by-Side View

Factor	Traditional API Integration	Model Context Protocol
Integration target	One system at a time, custom per consumer	Any MCP-compatible AI agent, one implementation
Context sharing	Static, predefined payloads	Dynamic, agent-driven retrieval
Maintenance overhead	High — each consumer requires separate updates	Low — update server once, all agents benefit
AI agent compatibility	None natively — requires bespoke adapters	Native — designed for agent reasoning loops
Security model	Mature (OAuth 2.0, API keys, rate limiting)	Maturing — OAuth 2.1 landed Dec 2025; audit trails in progress
Commerce discovery	Not applicable — search-engine era standard	Critical — the interface between your catalog and AI shopping agents

Model Context Protocol in 2025-2026: What Actually Changed

OAuth 2.1 Authorization Landed in December 2025

The single largest blocker for enterprise adoption — standardized, auditable authorization — was resolved in the December 2025 spec update. MCP now supports OAuth 2.1, meaning enterprise identity providers can gate server access through the same SSO policies governing any other SaaS tool. Regulated industries (pharma, financial services, public sector) finally had a viable compliance path.

OpenAI, Google, Microsoft, and Cloudflare Joined Natively in Q1 2026

The protocol stopped being Anthropic’s property when OpenAI’s agents, Google Gemini, Microsoft Copilot Studio, and Cloudflare’s developer platform adopted MCP natively in Q1 2026. Your MCP server is now the interface to the AI assistants your customers are already using daily — not a future consideration, a present one.

SAP and Adobe Committed Production Storefront Servers

SAP Commerce Cloud’s storefront MCP server — planned for Q2 2026 — and Adobe Commerce’s equivalent commitment means tens of thousands of enterprise brands can expose catalog data to AI shopping agents without building custom infrastructure from scratch. The cost of MCP readiness dropped substantially for brands on major commerce platforms.

The Public Registry Hit 9,400+ Servers and Showed Security Debt

Rapid growth surfaced predictable technical debt. Nearly half of public MCP servers in Zuplo’s April 2026 audit carry exploitable flaws. This isn’t an argument against MCP — it’s an argument for treating security review as a prerequisite rather than an afterthought.

FREE SESSION

Is Your Catalog Ready for AI Agent Discovery?

We audit your product catalog MCP readiness and identify visibility gaps costing you agentic channel traffic — in 30 minutes, at no cost.

Book Your Audit → ✓ Free ✓ 30 min ✓ No pitch

The Agentic Catalog Stack: A Framework for Brand Managers

After working through this with several brands, the most useful thing I can offer isn’t a technical implementation checklist — your IT team already has those. What’s missing is a decision map for where commercial leadership should focus its attention.

The Agentic Catalog Stack has three layers, and the sequence matters.

Layer 1 — Context Layer. Everything an AI agent needs to reason confidently about your products: structured attributes, certifications, regional pricing, availability signals, comparison-ready specifications. Most brands are weakest here. Incomplete attributes create incomplete context; agents fill gaps with inference, producing recommendations you can’t audit or correct.

Layer 2 — Protocol Layer. The MCP server (or MCP-compatible API surface) that exposes your Context Layer to the outside world. Authentication, rate limiting, audit trails, scope controls. This is where IT leads. Skipping the governance work in favor of speed creates the attack surface Zuplo documented. Budget this properly before the launch date.

Layer 3 — Discovery Layer. The AI agents, shopping assistants, and autonomous procurement tools that query your Protocol Layer. You don’t directly control this layer, but you influence it entirely through the quality of Layers 1 and 2. Brands asking “how do I rank on Perplexity?” are solving the wrong problem — the answer lives in Layer 1.

For a deeper look at enterprise AI architecture decisions around protocols like MCP, our post on AI implementation strategy for enterprise brands covers the organizational framework. If you’re evaluating specific MCP server deployment options, our MCP server guide for brands covers the production decisions that matter.

Frequently Asked Questions About the Model Context Protocol

What is the Model Context Protocol in plain terms?

MCP is an open standard that defines how AI models and agents retrieve context from external systems — databases, APIs, product catalogs, CRM records — in a consistent, interoperable way. Instead of building a custom integration for each AI tool, you build one MCP server and any compatible AI agent can use it. Anthropic published the initial spec in November 2024; it’s now backed by OpenAI, Google, Microsoft, and Cloudflare.

Is MCP only relevant for technical teams?

This is the most common misconception in enterprise MCP discussions. The protocol is implemented by developers, but the decision of what to expose via MCP — product data, pricing, inventory, documentation — is a commercial and brand strategy decision. Brands treating MCP as a purely technical project tend to build servers that are functionally correct but commercially useless, because nobody mapped what agents actually need to reason about their products.

How does MCP affect product discovery by AI agents?

AI agents querying product information — for a consumer shopping assistant or a B2B procurement tool — pull structured context from MCP servers. If your products aren’t accessible via an MCP-compatible interface, those agents skip your catalog or return low-confidence results. Traditional SEO and feed optimization doesn’t transfer to agentic channels. A separate readiness effort is required.

What are the real security risks of deploying an MCP server?

Two categories matter most. First, command injection: malformed inputs causing your server to execute unintended operations on backend systems — present in 43% of public servers per Zuplo’s April 2026 audit. Second, tool poisoning: hidden instructions embedded in server metadata that manipulate agent behavior — data exfiltration, credential theft — succeeding 84.2% of the time with auto-approval enabled. Both require explicit mitigation in implementation, not just a post-launch review.

Does my brand need to build a custom MCP server?

Not necessarily. If you run SAP Commerce Cloud or Adobe Commerce, both have committed production MCP server implementations, giving you a path to catalog exposure without custom infrastructure. Feedonomics’ Agentic Catalog Export creates MCP-compatible data surfaces from existing feeds. Evaluate platform-native options before commissioning bespoke development — the build-vs-configure decision has real cost implications.

What is the difference between an MCP server and a REST API?

A REST API exposes data in response to predefined requests from human-operated applications. An MCP server exposes capabilities — data, tools, actions — in a format designed for AI agent reasoning loops, where the agent decides what to query, in what sequence, and how to combine results. REST APIs can be wrapped inside an MCP server, but the MCP layer adds the semantic structure agents need to operate autonomously without human-written queries for each retrieval.

What happens to existing API integrations when adopting MCP?

They don’t need to disappear. MCP servers typically sit as a layer above existing APIs, translating agent requests into calls your infrastructure already handles. The investment is in the MCP server layer — authentication, capability definitions, security controls — not in rebuilding upstream systems. For brands with mature REST APIs, MCP adoption is an additive project, not a migration.

How do I know if our catalog is ready for AI agent indexing?

Three indicators are diagnostic. First, attribute completeness: if more than 20% of SKUs are missing key comparison attributes (dimensions, certifications, compatibility specs), agents underperform even with MCP access. Second, cross-system consistency: agents pulling from inconsistent sources return inconsistent recommendations. Third, structured comparability: products described with narrative copy rather than structured attributes are harder for agents to rank confidently. An Epinium catalog audit typically surfaces all three in the first session.

Is MCP the same as the Agent-to-Agent (A2A) protocol?

No. MCP governs how an AI agent retrieves context from external resources — databases, APIs, tools. A2A governs how AI agents communicate with each other in multi-agent workflows. Enterprise agentic systems use both in practice: MCP for data and tool access, A2A for orchestration between specialized agents. SAP’s agentic commerce architecture supports both protocols alongside the Unified Commerce Protocol (UCP) for transaction flows.

What should a brand manager do this quarter regarding MCP?

Three high-signal actions. First, audit your catalog attribute completeness — you can’t know your agentic discovery exposure without knowing your completeness score. Second, identify which of your commerce platforms have committed MCP server support and get on their early access programs. Third, assign ownership: pick one senior commercial stakeholder who is accountable for MCP readiness and give them budget to bring IT in rather than waiting for IT to surface the topic. The gap between “we should do this” and “we own this” is where most brands stall.

The Model Context Protocol is not something you can monitor from a distance and adopt when it stabilizes. The adoption curve is already steep, the commercial stakes — catalog visibility across agentic discovery channels — are live today, and the brands building MCP readiness now are accumulating an infrastructure lead that compounds over time. The question is no longer whether to implement MCP. It’s whether you’re early enough for it to matter.

For brands ready to move from assessment to action, our Transform program starts with the catalog and protocol audit that maps where you stand today against where agentic commerce requires you to be.

TRANSFORM BY EPINIUM

Make Your Catalog Visible to Every AI Agent That Matters

Brand managers who went through Epinium’s catalog audit found their first agentic visibility gaps in the opening session. Book yours before your competitors do.

Book Free Audit →

Free · 30 min · No commitment