MCP Grows Up: The Spec That Makes AI Agents Real

AI agents face a significant challenge in acting on behalf of users due to the lack of a secure external authorization mechanism within the Model Context Protocol (MCP), which prevents them from connecting to real systems like Gmail or Slack. This limitation has stalled many enterprise AI projects, as secure OAuth token management is essential for these agents to interact with core systems while maintaining compliance. The introduction of URL Elicitation, developed by Arcade.dev in collaboration with Anthropic and the MCP community, addresses this issue by enabling a secure browser flow for user authentication, ensuring that tokens remain secure and do not interact with untrusted clients. This advancement transforms MCP from a demo tool into a deployable solution for enterprises, allowing AI agents to connect securely to external SaaS tools and facilitating innovation by providing a trustworthy standard for developers, startups, and open-source communities. With URL Elicitation, enterprises can now deploy AI agents with user-level permissions, centralized governance, and standards-based security, bridging the gap between proof-of-concept and production rollout.