MCP Is Now a Certifiable Skill: The MCPA Exam and What Its 24% Security Weighting Signals

Key takeaways

• The Model Context Protocol Associate (MCPA) launched September 14, 2026 — the first official MCP credential, a 120-minute proctored exam with five domains and Security & Governance weighted second-heaviest at 24% — announced by the Agentic AI Foundation under The Linux Foundation.
• MCP's Tier 1 SDKs are approaching half a billion monthly downloads, with the TypeScript and Python SDKs each past 1 billion total downloads — scale that made a shared skills benchmark necessary, per AAIF.
• ChatGPT users' MCP tool calls reached 98 times their January level by August, and Resend passed 1 million MCP calls in a single month — protocol usage is climbing as fast as downloads.
• Enterprise-Managed Authorization (EMA), a stable MCP authorization extension built on the IETF ID-JAG draft, landed in Keycloak as an experimental feature in version 26.7 — the first open-source implementation of centralized MCP access policy.
• The certification is aligned with the 2026-07-28 MCP specification, the same stateless protocol that B2B production deployments run — a credential, an authorization extension, and a spec are now three layers of the same professional discipline.

MCP integration work just became something a hiring manager can verify. On September 14, 2026, the Agentic AI Foundation — the Linux Foundation home for MCP, A2A, AGENTS.md, goose, agentgateway, and Agent Router — opened enrollment for the Model Context Protocol Associate (MCPA), the first official certification for the protocol. A 120-minute, proctored, multiple-choice exam now separates "has read the MCP docs" from "can reason about hosts, clients, servers, trust boundaries, and risk controls." The protocol's own numbers explain why a credential arrived when it did: monthly downloads across Tier 1 SDKs are approaching half a billion, TypeScript and Python SDKs have each crossed 1 billion total downloads, and ChatGPT users' MCP tool calls hit 98 times their January level by August. This article covers what the exam tests, why the domain weighting matters more than the credential itself, and what changes for teams hiring for — and operating — MCP-connected agent systems.

What the MCPA actually certifies

The MCPA is a 120-minute, online, proctored, multiple-choice exam organized across five domains, aligned with the 2026-07-28 specification — the same stateless final spec covered in our B2B deployment analysis. The domain weights:

Domain	Weight
Interactions & Execution	26%
Security & Governance	24%
Use Cases & Ecosystem	20%
MCP Fundamentals	16%
Architecture & Components	14%

Two structural facts stand out. First, the two heaviest domains — Interactions & Execution (26%) and Security & Governance (24%) — account for half the exam. Candidates are tested on trust boundaries, permissions, and risk controls, not just protocol primitives. Second, the weight distribution treats security as a first-class discipline rather than a final-chapter afterword. David Soria Parra, MCP's co-creator and lead maintainer, framed the goal in the launch announcement: certification will "formalize a shared understanding of how the protocol works." Angie Jones, AAIF's VP of Developer Experience, added the employer-side framing — a "shared benchmark for assessing the skills required for modern software development."

For context on scale: this is the first certification launched by AAIF. The foundation could have credentialed any of its six founding projects. It chose MCP first.

The 24% signal: security is now a hiring criterion, not a patch

The Security & Governance domain carrying the second-heaviest weight is the datapoint this article exists to name. When a standards body puts 24% of its first credential on a subject, it is telling the market what competent protocol operation includes. MCP's security record in 2026 made that weighting inevitable: Trend Micro found 1,467 publicly accessible MCP servers with zero authentication, the July CVE wave put three CVEs in the official MCP Python SDK itself, and CISA added CVE-2026-59822 — a LiteLLM MCP endpoint authentication bypass — to the Known Exploited Vulnerabilities catalog with a September 16 remediation deadline. Our MCP Security Hardening Checklist organizes the controls behind that record into twelve verifiable layers; the MCPA now certifies that practitioners are expected to know them.

For a Head of Engineering building an agent program, the practical consequence is concrete: the exam provides a screening instrument. The question "has your team taken the MCPA" replaces "how well do you know MCP" — and the answer is checkable, because the credential is proctored and vendor-neutral. The same logic applies to vendor and contractor evaluation: a partner selling MCP integration services can now point at a credential that verifies its people understand permission scoping and trust boundaries at the level the spec requires.

The domain weights and the adoption datapoints behind the credential, in one view:

The other half of professionalization: who holds the keys

A credential certifies people. Enterprises also need the organizational layer — who authorizes an agent to touch an MCP server, and how that access is revoked when the employee who approved it changes roles. The protocol layer answered that on September 9, when the AAIF published an implementation of Enterprise-Managed Authorization in Keycloak. EMA is a stable MCP authorization extension built on ID-JAG — Identity Assertion JWT Authorization Grant, an IETF draft — that makes the enterprise identity provider the policy gateway for MCP access.

The problem it solves is concrete. In the standard MCP authorization model, each server can maintain its own OAuth silo. AAIF's post names the three enterprise failure modes: administrative overhead from tracking per-server agent access, "OAuth Sprawl" from users independently authorizing tools, and consent fatigue — users blindly approving access requests, which the post calls "a serious systemic security risk." ID-JAG inverts the flow: the identity provider issues a signed assertion for a specific MCP authorization server, the client presents it, and the server validates and issues a scoped access token. Authorization policy can be evaluated at both ends. Keycloak's PR #46048 (consumer support) merged as an experimental feature in Keycloak 26.7; PR #49998 (issuer support) is under review.

This matters for the connector work we publish on — NetSuite, HubSpot, Shopify — because per-server OAuth is exactly what a multi-system agent deployment produces at scale. A distributor connecting an RFQ quoting agent to NetSuite, BigCommerce, and three supplier catalogs does not want three independent authorization silos and an approval prompt per tool. EMA gives the IdP a role it already plays for human access, extended to agents — access follows role and group membership through onboarding, transfer, and offboarding, without per-server prompts.

Reading the adoption curve honestly

The usage stats in the launch announcement are large, and large numbers deserve context. TypeScript and Python SDKs each passing 1 billion total downloads measures cumulative adoption since launch — a growth signal, not a production-depth signal. The sharper datapoints are the behavioral ones: ChatGPT users' MCP tool calls reached 98× their January level by August, and Resend processed 1 million MCP calls in a single month. Tool-call volume is closer to production reality than download counts, because it reflects agents actually invoking tools rather than developers installing SDKs.

The honest caveat: adoption at this speed is also why the security domain is weighted at 24%. The same frictionlessness that produced a billion downloads produced 1,467 unauthenticated exposed servers. The MCPA certifies awareness of that gap; it does not close it. The hardening checklist and governed-module patterns remain the operational layer between a certified practitioner and a safe deployment. A credential on the wall plus an unhardened server in production is the exact failure mode the 24% domain exists to prevent.

What a mid-market team should do with this

For a 100–2,000-employee B2B company running a lean platform group, the MCPA changes three concrete practices:

1. Hiring: add MCP familiarity — MCPA or equivalent demonstrated experience — to the requirements for whoever owns agent integrations. The credential gives interviewers a shared vocabulary and a verifiable baseline for the 2026-07-28 spec's stateless architecture.
2. Authorization architecture: if agents are connecting to more than one MCP server, evaluate EMA now. Keycloak's implementation is experimental, but the EMA extension itself is marked stable, and Claude's enterprise-managed auth shows major platforms converging on the same pattern. Per-server OAuth silos do not survive contact with a second integration.
3. Security weighting as a review standard: use the exam's domain list as a scoping checklist. If your MCP deployment has no answer for the trust boundaries, permissions, and risk controls that make up 24% of the credential, that gap — not the protocol plumbing — is where an auditor will start.

None of this requires replacing your agent framework. It requires treating MCP expertise as a named skill with a verifiable standard, and treating MCP authorization as an enterprise concern rather than a per-tool prompt.

Related reading

• MCP Tutorial: From Zero to Production Server with the 2026-07-28 Specification — the hands-on companion: the exam certifies protocol knowledge; this tutorial walks the production build it should map to
• MCP Security Hardening Checklist: 1,467 Exposed Servers and the Controls That Close Them — the twelve controls behind the 24% Security & Governance domain, organized across five layers
• MCP 2026-07-28: What the Stateless Protocol Means for B2B Agent Deployments — the specification the MCPA is aligned with, and what statelessness changes for audit and scaling

Representative build vignette

A 500-employee industrial distributor hired a platform engineer to connect an RFQ quoting agent to NetSuite and BigCommerce through two MCP modules. The first integration took five weeks — per-server OAuth flows built separately, an approval prompt per tool, no central revocation when the engineer's role changed. When a second quoting agent needed the same systems, the team deployed the EMA pattern with their existing identity provider: one signed assertion flow, MCP access scoped to role and group membership, and a single revocation point that applied to every server the agent could reach. The second integration took nine days, and the security review that had stalled the first deployment took one meeting — the authorization policy was readable in the IdP, not reconstructed from three OAuth dashboards.

Request a scoped build

One-week discovery. You get a system inventory, workflow map, and fixed scope — whether or not you build with us.