Overview
- MCP maintainers published an experimental draft that defines uploads as client-handled and downloads as tool-provided URLs so file contents do not pass through the model.
- The draft builds on MCP’s extensions framework so implementations can opt in without changing the core protocol and developers can prototype the flow on test clients and servers today.
- Maintainers warn the spec does not itself guarantee control over final file destinations and limits on when MCP credentials are sent will not prevent a file from reaching a malicious endpoint.
- There is no formal reference implementation yet because maintainers expect details to change when vendors integrate third-party storage and export services.
- If adopted, the extension should replace many ad hoc developer workarounds and could simplify building production MCP apps, but it will leave hosts and implementers responsible for enforcing approved upload destinations and other safeguards.