MCP Certification Arrives: What the New MCPA Exam Signals for MCP Security and Governance
On September 14, 2026 the Agentic AI Foundation (AAIF) launched the Model Context Protocol Associate (MCPA), the first official MCP certification and a vendor-neutral credential. It is a 120-minute, online, proctored, multiple-choice exam across five domains, aligned with MCP specification 2026-07-28. Interactions & Execution (26%) and Security & Governance (24%) make up half of it. For teams running agents, that weighting shows where the work sits: what happens around a tool call, who approved it, and what record it leaves.
What AAIF announced on September 14
The MCPA targets engineers, platform teams and AI governance professionals. AAIF is the Linux Foundation's home for MCP, A2A, AGENTS.md, goose, agentgateway and Agent Router. It tests hosts, clients, servers and tools, message flow, trust boundaries, permissions and risk controls. Enrollment is open, with a 20% discount for attendees of AGNTCon + MCPCon Europe in Amsterdam and registrants of AGNTCon + MCPCon North America, October 22–23, 2026, San Jose (AAIF press release, Sep 14, 2026).
MCPA exam domains and weights
The MCPA exam has five domains; execution and governance carry 50% of the score. The right-hand column is our reading for teams operating agents.
| Domain | Weight | Question it raises for your stack |
|---|---|---|
| MCP Fundamentals | 16% | One shared vocabulary for hosts, clients, servers? |
| Architecture & Components | 14% | Which servers run in production, and who owns them? |
| Interactions & Execution | 26% | Where does a run keep state between tool calls? |
| Security & Governance | 24% | Which calls need a human decision, and where is it recorded? |
| Use Cases & Ecosystem | 20% | Which process moves onto MCP first? |
Why an MCP certification now: the adoption numbers
AAIF ties the launch to MCP's growth and positions the MCPA as a shared benchmark for employers. The figures from the announcement:
- Tier 1 MCP SDK downloads are approaching half a billion a month.
- The TypeScript and Python SDKs have both passed 1 billion total downloads.
- MCP tool calls from ChatGPT users reached 98 times their January level by August.
- Resend passed one million MCP calls in a single month.
On September 15 the Gates Foundation became AAIF's first philanthropic member (AAIF press release, Sep 15, 2026); A2A joined the foundation on August 27 (A2A announcement). We compare the two protocols in MCP vs A2A: what each standardizes and the execution gap.
What MCP leaves to your execution layer
MCP standardizes the tool connection; approval, run state and the audit trail across tools stay with your team. The specification says hosts must obtain explicit user consent before invoking any tool, and that MCP cannot enforce these principles at the protocol level, so implementors build the consent and authorization flows (MCP specification 2026-07-28).
Agintent works on that layer as a protocol concept with a working reference orchestrator. One request becomes one versioned envelope; its run contract has an explicit waiting_input state for human review with approve, reject and resume transitions, and artifacts and memory stay on the same object. Details: the intent envelope, explained and human-in-the-loop agent execution.
What to do this quarter
A readiness checklist built on the MCPA domains:
- List every MCP server your agents reach and mark the tools that write, send, pay or delete.
- For each write tool, define the approval rule and the reason code a paused run should show.
- Keep the approver, the decision and the reviewed artifact on the same record as the request.
- Pilot the pattern on one process first; our use cases show typical starting points.
FAQ
What is the MCPA certification?
The Model Context Protocol Associate (MCPA) is the first official MCP certification, a vendor-neutral credential from the Agentic AI Foundation launched on September 14, 2026. It validates how well a candidate understands and applies the protocol.
How long is the MCPA exam and what does it cover?
120 minutes, online, proctored, multiple choice, aligned with MCP spec 2026-07-28. It covers five domains; Interactions & Execution (26%) and Security & Governance (24%) weigh the most.
Does MCP handle human approval of tool calls?
The MCP specification requires hosts to obtain explicit user consent before invoking any tool and states that the protocol cannot enforce this itself. The approval flow and its record belong to the application or an execution layer around MCP.