Blog

The new roadmap, developed by Core Maintainers with community working groups, organizes protocol work into five priority areas: agentic messaging primitives, HTTP-native transport unification and hardening, agent identity and enterprise-ready security, improved primitives, and improved SDK developer experience. It follows the 2026-07-28 specification release, which removed protocol-level sessions and the initialization handshake, reworked Tasks into an official extension, and added authorization improvements including CIMD and stable Enterprise-Managed Authorization.

The 2026-07-28 MCP specification replaces the initialize/initialized handshake and Mcp-Session-Id header with a stateless request/response core where each request carries protocol version, client identity, and capabilities in _meta, plus new Mcp-Method and Mcp-Name routing headers. Server-to-client requests move to Multi Round-Trip Requests, list responses gain ttlMs and cacheScope hints, DCR is formally deprecated in favor of CIMD, and Roots, Sampling, and Logging are deprecated with a twelve-month window.

The mcp gem's first stable release implements the 2025-06-18 and 2025-11-25 spec revisions and passes 100% of server and client conformance scenarios, with the public API now stable so breaking changes ship only in major releases. It includes full server and client support for tools, prompts, resources, OAuth with dynamic client registration and PKCE, plus stdio and Streamable HTTP transports that mount directly in Rails routes.

Python v2 and TypeScript v2 lead four Tier 1 beta SDKs (with Go and C# betas) implementing the 2026-07-28 release candidate, whose stateless core removes the initialize handshake and protocol-level session so servers can scale behind a round-robin load balancer. The release also adds Multi Round-Trip Requests, routable transport headers, authorization hardening, and standard error codes, while roots, sampling, and logging get advisory deprecation annotations.

The Enterprise-Managed Authorization extension is now stable, letting organizations control MCP server access centrally through their identity provider: clients obtain an Identity Assertion JWT Authorization Grant during single sign-on and exchange it for server access tokens, so users connect all authorized servers on first login instead of per-server OAuth. Okta is the first supported identity provider, with Anthropic, Visual Studio Code, and servers including Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase supporting it.

The 2026-07-28 release candidate revises MCP to a stateless protocol layer: the initialize/initialized handshake and Mcp-Session-Id header are removed, with protocol version and client info traveling in _meta on every request, so remote servers can run behind a plain round-robin load balancer without sticky sessions or a shared session store. It also adds extensions for server-rendered UIs via MCP Apps and long-running work via Tasks, authorization closer to OAuth/OIDC, and a formal deprecation policy; the final spec ships July 28, 2026 with breaking changes.

Clare Liguori, a Senior Principal Engineer at AWS working on Kiro and the Strands Agents SDK, joins the Core Maintainer group, and Den Delimarsky steps up from Core Maintainer to Lead Maintainer alongside the existing lead. Delimarsky's work spans MCP authorization and security, including the authorization specification, RFC 8707 Resource Indicators, and the 2025-11-25 specification release.

The post explains that MCP is structured in three layers — core specification, projects like the Registry and Inspector, and extensions — and that extensions are strictly additive patterns built on existing MCP mechanisms, so a client or server that doesn't recognize one skips it during negotiation and the baseline protocol keeps working. MCP Apps, the first official extension, went GA in January 2026 with support in ChatGPT, Claude, VS Code, and Goose, and OAuth Client Credentials and Enterprise-Managed Authorization auth extensions are live.

The 2026 MCP roadmap drops release milestones in favor of four priority areas driven by Working Groups: transport evolution and scalability, agent communication, governance maturation, and enterprise readiness. SEPs aligned with these areas get expedited review, and no additional official transports will be added this cycle.

MCP Apps are live as the first official MCP extension, letting tools declare a _meta.ui.resourceUri that points to a ui:// resource the host renders in a sandboxed iframe with bidirectional JSON-RPC over postMessage. ChatGPT, Claude, Goose, and VS Code have shipped support, and the @modelcontextprotocol/ext-apps package provides an App class for building them.

Inna Harper and Basil Hosmer are stepping away from the Core Maintainer team, while Peter Alexander (Anthropic), Caitie McCaffrey (Microsoft), and Kurtis Van Gent (Google Cloud Databases) join it. The post also previews active SEPs including a DPoP extension for authentication, multi-turn SSE for transport, and Server Cards for discovery.

The Transport Working Group proposes replacing the initialize handshake with per-request state and a discovery mechanism, moving sessions to the data model layer, and adding Server Cards at a standardized /.well-known/mcp.json endpoint. The roadmap also covers chat-style elicitation and sampling responses, dedicated subscription streams with TTLs and ETags, and exposing JSON-RPC routing info via HTTP paths or headers.

Specification Enhancement Proposals are now created as pull requests to the seps/ directory instead of GitHub issues, so the PR number becomes the SEP number and git tracks every revision. Sponsors now update the Status field in the SEP markdown file, with existing issue-based SEPs welcome to keep their current workflow or migrate.

The Model Context Protocol marks its first anniversary alongside a new specification version, with the MCP Registry growing to close to two thousand server entries since September, a 407% increase. The post also covers the governance structure, working and interest groups, and partner commentary from GitHub, OpenAI, and Block.

The MCP Apps Extension (SEP-1865) standardizes UI resources declared with a ui:// URI scheme, referenced in tool metadata via ui/resourceUri, and communicating with hosts over existing MCP JSON-RPC via postMessage. The initial spec supports only text/html rendered in sandboxed iframes, deferring external URLs, remote DOM, and native widgets to future iterations.

The MCP Bundle format, a ZIP archive containing a local MCP server and a manifest.json describing it, is now part of the Model Context Protocol project along with its specification, CLI tooling, and reference implementation. A bundle built for one MCP-compatible client should work in any other that implements the spec, letting developers distribute once across clients including Claude desktop, Claude Code, and MCP for Windows.

MCP publishes a guide on server instructions, which let a server inject guidance the LLM should always read for how to use the server, independent of tools, prompts, or messages. The post argues they belong in the system prompt rather than repeated across tool descriptions, and walks through a GitHub MCP server example that adds workflow-aware instructions for PR reviews based on enabled toolsets.

The next Model Context Protocol specification ships November 25, with the release candidate shifted from November 11 to November 14, 2025. Priority areas are asynchronous operations, statelessness and scalability, server identity via .well-known URLs, official extensions, and SDK support tiering.

The Model Context Protocol project launched an official registry at registry.modelcontextprotocol.io, an open catalog and API where server maintainers publish self-reported information that public and private sub-registries build on. The preview carries no data durability guarantees and warns that breaking changes may occur before general availability.

The official PHP SDK for the Model Context Protocol is generally available, built with the PHP Foundation and Symfony, letting PHP developers build MCP servers that expose tools, prompts, and resources to AI applications. Client support is planned to follow.