Model Context Protocol update adds stateless metadata and security fixes
MCP maintainers released the project's largest update, changing metadata handling and tightening authorization for AI agents.
By Wei-Lin Zhao · AI Correspondent
· 3 min read
The Model Context Protocol update released July 28 replaces a key metadata workflow and adds security changes for AI applications that connect to outside systems. The project’s developers described the release as the largest since MCP was introduced, a meaningful claim for a protocol that has become part of the plumbing for agentic AI products.
MCP was open-sourced by Anthropic PBC in November 2024 and later donated to the Agentic AI Foundation, an industry group operating under the Linux Foundation. The foundation is backed by Anthropic, OpenAI Group PBC and other large technology companies, according to the project’s public materials.
The protocol gives AI applications a standard way to call external systems. An agent can use it to retrieve a database record, make a change to an e-commerce catalog or perform more involved tasks that depend on tools outside the model itself. That makes MCP relevant to vendors building agents, infrastructure teams exposing internal systems to models and security teams trying to control what those agents can touch.
What changed in the Model Context Protocol update?
The main change is a redesign of how MCP handles metadata attached to requests. Metadata can include contextual details such as which version of MCP an application is using. Before this release, applications passed that information through a handshake process that added operational complexity.
The new version removes that handshake and uses what the maintainers call a stateless protocol core. Instead of relying on a separate metadata-management step, MCP now puts the metadata into the request itself.
That is a technical adjustment with practical consequences. MCP applications often interact with services spread across multiple servers. Under the old approach, the handshake could tie a request and its metadata to one server, creating a potential single point of failure. The maintainers said the change should make MCP-based systems easier to scale during traffic spikes and easier to recover after server outages.
Security changes target authorization errors
The release also updates MCP’s authorization system, which governs what outside systems an AI application may access. The project’s developers said the revised mechanism is less likely to trigger certain errors and is more resistant to OAuth mix-up attacks, a class of attack that can be used to steal login credentials.
For companies exposing internal tools to AI agents, that part of the update may matter as much as the metadata redesign. Agent frameworks are only useful in production if access control is predictable, auditable and difficult to bypass. The announcement did not quantify the reduction in risk or provide incident data tied to the prior implementation.
The maintainers also introduced an extension framework for adding capabilities to MCP beyond its core functions. The framework includes prebuilt extensions, including MCP Apps, which is intended to help manage long-running agent workflows, and EMA, a tool aimed at streamlining some cybersecurity tasks.
The update does not change the broader question facing MCP adopters: whether a common protocol can keep pace with the messy operational and security requirements of real agent deployments. For now, the project is tightening low-level mechanics that matter to infrastructure teams: how requests carry context, how services recover when servers fail and how authorization behaves when agents reach into external systems.
This story draws on original reporting from SiliconANGLE.
