Model Context Protocol update targets enterprise AI deployments

The latest Model Context Protocol update from the Agentic AI Foundation, part of the Linux Foundation, is aimed at making MCP easier to run inside large companies using existing cloud operations stacks. The 2026-07-28 specification revision changes how MCP servers scale, adds more predictable deprecation rules, and tightens authorization behavior for enterprise deployments.

MCP was open-sourced by Anthropic in November 2024 as a standard way for AI applications and agents to connect to data sources, tools and other applications. The protocol defines how content moves between clients and servers, a detail that becomes more consequential as companies try to move agentic systems from prototypes into production environments.

David Soria Parra, an Anthropic technical staff member and co-inventor of MCP, called the release MCP’s most significant since remote MCP launched more than a year ago. In a blog post, he said the revision reflects lessons from the past 18 months and is intended to support scalable MCP servers.

What changed in the Model Context Protocol update?

The central architectural change is the removal of MCP’s legacy stateful model. The revised protocol is closer to conventional HTTP services, where network requests do not need to carry session state forward across a continuing connection.

Caitie McCaffrey, a Microsoft software engineer and core MCP maintainer, wrote that large-scale MCP deployments previously required sticky routing or shared state to preserve session continuity. That added operational work even when the tools exposed through MCP were themselves stateless, she said.

With the new design, organizations can run MCP servers behind standard load balancers and use existing Kubernetes and DevOps tooling. That is a practical enterprise concession: buyers already have infrastructure for stateless services, and bespoke session handling is the kind of implementation detail that slows adoption across central platform teams.

The update also introduces a Specification Feature Lifecycle and Deprecation Policy. The policy gives implementers at least 12 months between a feature’s deprecation and its removal. The documentation says the aim is to give SDK authors and protocol implementers a migration schedule they can plan against when parts of the protocol are retired.

How does the MCP update address enterprise security?

The revised specification adds Specification Enhancement Proposal 2468, which requires inclusion and validation of an issuer, or iss, parameter in authorization responses. The change is designed to reduce the risk of OAuth Mixup Attacks.

An OAuth Mixup Attack can arise when a client connects to multiple OAuth providers through multiple MCP servers. If an attacker controls one of those servers, they may be able to obtain an access token or code intended for another server. Validating the issuer parameter helps the client confirm which authorization server produced the response.

The release also adds support for the Enterprise Managed Authorization extension. That gives organizations a way to manage MCP servers through a central identity provider, a requirement that is common in larger companies where access control is handled by platform or security teams rather than individual application owners.

Another change moves tasks, such as long-running tool calls or batch operations, into an extension. Tasks shift those operations from blocking requests to asynchronous requests. McCaffrey said the benefit is that clients can store task IDs durably and resume polling after a crash or restart, rather than keeping fragile long-lived connections open while work completes.

Other additions include header-based routing and cacheable list results. The release is not migration-free: developers that built MCP implementations around session identifiers should expect some rework as they adapt to the new architecture.

This story draws on original reporting from The Register.