MCP Specification Overhaul Goes Stateless as Servers Pass 10,000

The protocol behind AI agents gets a rebuild

The Model Context Protocol (MCP) has become the default plumbing for connecting AI agents to outside tools. On July 28, 2026, it shipped the biggest revision since Anthropic released it in November 2024. Maintainers locked the release candidate on May 21, and it became the official 2026-07-28 specification in late July. The project describes it as the largest change in the standard's history.11 Anthropic's David Soria Parra called it the most substantial change since authorization was added to the protocol.12

The update arrives at a scale few people expected for an open standard that is not yet two years old. When Anthropic donated MCP to the Linux Foundation's new Agentic AI Foundation (AAIF) in December 2025, it reported more than 10,000 active public MCP servers and over 97 million monthly SDK downloads across Python and TypeScript.1314 The rewrite matters because it shows MCP's stewards shifting their goal. Winning developers over is largely done. The work now is getting the protocol through corporate security reviews and procurement processes, and this release is built for that.

What actually changed

The main change is architectural. The new revision drops protocol-level sessions, so each request can be handled on its own. That is the stateless pattern cloud-native services use to scale behind load balancers.15 Information that used to live in a session, such as protocol version, client identity and capabilities, now travels in a _meta parameter attached to every request.12 The revision also removes the initialize/initialized handshake and the Mcp-Session-Id header. It adds a required server/discover call for negotiating capabilities up front, and it formally deprecates Roots, Sampling, Logging and the old HTTP+SSE transport.14

The AAIF frames the practical benefit simply: organizations can now run MCP servers behind standard load balancers with the Kubernetes and DevOps tooling they already use.21 Earlier versions required sticky routing and shared session stores, which made scaling out awkward.11

The release also includes changes aimed at enterprise buyers:

• A formal deprecation policy. Features get at least 12 months between formal deprecation and the earliest possible removal.21
• Authorization hardening. Validation of the iss parameter is now mandatory, which the foundation says closes a whole class of OAuth mix-up attacks.21
• Enterprise Managed Authorization. A company's identity provider becomes the final authority on which MCP servers a user can reach.21
• Two new official extensions. Interactive server-rendered interfaces (MCP Apps) and long-running asynchronous Tasks both became official protocol extensions.27 Clients can save a task ID and resume polling after a crash.21

Coverage agrees on the content of the release but differs in how it describes the risk. VentureBeat's reporting presented the update as what finally makes agentic AI ready for large enterprise production.27 The Register put more weight on the cost: some changes are not backward compatible. It cited Stacklok's warning that servers on the new revision may not work with older clients, and the reverse, even during the deprecation window.15 My reading is that both are true. The 12-month window is a promise about features. It is not a promise of compatibility, and teams running mixed fleets will need to plan their upgrades carefully.

The 10,000-server number, and why it's slippery

The "10,000+ servers" figure appears in nearly every story about MCP. It deserves a closer look, because the counts vary widely.

The most reliable baseline is Anthropic's December 2025 ecosystem update.13 A May 24, 2026 snapshot of the official MCP Registry counted 9,652 current server records and 28,959 records including older versions. A GitHub search the same day found 15,926 repositories tagged mcp-server.13 Some outlets put the August 2026 total at about 15,930 public servers across four major registries.11 Third-party directories report far more. As of August, Glama listed more than 71,000 servers and one combined tally came close to 101,000, though those lists include many abandoned and duplicate entries.14 One setup guide noted that some 2026 trackers still put the total near 5,800.17 Download figures also differ: the AAIF has cited more than 110 million monthly SDK downloads as of April 2026.26

Enterprise adoption numbers are even more disputed. Digital Applied withdrew a widely repeated claim that 78% of enterprise AI teams run MCP in production, saying the figure could not be traced to a source. It replaced it with Stacklok's survey result: 41% of software organizations in limited (29%) or broad (12%) production.13 A later summary said a separate Stacklok and mcp.institute survey did arrive at 78%, alongside 28% of Fortune 500 companies running MCP servers.11 An enterprise guide published in July reported that only 11–14% of pilots reach production, held back by problems with identity, auditability and lock-in.25

I read these numbers this way: interest from developers is very high, but serious production use is real and much smaller. The 10,000 figure is best understood as a sign of momentum, not a count of systems in production.

Security is the main story

The new authorization rules make more sense in light of the year MCP has had on security. More than 30 CVEs were filed against MCP servers and clients in January and February 2026 alone, ranging from path traversal bugs to a remote code execution flaw rated CVSS 9.6.14 AgentSeal scanned 1,808 servers and found at least one security issue in 66% of them.14 Independent scans cited elsewhere put the share of public servers with exploitable flaws anywhere from 30% to 82%. A June report found that only 8.5% of public servers implement OAuth.11

The U.S. government has also weighed in. The NSA said in 2026 that MCP's rapid spread had outpaced the development of its security model.12 The NSA and CISA published joint security design guidance on June 2, 2026, according to one account.11 Security vendor Zenity points to the underlying problem: MCP does not enforce authentication, authorization or input validation at the protocol level, so each server is only as secure as the team that runs it.28 The Cloud Security Alliance described the wave of CVEs as the predictable result of deploying a permission-heavy protocol at scale before governance frameworks were ready.23

The newest revision addresses some of this, but not all of it. It hardens authorization. It does not stop a poorly built community server from passing malicious instructions to a model. The industry's response so far looks like a defensive layer built around the protocol rather than inside it. Enterprises are settling on tool allowlists for each agent, OAuth 2.1 identity binding, a central MCP gateway, and required human approval before destructive actions.25

A2A joins MCP under one governance body

The second major development this summer was about governance. Google's Agent2Agent (A2A) protocol became a hosted project of the AAIF in August, alongside MCP, Block's goose runtime, OpenAI's AGENTS.md and the agentgateway proxy.5 A2A's own blog says it entered as a Growth Stage project.7 Most reports date the announcement to August 17, though one enterprise outlet gave August 20.69

The two protocols do different jobs and are designed to work together. The Linux Foundation describes A2A as the layer for agents communicating with each other across organizational boundaries, while MCP connects an agent to internal tools and data.1 At its one-year mark in April, A2A reported support from more than 150 organizations, integration with Google, Microsoft and AWS platforms, and production use in supply chain, financial services, insurance and IT operations.1 Its v1.0 release added signed Agent Cards, multi-tenancy and version negotiation.4 The Agent Payments Protocol (AP2) extension has more than 60 supporters in payments and financial services.10

Forbes noted that the move is less dramatic than it may sound. Google had already handed A2A to neutral governance in June 2025, so this change concerns where the project is hosted, not who controls it. Forbes also pointed out that A2A's adoption figures come from the foundation and its vendors, not from independent measurement.5 One analysis questioned how much real usage sits behind the 150-organization claim, noting that no deployment count has been published.6 By any measure, MCP remains far larger.6

Reports of the foundation's size also vary widely: more than 170 members in April, more than 250 by August according to Axios, and more than 460 on a later roster.26614 The direction is clear even if the exact numbers are not.

What it means for enterprise agent strategies

For companies building autonomous agents, placing both protocols under one foundation removes a familiar objection: the worry that a key standard belongs to a single vendor.9 It gives buyers a reason to adopt both MCP and A2A rather than choose between them.

The harder work is still ahead. Anyone running internal MCP servers built on the June or November 2025 specs needs someone responsible for migrating them before the deprecation window closes in mid-2027.11 Scale brings costs that are easy to underestimate: every tool definition from every connected server goes into the model's context with each request, which can consume a large share of the input budget before the model does any work.19 The security problems above remain mostly unsolved.

My assessment: the July revision is the point where MCP stopped being an experiment and became infrastructure. The vendors agree on the standard and the protocol is now stateless, so the remaining obstacles are on the enterprise side: governance, identity and quality control. Those obstacles, more than any spec change, will determine how quickly AI agents reach real production use.