The Model Context Protocol (MCP) has moved beyond laboratory curiosity. The specification dated 28 July 2026 stabilises its foundations, and public registries now list more than 9,000 servers. For teams wiring agents into real tools, this release marks the shift from experimental protocol to infrastructure dependency.
What the 2026-07-28 specification contains
| Feature | Practical effect |
|---|---|
| Stateless core | Simpler hosting behind standard HTTP and straightforward horizontal scaling |
| MCP Apps | Full applications can be exposed, not just isolated tools |
| Tasks extension | Framed support for long-running and asynchronous work |
| Deprecation policy | An explicit framework for evolving the protocol without unannounced breakage |
From stdio to HTTP, and from API keys to OAuth 2.1
The stdio transport, convenient for local prototyping, gives way to hosted HTTP. In the same move, static API keys are replaced by OAuth 2.1, now required for remote servers. Setup is heavier, but the reasoning is hard to argue with: a remote MCP server exposes tools that write into real systems — databases, CMS platforms, analytics. That level of access is not protected by a hard-coded string.
Consequences for teams already using it
Servers prototyped over stdio with an API key will keep working, but the protocol’s direction is explicit: stateless HTTP and OAuth. No migration is imposed in the short term; any new server written today, however, is better off targeting that shape directly rather than being rewritten later.
What to take away
The 28 July specification brings no spectacular feature. It brings what was missing in order to build on top of it: a stateless core, standard authentication and an announced evolution framework. That is the vocabulary of an infrastructure component, not a prototype.
I have been running MCP-driven editorial routines in production for more than a year. Moving to OAuth 2.1 cost half a day of configuration per server, and it is the best half-day I have spent on the subject: hard-coded API keys were the one part of the chain I would not have wanted to discuss in an audit. — Simon Janvier
Further reading
The full specification is published on the official Model Context Protocol site.
Also on Mail Studio
- TypeScript 7.0: the compiler rewritten in Go
- Editorial agents in production: what holds and what breaks
