MCP ecosystem news
MCP News tracks 36 factual stories about the Model Context Protocol ecosystem - spec releases, adoption milestones, registry updates, and security disclosures, each with primary sources.
Latest stories
MongoDB's mongodb-mcp-server 2.0.0 removes session state and requires explicit connection ids
MongoDB published mongodb-mcp-server v2.0.0, removing session state and requiring an explicit connection id on all database operations. The release also adds multi-region and customer-managed-key options to cluster creation and rejects unrecognized tool arguments. The notes name no spec revision.
governanceTadas Antanavicius steps down as a Registry Working Group lead
A self-submitted pull request removed Tadas Antanavicius from the Registry Working Group leads list, merged on August 2. The stated reason is freeing time for two adjacent catalog projects, AI Catalog and Server Cards. The same maintainer authored the organization-namespace authorization fix in registry v1.8.0.
server releaseMCP Ruby SDK cuts its first stable release, adds 2026-07-28 support, and is promoted to Tier 2
The Ruby SDK reached v1.0.0 on July 24, declaring its public API stable, picked up the 2026-07-28 revision in v1.1.0 on August 1, and was promoted from Tier 3 to Tier 2 in the official SDK listing on August 2.
adoptionVercel MCP serves the 2026-07-28 revision in production three days after release
Vercel's first-party MCP server at mcp.vercel.com now supports the stateless 2026-07-28 specification, serving newer clients the stateless request model while 2025-era clients keep working from the same endpoint, via MCP SDK v2 and mcp-handler 2.0.
server releaseVercel's mcp-handler 2.0.0 adopts 2026-07-28, answers /sse with 410 Gone, and drops its Redis dependency
Vercel published mcp-handler 2.0.0, serving the stateless 2026-07-28 protocol natively while keeping a compatibility layer for 2025-era Streamable HTTP clients. The release removes the legacy HTTP+SSE transport outright and turns the Redis dependency and session options into deprecated no-ops. It is a different artifact from the Vercel MCP server.
adoptionMCP server connections for GitHub Copilot code review reach general availability, limited to read-only
GitHub moved MCP server connections and agent skills for Copilot code review from public preview to general availability across its paid Copilot tiers. Tool calls made during a review are constrained to read-only, and the GitHub and Playwright MCP servers are enabled by default.
securityHashiCorp discloses five vulnerabilities across its Terraform and Consul MCP servers, two rated CVSS 10.0 in advisory records
HashiCorp published two security bulletins one day apart covering its Terraform MCP Server and Consul MCP Server. In both products the stateless-mode issue is a cross-tenant credential reuse flaw that the GitHub advisory records score CVSS 10.0. HashiCorp's own bulletins state no CVSS scores or severity labels.
adoptionAmazon Bedrock AgentCore Gateway adds opt-in support for MCP 2026-07-28
AWS shipped same-day support for the stateless MCP revision in AgentCore Gateway: gateways advertise the protocol versions they speak, clients select a version per request, and existing 2025-era clients keep working unchanged.
spec releaseMCP goes stateless: the 2026-07-28 specification is released
The Model Context Protocol's 2026-07-28 revision is stable: the protocol core becomes stateless, retiring the initialize handshake and protocol-level sessions, with Multi Round-Trip Requests replacing server-initiated requests and a formal twelve-month deprecation policy. All four Tier 1 SDKs shipped support on release day.
client releaseAnthropic says 2026-07-28 support is rolling out across Claude products, without per-product dates
Anthropic published a post on the day of the revision describing the Claude-side capabilities tied to it and stating that support is being rolled out across Claude products. The post names four capabilities and puts the connectors directory above 950 servers, but gives no per-surface availability or completion date.
adoptionAzure MCP Server migrates to the 2026-07-28 stateless protocol in prerelease, requiring routing headers on every POST
Microsoft's Azure MCP Server moved to the 2026-07-28 stateless protocol in a prerelease published the day the revision landed. HTTP clients using the new revision must send the Mcp-Method and Mcp-Name routing headers on every POST, while clients on 2025-11-25 are auto-negotiated for backward compatibility.
adoptionCloudflare's Agents SDK and product MCP servers adopt 2026-07-28, and /sse URLs stop serving HTTP+SSE
Cloudflare shipped Agents SDK v0.20.0 with support for the new revision on July 27, then stated the next day that its product MCP servers run each request on a fresh stateless server. Legacy /sse URLs continue to resolve as aliases but no longer serve the deprecated HTTP+SSE transport.
governanceMCP publishes a feature lifecycle policy with a twelve-month minimum deprecation window
Alongside the 2026-07-28 revision, the MCP project published a written policy defining three feature states and a minimum period a feature must remain deprecated before it becomes eligible for removal. A standing registry page lists every deprecated feature with its migration path and earliest removal date, and Tier 1 SDKs are obligated to surface deprecations in-language.
adoptionNetlify's MCP server adds 2026-07-28 support and names its compatible clients
Netlify published a post stating that its MCP server already supports the 2026-07-28 specification while remaining compatible with earlier revisions. The post gives the connection command and names which clients work at publication: Claude.ai and Claude Managed Agents today, with Claude Code support coming soon.
server releaseMCP Python SDK 2.0.0 renames FastMCP to MCPServer, takes over the mcp PyPI name, and puts 1.x into maintenance mode
The Python SDK's v2 stable release took over the mcp distribution name on PyPI and renamed its high-level server class. Removal of the mcp.server.fastmcp module produced immediate downstream breakage, which AWS addressed the same day by pinning its server collection below 2.0.0.
adoptionAll four Tier 1 MCP SDKs shipped stable 2026-07-28 support within a day of the revision
The TypeScript, Python, Go, and C# SDKs each published a stable release carrying support for the 2026-07-28 revision on or within a day of its release date, each implementing the stateless core differently at the configuration layer. The Rust SDK, listed Tier 2, published a stable 3.0.0 the same day.
server releaseMCP TypeScript SDK 2.0.0 splits into nine scoped npm packages and fixes a connect failure against modern-only servers
The TypeScript SDK republished itself as a family of separately versioned scoped packages, moving schema sources into a shared core and separating client, server, and framework adapters. The same release corrected a wire-shape mismatch that had caused hard connect failures against servers implementing only the 2026-07-28 revision.
securityAWS API MCP Server advisory reports policy checks silently skipped when policy data fails to load
An advisory for the AWS API MCP Server states that if the server's policy enforcement data fails to load during startup, the per-request policy check is skipped for the lifetime of the process, so configured deny and gate rules do not apply. Underlying IAM permissions still apply. Fixed in 1.3.47.
adoptionGitHub MCP Server shipped 2026-07-28 support five days before the revision was released
GitHub published a changelog entry stating its MCP server already supported the stateless revision, five days ahead of the revision's release date, built on a Go SDK pre-release. The entry describes removing sessions, the initialize handshake, and the Redis-backed session store.
adoptionOpenAI deprecates its _meta["openai/visibility"] tool field in favor of _meta.ui.visibility
OpenAI's plugin changelog deprecated its vendor-namespaced tool visibility field and directed developers to the shared _meta.ui namespace instead, citing ambiguity in what the private value hides. It is the only July 2026 entry on that changelog.
securityGitHub MCP Server advisory reports an unauthenticated denial of service in its completion handler
An advisory for github/github-mcp-server states that its CompletionsHandler dereferenced params.Ref without a nil check, so a malformed completion/complete request missing required parameters caused a panic that terminated the process. The advisory rates it High with availability-only impact, fixed in 1.1.0.
registryOfficial MCP Registry v1.8.0 adds crates.io as a package type and restricts organization namespaces to owners
The official MCP Registry shipped v1.8.0, its only release in July and its first since mid-May. It adds cargo (crates.io) as a supported package registry type, narrows organization-namespace claims to org owners, and adds CI that auto-closes attempts to publish servers through the repository. The service remains in preview under a v0.1 API freeze.
governanceAgentic AI Foundation announces MCPA, a Linux Foundation-administered MCP certification
The Agentic AI Foundation announced the Model Context Protocol Associate (MCPA), described as the first official certification for MCP. The Linux Foundation training platform carries the exam listing with domain weightings and format, and directs candidates to the 2026-07-28 specification for preparation. At time of writing the exam was not yet open for purchase.
securityMCP Ruby SDK publishes five advisories covering session ownership and memory exhaustion, all fixed in 0.23.0
The official Ruby SDK published five security advisories on one date, two rated High and three Moderate in the advisory records. All five affect the mcp RubyGems package at 0.22.0 and earlier and are fixed in 0.23.0, which shipped the day before the advisories.
securityMCP Python SDK advisory reports the deprecated WebSocket server transport skipped Host and Origin validation
The Python SDK maintainers published an advisory stating that the deprecated websocket_server() transport did not implement the TransportSecuritySettings mechanism used by the SDK's other HTTP-based transports, so a page served from any origin could complete a WebSocket upgrade against an exposed server. The fix is in 1.28.1.
adoptionApple ships a Safari MCP server in Safari 27 beta, delivered through safaridriver
Apple's WebKit team introduced a Model Context Protocol server that lets an agent drive and inspect Safari for web development and debugging. It ships in Safari 27 beta and Safari Technology Preview 247, is delivered through the existing safaridriver binary, and runs locally with no network calls of its own.
governanceAnthropic donates MCP to the Linux Foundation's new Agentic AI Foundation
One year after open-sourcing the protocol, Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block, and OpenAI, where it joined Block's goose and OpenAI's AGENTS.md as founding projects. Maintainer governance and the SEP process were unchanged.
spec releaseMCP 2025-11-25 ships URL elicitation, CIMD, and experimental tasks
The protocol's fourth revision, released on MCP's first anniversary, added OpenID Connect discovery, URL mode elicitation, tool calling in sampling, Client ID Metadata Documents as a recommended registration mechanism, experimental tasks for durable requests, and formalized governance with working groups and SDK tiering.
securityFirst malicious MCP server found in the wild: npm's postmark-mcp backdoored outgoing email
Koi Security disclosed that the npm package postmark-mcp, an impersonation of Postmark's legitimate MCP server, added a hidden BCC from version 1.0.16 that silently copied every outgoing email to an attacker-controlled address. The package was removed from npm the day of disclosure; installed copies remained compromised.
registryThe official MCP Registry launches in preview
The MCP project launched registry.modelcontextprotocol.io as the official open catalog and API for publicly available MCP servers: a single source of truth that public marketplaces and private enterprise sub-registries can build on, with community-driven moderation and no data-durability guarantees while in preview.
spec releaseMCP 2025-06-18 hardens authorization and adds elicitation
The third specification revision classified MCP servers as OAuth resource servers, required RFC 8707 resource indicators against malicious-server token capture, added elicitation and structured tool output, and removed JSON-RPC batching.
adoptionMicrosoft announces native MCP support in Windows 11 at Build 2025
At Build 2025, Microsoft introduced an MCP platform for Windows 11: an MCP Registry for Windows as the trusted source for discoverable servers, built-in MCP servers exposing system functionality like the File System and Windows Subsystem for Linux, and App Actions surfaced as MCP servers, starting in a private developer preview.
securityInvariant Labs discloses Tool Poisoning Attacks against MCP agents
Security researchers at Invariant Labs disclosed a class of indirect prompt injection they named Tool Poisoning Attacks: hidden instructions in MCP tool descriptions enter an agent's context as trusted content the moment tools are listed, enabling data exfiltration and tool shadowing. The firm later released the mcp-scan detection tool.
spec releaseMCP 2025-03-26 lands: Streamable HTTP and OAuth 2.1 authorization
The protocol's second specification revision replaced the original HTTP+SSE transport with Streamable HTTP, added a comprehensive OAuth 2.1 authorization framework, and introduced JSON-RPC batching and tool annotations.
adoptionOpenAI adopts MCP across its products, starting with the Agents SDK
OpenAI CEO Sam Altman announced support for the Model Context Protocol across OpenAI products: available in the Agents SDK the same day, with ChatGPT desktop app and Responses API support to follow. The move put both major AI labs behind the same integration standard.
industryAnthropic open-sources the Model Context Protocol
Anthropic released MCP as an open standard for connecting AI assistants to the systems where data lives, shipping the specification and SDKs, local MCP server support in the Claude Desktop apps, and an open-source repository of pre-built servers for systems like Google Drive, Slack, GitHub, and Postgres.