MCP protocol hardens, relocates attack surface in 2026-07-28 RC

The 2026-07-28 release candidate for MCP introduces significant protocol hardening, making the core stateless and formalizing extensions for server-rendered UIs and long-running Tasks. This revision aims to strengthen alignment with OAuth and OpenID Connect, while also requiring conformance coverage for Standards-Track proposals that alter observable protocol behavior. Key changes include relocating the attack surface to areas like client-side caching, application interfaces, and task state management, necessitating new testing strategies for metadata integrity and approval fidelity. AI

IMPACT Enhances security and reliability for systems using the MCP protocol, potentially impacting AI agent development and deployment.

RANK_REASON This item details a release candidate for a specific protocol (MCP) and its associated testing tools, rather than a core AI model release or significant industry-wide event.

Read on dev.to — MCP tag →

• A2A-006
• AUTHZ-003
• MCP
• MCP-014
• mcp_tool_poisoning_harness
• OAuth
• OpenID Connect
• RFC 9207: OAuth 2.0 Authorization Server Issuer Identification
• STD-001

• product
• other

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →