The MCP 2026-07-28 specification hardened authorization and started a twelve-month clock on every legacy deployment.

Released 28 July 2026: a stateless protocol core, multi round-trip requests, header-based routing, cacheable list results, a formal extensions framework, and authorization aligned to an OAuth 2.1 resource-server model. Legacy versions expire around July 2027.

Get an Agent Trust Gap Brief

The twelve-month clock

The 2026-07-28 specification was released on 28 July 2026 with a twelve-month deprecation window for legacy protocol versions. That places a migration deadline in July 2027 on every enterprise MCP deployment — and the authorization changes touch identity infrastructure rather than application code, so the work usually lands on a team that has not been told yet.

What changed

Stateless protocol core

Removes server-side session assumptions. Simplifies horizontal scaling and changes how session-bound authorization must be reasoned about.

Multi round-trip requests

Interactions that need several exchanges are now first-class rather than improvised.

Header-based routing

Routing metadata moves to headers, which matters for gateways and proxies sitting in front of MCP servers.

Cacheable list results

Tool and resource listings can be cached — a performance win that introduces a staleness question for authorization decisions built on those lists.

Authorization hardening

Closer alignment with OAuth 2.1 and OpenID Connect. A protected MCP server acts as an OAuth 2.1 resource server accepting bearer access tokens.

Formal extensions framework

Extensions become a defined mechanism rather than vendor divergence.

Enterprise-Managed Authorization

The extension that changes the governance picture most. Organisations provision MCP server access centrally through their identity provider, so users receive connected servers on first login rather than clicking through per-application OAuth consent. Anthropic, Microsoft and Okta are among the adopters.

For a governance team the difference is categorical. Per-user OAuth consent produces an estate nobody can enumerate and nobody can revoke centrally. IdP-provisioned access produces one that can be inventoried, reviewed and switched off — which is the precondition for every other control on this site.

Migration checklist

Inventory every MCP server your agents can reach, with a named approver and the protocol version each currently speaks.
Identify legacy-version dependencies — both servers you run and servers you consume.
Map the authorization model per server: bearer tokens, audience binding, resource indicators, dynamic client registration.
Close the confused-deputy and token-passthrough gaps before migrating, not after — migration is the natural moment to fix them.
Evaluate Enterprise-Managed Authorization against your IdP. This is the strategic decision in the whole migration.
Re-consent tools whose definitions changed. A stale approval against a changed tool is a rug-pull waiting to be discovered.
Instrument tool calls with execution receipts — agent, tool, argument hash, policy version, response.
Verify revocation reaches the server with a measured time-to-effect, not just the client.

The NSA has published a cybersecurity information sheet on Model Context Protocol security — worth reading before an enterprise rollout. Specification source: The 2026-07-28 Specification. Verified 2026-08-06.

MCP governance in the platform

Common questions

What is MCP 2026-07-28?

A revision of the Model Context Protocol that hardened authorization. It matters because MCP is the transport a growing share of agent tool calls run over.

Is there a migration deadline?

The revision starts a practical migration clock for implementations on earlier revisions. Confirm specifics against the protocol documentation.

What should we do first?

Inventory: which MCP servers exist, which tools they expose, which agents can reach them, and who owns each.

Is an MCP server a third party?

In substance yes — it exposes tools your agent calls with your authority.

Does MCP handle policy?

No. It handles connection and capability exposure. Whether a permitted call is an appropriate action is a policy question at the effect boundary.