MCP Shipped Its Largest Revision Ever on July 28: Stateless Core, OAuth 2.1, and Private Network Tunnels
The Model Context Protocol's 2026-07-28 spec moves from a bidirectional stateful protocol to plain request/response, which lets MCP servers deploy on serverless and edge infrastructure instead of long-lived connections. It also aligns authorization with OAuth 2.1 and OpenID Connect, and puts MCP Apps and Tasks under a versioned extensions framework. Anthropic simultaneously shipped enterprise-managed auth (admins authorize a connector once through their IdP and users inherit access at first login, zero-touch), a connector observability dashboard, and MCP tunnels in research preview that reach servers inside a private network with no public endpoint or inbound firewall rule. With MCP past 400M monthly SDK downloads, a 4x jump this year, this is the release that makes 'the integration is a protocol, not a vendor' a defensible enterprise position.
Source
↳ Follow the thread