PR #3300, merged into modelcontextprotocol/modelcontextprotocol on 2026-08-26, adds a charter for a Transports working group under docs/community/working-groups. Transport is where most of this week's MCP CVEs actually live (unauthenticated Streamable HTTP listeners, origin validation by prefix match, unbounded SSE buffering, DNS rebinding), so a chartered group with a stated scope is the governance signal to watch if you maintain a server. Worth tracking for anyone whose server exposes an HTTP transport rather than stdio.