Fetching from the wire…
01
02
03
04
05
06
07
08
Tools2026-08-26 · source-backed
PR #3300, merged August 26, adds a charter under docs/community/working-groups. Transport is where nearly every MCP CVE this week actually lives: unauthenticated Streamable HTTP listeners, origin validation by prefix match, unbounded SSE buffering, DNS rebinding. A chartered group with a stated scope is the governance signal to track if you maintain a server exposing HTTP rather than stdio.
Each link below shares sources, entities, or timing with this story.
Cloudflare supports MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Cloudflare supports MCP); both cover August, HTTP, MCP, Streamable HTTP; reported by the same outlet (github.com).
Cloudflare supports MCP / Shared entities / Earlier coverage
Linked by a graph relationship (Cloudflare supports MCP); both cover August, HTTP, MCP, SSE; earlier August coverage from 2026-08-07.
Context7 uses MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Context7 uses MCP); both cover August, HTTP, MCP; reported by the same outlet (github.com).
MCP uses Docker / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (MCP uses Docker); both cover August, DNS, HTTP; reported by the same outlet (github.com).
VS Code supports MCP / Shared entities / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (VS Code supports MCP); both cover August, MCP; reported by the same outlet (github.com).
OpenAI Agents SDK supports MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (OpenAI Agents SDK supports MCP); both cover August, HTTP, MCP, SSE; reported by the same outlet (github.com).
VS Code supports MCP / Shared entities / Earlier coverage
Linked by a graph relationship (VS Code supports MCP); both cover August, DNS, MCP; earlier August coverage from 2026-08-07.
MCP deprecates Roots / Shared entities / Earlier coverage
Linked by a graph relationship (MCP deprecates Roots); both cover HTTP, MCP, SSE; earlier HTTP coverage from 2026-07-28.