Fetching from the wire…
01
02
03
04
05
06
07
08
Infra2026-09-04 · source-backed
JSON payloads are rejected past 1000 levels of nesting before the parser recurses, both SSE readers cap per-event bytes through a new MaxEventSize, stdio caps a single JSON-RPC frame via StdioTransport.MaxLineLength, and OAuth dynamic client registration responses are capped at 1 MB. The release notes credit session leaks, deadlocks and teardown hangs found by users running the 2026-07-28 protocol at scale. No new protocol revision. If you run an MCP server in Go, these are the first hard limits on what a hostile client can make you allocate. GitHub
Each link below shares sources, entities, or timing with this story.
The 2026-07-28 Model Context Protocol spec published today, and it removes two things every MCP server currently depends on: the initialize/initialized handshake and the Mcp-Session-Id header. Both are gone. Not deprecated. Gone from the core. (Model Context Protocol Blog) Wha...
You have one week. If you run an MCP server in production, stop what you're doing and read the release candidate. The Model Context Protocol's 2026-07-28 spec is the largest revision since the protocol launched, and the headline is architectural: the initialize/initialized han...
Hudson Rock got hold of the archive and counted it. 433,909 files. 118,829 CI runner dumps traced to 2,488 corporate domains. AWS keys, Salesforce client secrets, Slack signing secrets, Azure environment variables, and AI provider API keys belonging to NVIDIA, Volkswagen, Micr...
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
iOfficeAI/OfficeCLI is Apache-2.0 C#/.NET giving agents read/write control over .docx, .xlsx, and .pptx with no Microsoft Office install, no external dependencies, and no .NET runtime at execution time (GitHub). Its differentiator over python-docx-style libraries is a native f...
Eighteen days. That's how long you have. The 2026-07-28 MCP specification release candidate removes the session concept from the protocol layer entirely. The initialize / initialized handshake is gone. The Mcp-Session-Id header is gone. Protocol version, client identity, and c...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.