Fetching from the wire…
Public story · 2026-09-18 · high
The spec now treats Skills as done, but Go, Python, TypeScript and C# still need separate implementation work before any client can use it.
Why now: The spec PR merged September 18, with four SDK implementations still open.
The Model Context Protocol's Skills extension is now marked Final under proposal SEP-2640, and the protocol's spec docs caught up with that status on September 18 in PR #3372. The extension itself lives in a separate repo, modelcontextprotocol/ext-skills, and works by distributing skills through MCP's existing Resources primitive rather than adding a new one.
That's a real design choice worth sitting with for a second. Skills don't get their own protocol surface. A server exposes them the same way it exposes any other resource, and a client that already speaks Resources gets skills discovery close to free, in theory.
In practice, nobody's client speaks it yet. The PR is explicit that finalizing the spec and shipping SDK support are two different jobs, and the second one hasn't happened. Implementation PRs for the Go, Python, TypeScript and C# SDKs are all still open. A server author can point at the finished spec, but a client built on any of the four official SDKs can't consume a Skills-exposing server until its language's SDK PR merges and ships.
That gap matters because "Final" reads as "stable" to anyone skimming the spec status, and stability at the protocol layer doesn't buy you a working client. If you're designing against MCP now, treat the Resources-based approach as the target shape, not something you can wire up before those four PRs close. The thing to watch is which SDK merges first. Whichever language gets support becomes the reference implementation everyone else's client library gets compared against, and that usually sets defaults the other three end up copying.
Each link below shares sources, entities, or timing with this story.
The 2026-07-28 Model Context Protocol spec published today, and it removes two things every MCP server currently depends on: the initialize/initialized handshake and the Mcp-Session-Id header. Both are gone. Not deprecated. Gone from the core. (Model Context Protocol Blog) Wha...
A single architectural decision, replicated across Python, TypeScript, Java, and Rust, sitting at the center of the protocol most agent builders now run. OX Security's research team disclosed a critical vulnerability in the official Model Context Protocol SDKs that enables arb...
Google published the explainer August 5 for the 2026-07-28 spec, which removes the initialize/initialized handshake (SEP-2575) and the Mcp-Session-Id header (SEP-2567), making the protocol core stateless. Google led it via PR #2575 and co-founded the MCP Transports Working Gro...
On September 9, Anthropic added a mods/ folder to the public claude-code repo containing the full source of three plugins compiled into the binary: sec-default, diff and telemetry. 52 commits by September 13. None of it appears in the CHANGELOG, so the repo is running ahead of...
Two merged PRs, five hours apart, and together they change what agent tool approval means on macOS. PR #43624, merged at 00:15Z on September 8, implements macOS user verification using P-256 keys in the Secure Enclave, stored in the Data Protection Keychain, with biometric aut...
If you wrote an MCP server before July, it's on a protocol shape the maintainers have already removed. Not deprecated-with-a-migration-window. Removed from the spec. MCP lead maintainers David Soria Parra and Den Delimarsky published an updated roadmap on August 22, and the re...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.