The Model Context Protocol team published an updated roadmap this week, and it's worth reading beyond the headline. The previous roadmap from March targeted four areas: transport evolution, agent communication, governance, and enterprise readiness. They delivered on all four.
The changes landed in the 2026-07-28 spec release — and the biggest one is architectural.
"Protocol-level sessions and the initialization handshake are gone, so a server can scale horizontally without holding state."
That's not a minor tweak. That's MCP crossing from "interesting protocol" to "just another HTTP workload you can run anywhere."
What actually shipped
- Stateless + sessionless by default — servers no longer hold per-client state. Horizontal scaling is now trivial (SEP-2575, SEP-2567)
-
server/discover— clients can probe supported versions and capabilities before connecting - Cacheable list results — less round-trip chatter for tool discovery (SEP-2549)
- Tasks extension reworked — moved into an official extension after early adopter feedback (SEP-2663)
- Multi Round-Trip Requests — replaced server-initiated requests so elicitation works on stateless servers (SEP-2322)
- Enterprise auth hardened — issuer validation, issuer-bound client credentials, Client ID Metadata Documents (CIMD), and Enterprise-Managed Authorization now stable
What the new roadmap prioritises
Five areas, each with dedicated Working Groups:
Agentic messaging primitives — server-initiated events (webhooks and channels, so clients stop polling), plus maturing Tasks into the core spec. The goal: MCP handles long-running agentic loops natively.
HTTP-native transport unification — unify stdio and Streamable HTTP under one transport model. A local MCP server and a cloud-hosted one should behave identically.
Agent identity — this is the one worth watching. Today auth is built around a human approving in a browser. That doesn't work for agent-to-agent calls or unattended cloud workloads. The roadmap targets DPoP, Workload Identity Federation, and standard token exchange — with active engagement in IETF OAuth and WIMSE standards bodies.
Improved primitives — two specific problems: tools/call responses can carry output in multiple forms with no contract for which one clients use, and large tool catalogs (100+ tools) waste context tokens before a user asks anything. Progressive discovery is the proposed fix.
SDK developer experience — conformance testing, better docs, making it easier to build MCP clients and servers whether you're writing the code yourself or pointing an agent at the libraries.
What to do
- Running MCP servers? The stateless shift is the most operationally significant change. Review SEP-2575 if you haven't — your deployment model may be able to simplify significantly.
- Building agent-to-agent flows? The agent identity work is directly relevant. Watch the DPoP and Workload Identity Federation threads — pasting API keys between agents is the pattern they're replacing.
- Shipping large tool catalogs? Progressive discovery is coming. Hold off on complex client-side filtering hacks and track SEP progress.
- Want to contribute? Each priority area has a Working Group with open seats. Discord is the entry point.
The full roadmap is at modelcontextprotocol.io/development/roadmap.
✏️ Drafted with KewBot (AI), edited and approved by Drew.
Top comments (0)