The latest changes to MCP paradoxically make the protocol both better and more crufty. For instance, many RPC params are now duplicated as HTTP headers.
The release candidate for MCP 2026-07-28 is out. The protocol is now stateless: no handshake, no session id, any request can hit any server instance. Plus extensions as first-class (MCP Apps, Tasks), auth hardening, and a proper deprecation policy so we don't have to do this again.
https://t.co/XRLTu1BSkB
@0xblacklight@RhysSullivan@aaronpk That said, you need to be an approved partner to get those details. I’m not on that list (yet!?). I’ve applied, but if anyone knows how to get access to the spec at least - I’d love to know.
Paging @jeff_weinstein@irvinebroque
@0xblacklight@RhysSullivan@aaronpk Re: Stripe Projects. That is apparently supposed to be an open protocol - alluded to in Cloudflare’s support announcement: https://t.co/ngeV5wWNtQ
I’m really excited about this, and have been eager to implement and give feedback.
"Replacing long-lived keys with ephemeral keys is, for my money, one of the best uses of security engineering effort." is the best sentence I've read pertaining to my field in awhile. More at:
https://t.co/HY8WhrYJjp