The maintainers of the Model Context Protocol (MCP) have published an updated roadmap that will shape the next specification release of the protocol that has become a de facto standard for connecting AI models to external tools and data. The August 22 post, authored by lead maintainers David Soria Parra and Den Delimarsky, lays out five priority areas — from agentic messaging primitives to standardized agent identity — and arrives just weeks after the protocol's landmark 2026-07-28 specification overhaul.
The update drew immediate attention from the developer community, with the roadmap announcement collecting more than 240 upvotes and over 140 comments on Hacker News within days. For developers building agentic applications, the document signals where the protocol's core maintainers and working groups will spend their review time — and which proposals will move fastest through the queue. For more context on this story, see our ongoing more AI stories.
What the July Specification Already Changed
Before setting new priorities, the maintainers took stock of the previous roadmap, published in March 2026, which focused on four areas: transport evolution and scalability, agent communication, governance maturation, and enterprise readiness. According to the blog post, "significant progress" was made on all four fronts, with the bulk of the changes landing in the 2026-07-28 specification release.
The most consequential change was the removal of protocol-level sessions and the initialization handshake, tracked as SEP-2575 and SEP-2567. The shift means an MCP server can now scale horizontally without holding state — a fundamental rework that makes remote MCP servers behave like ordinary web services. Clients can also call a new `server/discover` endpoint to learn a server's supported versions and capabilities before doing anything else, and list results became cacheable under SEP-2549.
On the agent communication side, the Tasks construct was reworked into an official extension (SEP-2663), while a new Multi Round-Trip Requests pattern (SEP-2322) replaced server-initiated requests so that flows like elicitation work on stateless servers. Governance matured as well: the project formally adopted a Contributor Ladder, working groups now triage their own enhancement proposals, and the specification gained a proper feature lifecycle and deprecation policy.
Enterprise readiness work concentrated on authorization, shipping issuer validation, issuer-bound client credentials, and Client ID Metadata Documents as the preferred client registration path, with Enterprise-Managed Authorization promoted to stable as an extension.
Five Priorities for the Next Release Cycle
1. Agentic Messaging Primitives
The first priority acknowledges that "modern agentic workloads no longer fit the standard request-and-response pattern." Loops run longer, servers push streamed results, and developers need the ability to steer work mid-flight. MCP has been growing toward these requirements with Tasks, subscriptions and listen operations, and progress notifications — but the maintainers want them to work well together.
Planned work includes server-initiated events delivered through webhooks and channels, "so clients aren't left polling for results," a composition review spanning the Agents, Transports, and Triggers & Events working groups, and maturing the Tasks extension so it can move into the core specification.
2. HTTP-Native Transport Unification
With the July release, the maintainers wrote, "a remote MCP server is now no different from any other HTTP workload," making MCP servers easy to host on infrastructure organizations already use for their APIs. The approach "has proven to scale," and the roadmap now proposes stretching it to cover local servers speaking Streamable HTTP over standard input and output. Unifying on a single transport, the post argues, would simplify both MCP server and client development even further.
3. Agent Identity and Enterprise-Ready Security
Perhaps the most forward-looking priority addresses a gap between how MCP authorization works today and how agents actually operate. Current authorization is built around a person approving access in a browser — fine for interactive clients, but increasingly out of step with reality.
"More and more of the callers are agents running as cloud workloads with their own identity, acting on behalf of a user who isn't present, or delegating narrower authority to sub-agents," the maintainers wrote. The goal is a standardized way for MCP servers to recognize and trust those agent identities, "built on existing standards rather than pasted API keys and long-lived tokens."
Concretely, the work covers finalizing Demonstrating Proof of Possession (DPoP) and driving its adoption, defining an opinionated path for agent identity and delegation through Workload Identity Federation, the ID-JAG grant behind Enterprise-Managed Authorization, and standard token exchange. The team will also continue engaging with the IETF OAuth and WIMSE working groups to help underlying standards evolve.
4. Improved Primitives and Progressive Tool Discovery
Tool calling remains the part of MCP most developers touch first, and it has "held up well," according to the post. But result handling falls short: a `tools/call` response can carry the same output in more than one form, and server developers have no way to know which form a given client will put in front of the model. The roadmap aims to standardize on one clear contract.
The maintainers also flagged the problem of scale. "Connecting to a server with a hundred tools means the model pays for that entire surface before the user has asked a single question, and tool selection tends to get worse as the list grows," they wrote. The answer is a progressive discovery effort, letting a server offer a small entry point and reveal more of its catalog as the conversation narrows.
5. Improved SDK Developer Experience
Finally, the maintainers pledged investment in the SDKs through which most developers experience MCP — their ergonomics, their conformance with the specification, and their documentation across every supported platform and language. The stakes have risen, they noted, now that many developers build MCP clients and servers "by pointing an agent at our libraries," where clear APIs and accurate documentation decide whether generated code works with minimal friction.
What It Means for the Ecosystem
The roadmap includes a practical incentive structure: Specification Enhancement Proposals (SEPs) that fall within the priority areas get expedited review and the best chance of acceptance, while out-of-scope proposals are not rejected automatically but receive scarce maintainer time last. Each priority area has named core maintainers and one or more working groups, all of which have room for more contributors, and the experimental extension mechanism under SEP-2133 lets groups test ideas before formal proposals.
Since Anthropic introduced and open-sourced MCP in late 2024, the protocol has spread across the industry, with major AI vendors and tool builders adopting it as a common way to give models access to external systems. The August roadmap suggests the protocol's next phase will be defined less by basic connectivity and more by the harder problems of the agentic era: identifying who — or what — is actually calling, keeping long-running work steerable, and taming the sprawl of tools that agents must navigate.
For developers and platform teams betting on MCP, the message is clear: stateless HTTP operation is now the assumed baseline, and the protocol's center of gravity is shifting toward agents that act autonomously, carry their own verifiable identities, and discover capabilities progressively rather than all at once.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
