↓ Skip to main content
sdd.sh
sdd.sh
  1. Articles/

MCP's 2026 Roadmap: From Prototype Protocol to Production Standard

·3041 words·15 mins·
Florent Clairambault
Author
Florent Clairambault
CTO & software engineer — writing daily about spec-driven development and agentic coding
Table of Contents

Updated September 19, 2026. Six months after this article was published, MCP shipped the stateless spec it promised, moved to Linux Foundation governance under the Agentic AI Foundation, and hit SDK v2.0 — and two of the three security gaps flagged in the May update are still, as of today, unpatched. The original article follows; the September update is at the very bottom, after the May update.

When Anthropic introduced the Model Context Protocol in November 2024, most developers were skeptical. Another standard? The graveyard of AI integration specs was already crowded. Sixteen months later, MCP is natively supported by Anthropic, OpenAI, Google, and Microsoft, ships in millions of daily active developer tool sessions, and has just published a serious 2026 roadmap from its lead maintainer.

The roadmap — written by David Soria Parra and published March 9, 2026 — reads less like a product announcement and more like a protocol growing up. Here’s what it says and what you should care about.

Why the Roadmap Format Changed
#

Previous MCP roadmaps organized work around release milestones: version X will include Y. That framing made sense when a small Anthropic team owned the entire spec. It no longer fits.

MCP is now a multi-company open standard under the Linux Foundation. The community has grown large enough that no small group of core maintainers can realistically review every proposed spec change — and organizing work around milestones that one team controls doesn’t scale.

The 2026 roadmap switches to Working Groups and Interest Groups as the primary vehicle for protocol development. Instead of “version 2.0 ships in Q2,” you get “the Transport WG owns Streamable HTTP improvements and drives its own timeline.” SEPs (Spec Enhancement Proposals) in the four priority areas get expedited review. Everything else goes into the queue.

This is how successful open standards work. It’s a meaningful structural maturation.

The Four Priority Areas
#

Core maintainers ranked candidate areas and landed on four that will receive the most attention and the fastest SEP reviews in 2026.

1. Transport Scalability
#

Streamable HTTP gave MCP a production-ready transport — the right call to move away from the original SSE-only approach. But running it at scale has surfaced real gaps.

The current spec assumes you can maintain a session with a single server instance. The moment you put a load balancer in front of your MCP server, things break in subtle ways. The roadmap proposes evolving Streamable HTTP to run statelessly across multiple server instances with proper session creation, resumption, and migration semantics.

Alongside that, the working group is designing MCP Server Cards — a standard for exposing server metadata at a .well-known URL so registries can discover what a server does without actually connecting to it. Think of it as a capabilities manifest: what tools does this server expose, what scopes does it need, what transports does it support.

For teams deploying MCP servers in production today, stateless transport isn’t optional. This work is overdue.

2. Agent Communication (Tasks)
#

MCP currently lets clients start asynchronous Tasks — fire-and-forget agent jobs. But early production deployments have revealed that the lifecycle semantics are underspecified.

What happens when a task fails? When should a client retry? How long are completed results retained before expiration? The current spec leaves these as implementation details, which means every team is making up their own answers — and interoperability breaks.

The roadmap proposes clearer lifecycle rules for tasks: defined retry behavior for failed jobs, explicit retention policies for completed results. This sounds like plumbing. It is plumbing. It’s also exactly the kind of thing that separates a toy protocol from one you’d bet production systems on.

If you’re building agentic workflows where a Claude Code session hands off tasks to background MCP agents, this directly affects you.

3. Governance Maturation
#

This is the least flashy priority area and arguably the most important for the long-term health of the protocol.

Right now, every SEP must be reviewed by the full group of core maintainers regardless of what it affects. A change to the TypeScript SDK’s error handling and a change to the core spec transport layer go through the same full-council review. That doesn’t scale — maintainer time gets spread thin, and contributors outside the core group have no clear path to taking on more responsibility.

Two SEPs are already in flight: a Contributor Ladder SEP that defines progression from community participant to WG lead to core maintainer, and a delegation model that lets Working Groups with a proven track record accept SEPs within their own domain without requiring a full core-maintainer vote.

The goal is a protocol that can continue growing without creating a bottleneck at the top. For developers contributing to MCP tooling, this means your SEPs may move significantly faster once WG delegation is in place.

4. Enterprise Readiness
#

Enterprises are deploying MCP at scale and hitting walls the spec doesn’t address.

The three specific gaps called out in the roadmap:

  • Audit trails and observability: Who called what tool, when, with what arguments? Enterprises need logs that satisfy compliance requirements. MCP currently has no standard way to emit or structure this data.
  • Enterprise-managed auth: SSO-integrated flows where identity comes from the organization’s IdP, not a developer-managed OAuth app. The current auth model works fine for individual developers; it’s the wrong shape for enterprise IT.
  • Gateway and proxy patterns: Many enterprises route all external API traffic through security gateways. MCP needs defined semantics for how an intermediary sits between a client and server without breaking the protocol.

Importantly, the roadmap notes that most enterprise readiness work will land as extensions rather than core spec changes. Enterprise needs are real, but the solution shouldn’t make the base protocol heavier for everyone who doesn’t need it. Smart call.

SDK Ecosystem Status
#

The roadmap doesn’t exist in isolation from the SDK implementations. As of March 2026:

  • TypeScript SDK v1.27.1 is the reference implementation with the most active conformance work. If you’re building MCP servers, start here.
  • Python SDK v1.26 is tracking close behind. The gap between TypeScript and Python has narrowed significantly since 2025.
  • OpenAI Agents SDK v0.12.5 introduced MCP retry and error normalization — essentially implementing the task lifecycle rules the spec is still formalizing.
  • Google ADK v2.0 pre-release added a structured Task API for agent-to-agent delegation.

The multi-vendor SDK convergence is one of MCP’s strongest signals. When OpenAI’s own agent SDK ships MCP support and invests in conformance, the “this is just an Anthropic thing” concern disappears.

What This Means If You’re Building on MCP Today
#

If you’re integrating MCP into your tools now, a few practical implications:

Build with Streamable HTTP. SSE-based transport is legacy. The entire roadmap’s transport work is anchored on Streamable HTTP. If you’re starting a new MCP server, don’t touch SSE.

Don’t design around session stickiness. The stateless transport work is coming, and servers that assume a single-instance session will need to be refactored. Design for statelessness now.

Expect the TypeScript SDK to move fastest. It’s the reference implementation. New features land there first. If you’re writing Python and something feels unsupported, check whether it’s in the TypeScript SDK yet.

Watch the Governance WG. Once the delegation model ships, SEP review times for targeted spec areas should drop significantly. If you have protocol proposals in flight, timing a submission for after delegation is in place may get you faster review.

The Bigger Picture
#

MCP moved from zero to multi-company open standard in roughly 16 months. The 2026 roadmap reads like a protocol that’s survived contact with real production workloads and is now doing the less glamorous work of growing up: governance, observability, enterprise auth, stateless transport.

The protocols that win aren’t always the most elegant. They’re the ones that show up for the boring production-readiness work after the initial hype fades. MCP appears to be doing exactly that.

Sources:

Update: Two Months Later (May 23, 2026)
#

The March roadmap was optimistic about the boring work of maturation — governance, stateless transport, enterprise auth. How did it land?

What Actually Happened: The Scale Story
#

On March 25, MCP crossed 97 million monthly SDK downloads — up 4,750% from a year earlier. By May, the official registry listed 6,400+ servers across developer tools, enterprise SaaS platforms, and infrastructure services. OpenAI attended MCP Dev Summit NYC in April, confirmed full MCP adoption, and deprecated its own Assistants API in favor of the MCP standard. Salesforce exposed its entire CRM platform via MCP. ServiceNow made MCP support standard in every Now Assist SKU.

The Working Group structure from the roadmap did form. Protocol governance moved under the Linux Foundation with multi-vendor representation. The A2A protocol (Google’s competitor standard for agent-to-agent communication) reached v1.2 and was put under the same Linux Foundation umbrella in April — the two approaches are now converging in governance if not yet in spec.

What the Roadmap Didn’t Anticipate: Three Security Crises
#

The March roadmap devoted its Enterprise Readiness section to audit trails, SSO auth, and gateway patterns. What it didn’t model was the attack surface that rapid, broad MCP adoption would create.

April 2026 — STDIO Command Injection. OX Security found that MCP’s STDIO transport allowed malicious tool descriptions containing shell metacharacters to execute arbitrary OS commands. The vulnerability was present in Anthropic’s own spec and propagated into the Python, TypeScript, Java, and Rust official SDKs. More than 200,000 STDIO-based MCP servers were affected, including deployments in LiteLLM, LangChain, LangFlow, and Flowise. Anthropic’s position: “by design — sanitization is the developer’s responsibility.”

May 2026 — OAuth Token Hijacking. Mitiga Labs disclosed that a malicious npm package could silently rewrite ~/.claude.json to redirect MCP server connections through an attacker-controlled proxy, capturing OAuth tokens for every enterprise service connected via MCP. Token rotation doesn’t stop the attack because the malicious hook reasserts on every Claude Code reload. Anthropic classified the report out of scope.

These are distinct problems. The STDIO flaw is architectural — it’s in the transport layer that the roadmap was actively improving. The OAuth hijacking is a consequence of MCP’s trust model: once a connection is established, tokens flow broadly, and the config file that controls those connections is a plaintext file in the home directory with no integrity protection.

Both crises expose the same underlying gap. The roadmap’s enterprise readiness section focused on organizational auth — SSO, IdP integration, audit logs. It didn’t address the security boundary around the MCP trust model itself. What happens when ~/.claude.json is compromised? What happens when tool descriptions contain adversarial content? The protocol grew faster than the threat model.

Where the Roadmap Items Stand
#

Transport Scalability: Stateless multi-instance Streamable HTTP is in active development but not yet shipped as of May 2026. Teams running MCP servers behind load balancers still need sticky sessions.

Agent Communication (Tasks): Lifecycle rules for task retry and retention have been informally adopted in OpenAI and Google’s SDKs, but the core spec hasn’t been updated yet. SEP review times did improve after the governance delegation model was introduced.

Governance Maturation: The Contributor Ladder SEP shipped. WG-level delegation is in place for three working groups. This is working as intended.

Enterprise Readiness: The audit trail work has progressed via OpenTelemetry instrumentation. Enterprise auth remains a patchwork of custom implementations, which is part of why the OAuth hijacking attack is so impactful — there’s no standard hardening mechanism.

The Honest Assessment
#

Two months in, MCP has done what the roadmap said it would: it’s grown up as a governance structure and gained multi-vendor credibility. The protocol won. OpenAI’s adoption was the final confirmation.

The thing the roadmap underestimated was security. The same properties that make MCP powerful — broad tool access, persistent OAuth integrations, deep enterprise connectivity — make it a high-value target that the threat modeling hadn’t caught up with. The working group structure is the right mechanism to address this, but the security working group needs to be resourced as a priority, not an afterthought.

May 2026 update sources:

Update: Six Months Later (September 19, 2026)
#

By late May, this article’s own follow-up piece had already reported the stateless release candidate locking and Anthropic’s donation of MCP to the newly formed Agentic AI Foundation (AAIF). Four months on, that RC is finalized and shipped, the ecosystem has moved past it, and the security picture is worse in one respect, not better.

The roadmap items: mostly delivered
#

Transport Scalability — shipped. The 2026-07-28 spec release went final on schedule. Session management (the initialize/initialized handshake and Mcp-Session-Id header) is gone from the protocol core; any request can hit any server instance behind a plain round-robin load balancer, no sticky sessions required. New Mcp-Method/Mcp-Name headers enable header-based routing, and list results are now cacheable. This is the single biggest production-readiness item the original roadmap promised, and it landed.

Agent Communication (Tasks) — restructured, not just ratified. Rather than simply graduating from experimental to stable inside core, Tasks moved out of core entirely into an official extension (io.modelcontextprotocol/tasks) under a new Extensions Framework, per SEP-2663. Lifecycle is now tasks/get, tasks/update, tasks/cancel, with a keepAlive field governing retention — the concrete lifecycle rules this article’s March version said the spec was missing.

Governance Maturation — a bigger shift than “delegation.” The Contributor Ladder shipped and Working Groups can now triage their own domain proposals without a full core-maintainer vote, as planned. But the larger move happened underneath that: on March 20, Anthropic formally transferred MCP governance to the Agentic AI Foundation, with Anthropic, Block, and OpenAI as founders and Google, Microsoft, AWS, Cloudflare, Bloomberg, Intuit, Salesforce, and Snowflake as supporters. AAIF also adopted a three-stage project lifecycle (Growth/Impact/Emeritus), opening the umbrella to projects beyond MCP itself.

Enterprise Readiness — auth is no longer patchwork. The Enterprise-Managed Authorization (EMA) extension stabilized in June, implementing an Identity Assertion JWT Authorization Grant (ID-JAG) for centralized login across MCP servers — adopted by Anthropic, Microsoft, and Okta. The July 28 spec layered on issuer validation, issuer-bound client credentials, and Client ID Metadata Documents as the preferred client-registration path. Separately, OpenTelemetry merged standard MCP semantic conventions back in January, giving Grafana, Datadog, and Honeycomb users out-of-the-box trace/span attributes for tool calls — the audit-trail gap the original roadmap flagged now has a real answer.

SDK ecosystem — a major version bump. Both the TypeScript and Python SDKs went stable at v2.0.0 on July 27-28, tied to the stateless spec, with TypeScript splitting into separate client/server packages.

The security picture: one gap papered over, two still open, a third pattern emerging
#

Neither security crisis from the May update has actually been fixed. The STDIO command-injection flaw OX Security disclosed in April is still, per Anthropic’s own stated position, “by design” — no protocol-level or SDK-level mitigation has shipped; only downstream tools like LiteLLM patched independently. The OAuth token-hijacking technique Mitiga Labs reported is still “out of scope” by Anthropic’s own determination, with no patch planned; the trust model that lets a compromised ~/.claude.json silently redirect every connected MCP server’s tokens is unchanged.

What has changed is where the newest instance of this pattern showed up, and it’s not strictly an MCP flaw. This week’s Plugin4Shell disclosure — a Git-checkout verification bypass that defeats SHA-pinned plugin trust across Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI — runs over each agent’s own plugin-loading path, not over MCP transport. But it’s the same failure mode the STDIO and OAuth crises exposed in the MCP trust model: verification that looks cryptographically solid on paper (a pinned commit hash, an OAuth token, a tool-description schema) turns out to be trivially bypassable in practice, and fixing it is inconsistent across vendors — Anthropic and OpenAI patched their respective pieces, GitHub and Google didn’t. Three incidents into 2026, “AI coding tools trust more than they verify” is no longer an isolated finding, it’s the load-bearing critique of the entire ecosystem’s extensibility model.

Scale and convergence
#

Registry and download figures are murkier than the roadmap’s own milestone announcements made them look — the official registry counted 9,652 servers as of the May 24 snapshot, and aggregator sites (not a single authoritative source) put combined counts well above that by mid-year. Google’s competing A2A protocol joined the same AAIF/Linux Foundation umbrella as MCP around August, formalizing a two-layer reference architecture (MCP for tools, A2A for agent-to-agent coordination) rather than the two standards competing. Not every signal points toward consolidation, though: Perplexity said in March it was dropping MCP internally in favor of a plain REST-plus-API-key approach over context and auth overhead, and Cloudflare kept MCP for discovery but switched its own tool-calling to code generation — real, if minority, fragmentation pressure even as the core spec matures.

The honest assessment, six months in
#

The March roadmap’s non-security promises came true almost exactly as written: stateless transport, cleaner task lifecycle, working governance delegation, standardized enterprise auth. That’s a genuinely rare hit rate for a protocol roadmap. The security promise the roadmap never explicitly made — but that its enterprise-readiness section implied — hasn’t materialized at all. Two named, disclosed vulnerabilities sit unpatched for four-plus months on Anthropic’s own determination that they’re out of scope, and the newest related disclosure landed in a different but structurally identical part of the same trust model. A protocol can finish growing up organizationally while still leaving its actual attack surface exactly where it was in May.

September 2026 update sources:

Related