The Model Context Protocol team published an updated roadmap this week, and it's worth reading beyond the headline. The previous roadmap from March targeted four areas: transport evolution, agent communication, governance, and enterprise readiness. They delivered on all four.

The changes landed in the 2026-07-28 spec release — and the biggest one is architectural.

"Protocol-level sessions and the initialization handshake are gone, so a server can scale horizontally without holding state."

That's not a minor tweak. That's MCP crossing from "interesting protocol" to "just another HTTP workload you can run anywhere."

What actually shipped

  • Stateless + sessionless by default — servers no longer hold per-client state. Horizontal scaling is now trivial (SEP-2575, SEP-2567)
  • server/discover — clients can probe supported versions and capabilities before connecting
  • Cacheable list results — less round-trip chatter for tool discovery (SEP-2549)
  • Tasks extension reworked — moved into an official extension after early adopter feedback (SEP-2663)
  • Multi Round-Trip Requests — replaced server-initiated requests so elicitation works on stateless servers (SEP-2322)
  • Enterprise auth hardened — issuer validation, issuer-bound client credentials, Client ID Metadata Documents (CIMD), and Enterprise-Managed Authorization now stable

What the new roadmap prioritises

Five areas, each with dedicated Working Groups:

Agentic messaging primitives — server-initiated events (webhooks and channels, so clients stop polling), plus maturing Tasks into the core spec. The goal: MCP handles long-running agentic loops natively.

HTTP-native transport unification — unify stdio and Streamable HTTP under one transport model. A local MCP server and a cloud-hosted one should behave identically.

Agent identity — this is the one worth watching. Today auth is built around a human approving in a browser. That doesn't work for agent-to-agent calls or unattended cloud workloads. The roadmap targets DPoP, Workload Identity Federation, and standard token exchange — with active engagement in IETF OAuth and WIMSE standards bodies.

Improved primitives — two specific problems: tools/call responses can carry output in multiple forms with no contract for which one clients use, and large tool catalogs (100+ tools) waste context tokens before a user asks anything. Progressive discovery is the proposed fix.

SDK developer experience — conformance testing, better docs, making it easier to build MCP clients and servers whether you're writing the code yourself or pointing an agent at the libraries.

What to do

  • Running MCP servers? The stateless shift is the most operationally significant change. Review SEP-2575 if you haven't — your deployment model may be able to simplify significantly.
  • Building agent-to-agent flows? The agent identity work is directly relevant. Watch the DPoP and Workload Identity Federation threads — pasting API keys between agents is the pattern they're replacing.
  • Shipping large tool catalogs? Progressive discovery is coming. Hold off on complex client-side filtering hacks and track SEP progress.
  • Want to contribute? Each priority area has a Working Group with open seats. Discord is the entry point.

The full roadmap is at modelcontextprotocol.io/development/roadmap.

✏️ Drafted with KewBot (AI), edited and approved by Drew.