# The New MCP Roadmap

> The MCP core team's new roadmap covers agentic messaging, transport unification, agent identity, tool-result contracts, and SDK developer experience.

Published: 2026-08-25
URL: https://daniliants.com/insights/the-new-mcp-roadmap/
Tags: mcp, ai-agents, oauth, tool-use

---

## Summary

The Model Context Protocol (MCP) core team published an updated roadmap covering five priority areas for the next specification cycle: agentic messaging primitives, HTTP-native transport unification, agent identity/security, improved tool-result contracts, and SDK developer experience. It follows a five-month cycle that already shipped stateless servers, cacheable capability discovery, and a reworked Tasks extension in the 2026-07-28 spec release.

## Key Insight

- **Sessions are gone from the protocol level.** The 2026-07-28 release removed the initialization handshake and protocol-level session state (SEP-2575, SEP-2567), so MCP servers can now scale horizontally like any stateless HTTP service - no sticky sessions, no session affinity needed at the load balancer.
- **Clients can now pre-negotiate before connecting.** A new `server/discover` call lets a client learn a server's supported versions and capabilities before doing anything else, and list results (tools/resources) are now cacheable with a TTL (SEP-2549) - cuts redundant round-trips on every session start.
- **Tool result format is still ambiguous and that's a named 2026 priority.** A `tools/call` response can express the same output in multiple shapes today, and servers have no way to know which shape a given client will actually put in front of the model - the roadmap commits to standardizing on one contract.
- **Tool-list bloat is explicitly called out as a model-cost problem.** Connecting to a server with 100 tools means the model pays token cost for the entire tool surface before a single user question - "tool selection tends to get worse as the list grows." The fix in progress is progressive discovery: a small entry point that reveals more of the catalog as the conversation narrows (relevant to anyone running MCP servers with large tool counts today).
- **Auth is moving away from static API keys toward agent-native identity.** Current MCP auth assumes a human approving access in a browser; the new work targets agents acting as their own cloud identity (not "on behalf of a present human") via DPoP (RFC 9449), Workload Identity Federation, ID-JAG token exchange, and Client ID Metadata Documents (CIMD) replacing manual client registration.
- **Server-initiated requests were replaced by a new pattern.** Multi Round-Trip Requests (SEP-2322) replaces server-initiated requests so elicitation-style flows (server asks the client/user something mid-task) still work even on stateless servers - this was a real architectural gap the old design couldn't solve cleanly.