The New MCP Roadmap

My notes

Summary

The Model Context Protocol (MCP) core team published an updated roadmap covering five priority areas for the next specification cycle: agentic messaging primitives, HTTP-native transport unification, agent identity/security, improved tool-result contracts, and SDK developer experience. It follows a five-month cycle that already shipped stateless servers, cacheable capability discovery, and a reworked Tasks extension in the 2026-07-28 spec release.

Key Insight

• Sessions are gone from the protocol level. The 2026-07-28 release removed the initialization handshake and protocol-level session state (SEP-2575, SEP-2567), so MCP servers can now scale horizontally like any stateless HTTP service - no sticky sessions, no session affinity needed at the load balancer.
• Clients can now pre-negotiate before connecting. A new server/discover call lets a client learn a server’s supported versions and capabilities before doing anything else, and list results (tools/resources) are now cacheable with a TTL (SEP-2549) - cuts redundant round-trips on every session start.
• Tool result format is still ambiguous and that’s a named 2026 priority. A tools/call response can express the same output in multiple shapes today, and servers have no way to know which shape a given client will actually put in front of the model - the roadmap commits to standardizing on one contract.
• Tool-list bloat is explicitly called out as a model-cost problem. Connecting to a server with 100 tools means the model pays token cost for the entire tool surface before a single user question - “tool selection tends to get worse as the list grows.” The fix in progress is progressive discovery: a small entry point that reveals more of the catalog as the conversation narrows (relevant to anyone running MCP servers with large tool counts today).
• Auth is moving away from static API keys toward agent-native identity. Current MCP auth assumes a human approving access in a browser; the new work targets agents acting as their own cloud identity (not “on behalf of a present human”) via DPoP (RFC 9449), Workload Identity Federation, ID-JAG token exchange, and Client ID Metadata Documents (CIMD) replacing manual client registration.
• Server-initiated requests were replaced by a new pattern. Multi Round-Trip Requests (SEP-2322) replaces server-initiated requests so elicitation-style flows (server asks the client/user something mid-task) still work even on stateless servers - this was a real architectural gap the old design couldn’t solve cleanly.