The Model Context Protocol (MCP), the open standard that increasingly connects AI agents to existing software, has received its largest update since Anthropic released it. The Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, published the changes, which complete MCP's migration to a fully stateless architecture, harden authentication against a known class of attacks, introduce a formal 12‑month deprecation policy, and promote two headline capabilities — interactive server-rendered interfaces (MCP Apps) and long‑running asynchronous tasks (MCP Tasks) — to official protocol extensions.
Why stateless architecture matters
Under the previous design, an MCP client — the AI application issuing requests — needed a persistent session with a specific server instance. In modern cloud environments where interchangeable compute nodes are spun up and down behind load balancers, that requirement made production deployments fragile: if the server holding session state disappeared, an agent's work disappeared with it. The new release removes that constraint, allowing MCP servers to run behind standard load balancers and use existing Kubernetes and cloud‑native DevOps tooling.
David Soria Parra, MCP co‑creator and a lead maintainer at Anthropic, described the change as probably the biggest protocol modification they've made and a major step toward enterprise usage.
Trade‑offs of removing state
The maintainers were explicit about costs. First, payloads generally grow because much of the state is carried over the wire between client and server. Soria Parra noted these payloads are highly compressible and remain relatively small compared with typical web HTTP requests.
Second, a few rarely used features were removed or narrowed. For example, out‑of‑band server logging — where a server could push informational log messages to a client at any time — is no longer supported; the team found very few users on GitHub who relied on it.
Den Delimarsky said the change is better framed as moving responsibility for creating and managing state to developers, intentionally simplifying the protocol surface so teams can manage state in ways that suit their environments. For most developers migration should be almost painless because official SDKs in TypeScript, Python, C#, Rust, Java, and other languages will absorb the changes.
Twelve‑month deprecation policy for enterprise stability
One of the most enterprise‑oriented parts of the release is policy rather than code: a formal deprecation framework guaranteeing a minimum of twelve months between a feature's deprecation announcement and its earliest possible removal. The timeline emerged after consultations with large vendors including Google, Microsoft, and Amazon; maintainers said twelve months struck a reasonable middle ground.
Soria Parra added that their telemetry shows most of the ecosystem upgrades within six to eight months, and described the 12‑month period more as a listening window than a strict countdown.
Authentication hardening closes mix‑up attacks
The update also tightens authorization, bringing MCP's auth specification in line with how OAuth 2.0 and OpenID Connect are deployed in practice. The protocol now enforces mandatory validation of the issuer (iss) parameter, a protocol‑level defense the announcement says closes a class of mix‑up attacks where a client could be tricked into associating an authorization response with the wrong identity server.
Maintainers say this was preventive engineering rather than incident response; no active exploitations were reported. The new Enterprise Managed Authorization extension, developed closely with Okta, enables organizations to make their corporate identity provider the authoritative gatekeeper for MCP server access, allowing centralized governance so that users authenticate with corporate credentials rather than personal ones.
Delimarsky said additional proposals are under consideration, such as proof‑of‑possession and workload identity federation, features requested by security teams running MCP in production.
MCP Apps and MCP Tasks become official extensions
Two capabilities were promoted to official extension status under a new framework that lets extensions evolve independently of the core spec:
- MCP Apps enables servers to deliver rich, interactive, server‑rendered user interfaces to AI clients — introducing dashboards, forms, and visualizations into agent outputs.
- MCP Tasks addresses long‑running work by returning durable task handles so clients can disconnect, crash, restart, and resume polling rather than keeping fragile long‑lived connections open.
A related addition, multi‑round‑trip requests, lets servers and clients negotiate back and forth within a single logical operation to gather the right parameters for actions.
Soria Parra said these capabilities and the architectural overhaul were driven by heavy production users, with input from distributed systems experts at Microsoft, Google, and others.
Governance and Anthropic's role under the Linux Foundation
Anthropic created MCP in November 2024 and donated it to the Agentic AI Foundation under the Linux Foundation in December 2025, alongside founding projects from Block and OpenAI. The maintainer group now includes Anthropic, Microsoft, OpenAI, Google, and Amazon, with contributions from other companies such as Block.
Soria Parra acknowledged he retains technical veto rights as a lead maintainer and Anthropic employee but said they have never actively used that power. Mazin Gilbert, AAIF executive director, stated the foundation's membership grew from about 40 at its December inauguration to 240 today, calling it the fastest‑growing foundation in Linux Foundation history by membership.
Gilbert estimated Anthropic's share of contributions has fallen below half and emphasized that neutrality requires letting go and expanding community contribution. The membership has widened beyond tech vendors into retail, finance, and telecom, and now includes organizations such as CERN and Consumer Reports.
Global engagement amid geopolitical tensions
The AAIF plans AGNTCon and MCPCon events this fall in Shanghai, Tokyo, Amsterdam, and San Jose, with more events planned in South Korea, Nairobi, and Toronto. Gilbert emphasized model‑agnosticism: MCP should be supported by any model regardless of origin so that enterprises can pick models based on task needs.
He argued the combination of an open standard, stateless scalability, and neutral governance is what builds enterprise trust — the same three properties that established HTTP as a global standard.
Adoption and next steps
Maintainters highlighted rapid ecosystem growth: SDK downloads have doubled in the past six months and now reach roughly 250 million per week. For comparison, Anthropic reported 97 million monthly downloads across the Python and TypeScript SDKs when it donated the protocol in December 2025.
Success will be measured by server deployments on the new spec, feedback through working groups and GitHub discussions, and whether large industry contributors such as Microsoft and Google ship on the specification. Soria Parra and Den Delimarsky stressed the release reflects broad community effort rather than any single company's work.
Mazin Gilbert is already looking ahead to how MCP will interlock with the AAIF's Agent Gateway project for traffic management and policy enforcement, and to agentic commerce scenarios where MCP serves as a discovery layer for merchants exposing products and services to AI agents. By Gilbert's reckoning, the internet of agents is in its early years — and with this release, it has core infrastructure capable of carrying significant production load.
