MCP Roadmap 2026-2027: The 2026-07-28 Spec and What Comes Next

The MCP Roadmap 2026 describes the evolution of the Model Context Protocol after the November 2025 spec line. The core movement: away from pure tool connectivity, toward enterprise readiness with auth, audit trails, registry, and discovery. The 2025-11-25 spec introduced experimental Tasks for long-running requests, URL mode elicitation, tool calling in sampling, and Client ID Metadata Documents. Since July 28, 2026, the 2026-07-28 spec has been in effect, with a stateless protocol core, server/discover, and Tasks as an official extension. Anything that comes after that is marked as a forecast in this article.

This article belongs to the hub The Future of Agentic AI (2026-2028) and takes a closer look at the integration layer that affects almost every production agent system in DACH companies in 2026.

• Status today (as of October 2026): MCP is the de facto integration layer for agent-to-tool. In December 2025, Anthropic reported more than 10,000 active public servers and more than 97 million monthly SDK downloads.
• Next step: The MCP maintainers' roadmap from August 2026 prioritizes agent identity and enterprise security, messaging primitives for longer-running agents, and a unified HTTP transport. Since December 2025, the Agentic AI Foundation (Linux Foundation) has been responsible for budget and strategy, not for the technical direction.
• Biggest open issue: Security. The protocol cannot verify tool descriptions. That is why sandboxing, least privilege, and controlled registries remain the operator's responsibility.

The starting point: what the 2025-11-25 spec line means

Anthropic introduced the Model Context Protocol on November 25, 2024, as an open standard for connecting AI applications to external systems such as file systems, databases, business systems, and dev tools. Technically, MCP rests on JSON-RPC 2.0 over several transports: stdio for local use, originally Server-Sent Events, and since the 2025-03-26 revision Streamable HTTP.

Development has moved in clear steps, and you need to know them to read the roadmap:

• March 2025 (2025-03-26): OAuth 2.1, Streamable HTTP, JSON-RPC batching, and tool annotations were added. This made MCP auth-capable in the enterprise sense for the first time.
• June 2025 (2025-06-18): JSON-RPC batching was removed again. Structured tool output and elicitation were added. Since then, MCP servers have been classified as OAuth resource servers, and clients must implement resource indicators as defined in RFC 8707.
• November 2025 (2025-11-25, the reference line): experimental Tasks for long-running requests with polling, URL mode elicitation, tool calling in sampling, Client ID Metadata Documents as the recommended client registration method, and OpenID Connect discovery.
• January 2026: MCP Apps (SEP-1865) became the first official extension on January 26, 2026. It delivers interactive UI from MCP servers to host applications such as Claude and ChatGPT.

Then there is a governance event: on December 9, 2025, Anthropic donated MCP to the newly founded Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation. The AAIF was founded by Anthropic, Block, and OpenAI; alongside them, AWS, Bloomberg, Cloudflare, Google, and Microsoft are Platinum members, joined by Cisco, IBM, Okta, Oracle, SAP, and Snowflake, among others. According to the MCP project, the technical direction and the roadmap stay with the maintainers; the foundation board decides on strategic investments, budget, and new members. For DACH decision-makers, this means MCP is a vendor-neutral standard and no longer a bet on a single provider. That significantly lowers the lock-in risk in procurement.

The 2026-07-28 spec: what actually came after 2025-11-25

The successor spec is no longer an outlook. The release candidate came out on May 21, 2026, and the final 2026-07-28 spec on July 28, 2026, together with updated Tier 1 SDKs for TypeScript, Python, Go, and C#. The key changes according to the official changelog:

• Stateless core: The initialize and notifications/initialized handshake is gone, as is the Mcp-Session-Id header. Every request carries its protocol version and client capabilities itself. If a server needs state across several calls, it issues its own handles for that, which come back as regular tool arguments.
• server/discover: Every server must offer this RPC and use it to report protocol versions, capabilities, and its identity. Clients can call it before the first request.
• Extensions framework: Client and server negotiate optional extensions through a dedicated field in their capabilities. Tasks move out of the experimental core into the official extension io.modelcontextprotocol/tasks. The blocking tasks/result is dropped; the client now retrieves results only by polling via tasks/get.
• Multi Round-Trip Requests (MRTR): Instead of sending its own server requests for Roots, Sampling, or elicitation, the server returns an intermediate result with the status input_required. The client repeats the original request with the missing information.
• Deprecations: Roots, Sampling, and Logging are deprecated but will keep working for at least twelve months. Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents. The HTTP+SSE transport, already superseded since 2025-03-26, is now formally deprecated.

This is the real leap from a tool-calling protocol to an infrastructure building block. According to the maintainers' current roadmap, a remote MCP server is now no different from any other HTTP workload. If you migrate a server from 2025-11-25 to 2026-07-28, you mainly have to rework session logic and server-side requests.

Where MCP stands today (as of October 2026)

The numbers show that MCP has left the experimental phase. When MCP was handed over to the Agentic AI Foundation on December 9, 2025, Anthropic cited more than 10,000 active public MCP servers and more than 97 million monthly SDK downloads across Python and TypeScript.

In practical terms: SAP Joule Studio 2.0 integrates MCP natively (MCP servers for ABAP, LeanIX, Integration Suite), and Microsoft 365 Copilot, Copilot Studio, Salesforce Agentforce, n8n, LangGraph, Mastra, and PydanticAI speak MCP. If you start an agent project in 2026, you will write or consume MCP servers, whether you plan to or not.

What matters for the architecture decision is the distinction from A2A (agent-to-agent). MCP is the foundation for agent-to-tool. It can be repurposed to expose an agent as a "server" with tool-shaped capabilities, but it was not built for that. The A2A project under the Linux Foundation, whose founding members include Google and Microsoft, draws the line between the two protocols in its documentation as follows: MCP connects an agent to its tools, A2A connects agents to each other.

The MCP roadmap 2026-2027: priorities and forecast

The maintainers' priorities are published; the stages after that are forecasts, not facts. With AI roadmaps, the timing is far less certain than the direction.

The MCP maintainers' roadmap of March 9, 2026 set four focus areas, among them enterprise readiness with four gaps: audit trails, SSO-integrated auth, gateway behavior, and configuration portability. According to the maintainers, all four focus areas have made significant progress since then; most of these changes landed in the 2026-07-28 spec. For enterprise readiness, that mainly meant auth work: Client ID Metadata Documents are now the preferred registration path, Dynamic Client Registration is deprecated, and Enterprise-Managed Authorization is available as a stable extension. On audit trails, gateway behavior, and configuration portability, the new roadmap gives no update. The roadmap of August 22, 2026 sets five priorities:

• Messaging primitives for agents: server-side events via webhooks and channels; the Tasks extension is meant to mature far enough to be included in the spec.
• Unified HTTP transport: Local servers are also meant to speak Streamable HTTP in the future, carried over stdio, so that only one transport remains.
• Agent identity and enterprise security: a standard for trusted agent identities, built on DPoP and Workload Identity Federation instead of pasted-in API keys and long-lived tokens.
• Improved primitives: a unified format for tool results and incremental tool discovery.
• Better SDKs: ergonomics, spec conformance, and documentation.

From this, you can derive the expected trajectory:

Our assessment of the next stages:

• 2027: MCP servers become the standard enterprise integration. Enterprise-readiness extensions (SSO, audit trails, gateway policies) stabilize. Companies should expect their major SaaS providers to ship official remote MCP servers as a procurement default.
• 2028: MCP-equivalent patterns spread to non-LLM AI (vision, voice-native, robotics). The "agentic mesh" architecture consolidates: MCP for agent-to-tool, A2A or successor protocols for agent-to-agent.

The open issues: security, registry, trust

The biggest unresolved question is security. Most of the attacks documented in 2025 target the same weakness: hosts pass tool descriptions to the model without vetting them. In April 2025, Invariant Labs criticized MCP's security model for assuming trustworthy tool descriptions. The 2026-07-28 spec states that descriptions of tool behavior should be considered untrusted unless they come from a trusted server. MCP cannot enforce this at the protocol level. Syntactically correct descriptions therefore easily pass as safe, even when they contain hidden instructions. The most important attack patterns:

• Indirect prompt injection via MCP server descriptions.
• Tool poisoning: Invariant Labs demonstrated this in April 2025 with a WhatsApp proof of concept.
• Look-alike server squatting: servers with deceptively similar names.
• Full-schema poisoning (CyberArk): Every part of a tool schema is a potential injection point, not just the description.
• GitHub MCP "Toxic Agent Flow": a malicious GitHub issue tricks the agent into leaking data from private repos.

As of 2026, securing MCP is the operator's responsibility, not the protocol's: sandboxing, scope-limited tokens, least privilege, and above all no autonomous installation of MCP servers from an unvetted registry. This is exactly where the second open issue comes in: registry and discovery. Large enterprises today run internal MCP server registries with strict access control and put servers behind OAuth 2.1. For cross-vendor discoverability, AGNTCY's OASF directory is emerging as a plausible form, still on watchlist status and not an established standard.

Practical example: MCP tool layer in a DACH enterprise

The reference setup for a DACH enterprise (AI Center of Excellence, 10-30 FTE, hub-and-spoke) shows what this looks like in practice. The tool layer here is built entirely on MCP, with an internal registry and OAuth 2.1 as mandatory requirements. Our recommended rollout sequence:

1. Standardize the MCP server policy (registry, access, OAuth 2.1).
2. Introduce A2A within a single estate first (e.g., Salesforce only).
3. Expand to a second estate (e.g., SAP).
4. Publish an AgentCard registry.
5. Add cross-vendor identity (AGNTCY) only once the volume justifies it.

A practical mandatory step from day one: push a single trace ID through every A2A task and every MCP call. Otherwise you get audit gaps in which the logs of one estate cannot be correlated with those of another. Without this discipline, a multi-agent system is effectively impossible to investigate when a supervisory authority makes an inquiry. The cost of the first platform year depends mainly on whether a single-vendor setup is extended or a genuine cross-vendor mesh with sovereign hosting is built.

What this means for agencies and B2B

For agencies and AI-native product providers, MCP is the lever for productization: a shared MCP server repository across all client projects, plus vertical custom servers (for example, an SEO keyword research server or an internal CMS server). If you build cleanly here, you sell integrations instead of one-off solutions.

For B2B decision-makers, the procurement question is central: does the contract with Agentforce, Joule, or Copilot Studio guarantee compliance with the MCP standards, and what happens on exit? MCP as a vendor-neutral standard under the Linux Foundation is the best available safeguard against platform lock-in, but only if registry governance, OAuth 2.1 security, and audit-trail discipline are built in from the start. Our page on AI agent integration for companies shows how we implement this in projects.

If you want to follow how the MCP roadmap, the spec releases, and the security debate develop without researching it yourself every week: our newsletter collects the relevant developments in agentic AI for the DACH market. Precise, without hype, with a clear separation between fact and forecast.