
The New MCP Roadmap
Official blog post from the Model Context Protocol Core Maintainers laying out the updated project roadmap, with a significant authorization/identity component: it recaps the 2026-07-28 spec release's security work (issuer validation, issuer-bound client credentials, Client ID Metadata Documents as the preferred client registration path, and a now-stable Enterprise-Managed Authorization extension) and names "Agent identity and enterprise-ready security" as a top priority going forward. That upcoming work covers finalizing DPoP, defining agent identity and delegation through Workload Identity Federation, the ID-JAG grant, and standard token exchange, plus deeper engagement with the IETF OAuth and WIMSE standards groups — aimed at moving MCP server authorization away from long-lived API keys toward cryptographically bound, delegated agent identities.
What it is
Roadmap post from the MCP Core Maintainers naming five priority areas for the next phase of protocol work: agentic messaging primitives, HTTP-native transport unification, agent identity and enterprise-ready security, improved primitives (tool result contracts and progressive tool discovery), and SDK developer experience. The existing summary covers the security track in detail; this document adds the other four tracks and the process mechanics around how MCP evolves.
How it works
Proposals (SEPs) that fall inside these five named areas get expedited maintainer review; SEPs outside them aren't rejected but compete for scarce review time behind these priorities. Each area has named Core Maintainers and one or more Working Groups responsible for it, and contributors are expected to raise a proposal with the relevant Working Group before submitting it. SEP-2133 lets any Working Group or Interest Group experiment in an experimental-ext- repository before writing a formal SEP, as a way to test ideas before committing to the spec-change process.
Preconditions / Affected
Relevant to anyone building MCP servers/clients, SDK authors, and SEP contributors. The transport-unification track specifically affects local servers currently speaking stdio — the roadmap's direction is to unify these onto Streamable HTTP, which would affect existing stdio-based server/client code going forward. The tool-discovery work targets servers with large tool catalogs (the post cites the "hundred tools" case) where context cost and tool-selection accuracy degrade as the list grows.
What to do
For contributors: identify which of the five priority areas a proposal belongs to and engage the matching Working Group first, since review bandwidth is allocated to these areas. For teams planning server work, the practical signal is the push toward one unified HTTP transport (including local/stdio deployments) and toward smaller initial tool surfaces with progressive discovery rather than exposing a full tool catalog upfront — both are design directions to anticipate rather than shipped behavior today.
Caveats
This is a direction-setting roadmap, not a shipped spec change — the four non-security tracks (messaging primitives, transport unification, improved primitives, SDK DX) are stated priorities with no dates, SEP numbers, or version targets given for completion.
Organisations named here
- DPoP
- ID-JAG
- IETF OAuth working group
- WIMSE working group
Technologies named here
- Client ID Metadata Documents
- Model Context Protocol
- Enterprise-Managed Authorization
- Demonstrating Proof of Possession
- OAuth
- Workload Identity Federation
Techniques named here
- Issuer validation
- Issuer-bound client credentials
Related in Identity & Access
Education Under Attack: The Pattern Behind Recent University Breaches
Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress
.png)
Google API keys keep working after you delete them
