Skip to content

Back to the catalog

The New MCP Roadmap
blog.modelcontextprotocol.ioarticle

The New MCP Roadmap

Official blog post from the Model Context Protocol Core Maintainers laying out the updated project roadmap, with a significant authorization/identity component: it recaps the 2026-07-28 spec release's security work (issuer validation, issuer-bound client credentials, Client ID Metadata Documents as the preferred client registration path, and a now-stable Enterprise-Managed Authorization extension) and names "Agent identity and enterprise-ready security" as a top priority going forward. That upcoming work covers finalizing DPoP, defining agent identity and delegation through Workload Identity Federation, the ID-JAG grant, and standard token exchange, plus deeper engagement with the IETF OAuth and WIMSE standards groups — aimed at moving MCP server authorization away from long-lived API keys toward cryptographically bound, delegated agent identities.

TL;DR MCP's official roadmap details authorization hardening already shipped and planned agent-identity work (DPoP, Workload Identity Federation, ID-JAG, CIMD) to replace static API keys for agentic workloads.
Also seen from another angle🧠 AI →
Document

What it is

Roadmap post from the MCP Core Maintainers naming five priority areas for the next phase of protocol work: agentic messaging primitives, HTTP-native transport unification, agent identity and enterprise-ready security, improved primitives (tool result contracts and progressive tool discovery), and SDK developer experience. The existing summary covers the security track in detail; this document adds the other four tracks and the process mechanics around how MCP evolves.

How it works

Proposals (SEPs) that fall inside these five named areas get expedited maintainer review; SEPs outside them aren't rejected but compete for scarce review time behind these priorities. Each area has named Core Maintainers and one or more Working Groups responsible for it, and contributors are expected to raise a proposal with the relevant Working Group before submitting it. SEP-2133 lets any Working Group or Interest Group experiment in an experimental-ext- repository before writing a formal SEP, as a way to test ideas before committing to the spec-change process.

Preconditions / Affected

Relevant to anyone building MCP servers/clients, SDK authors, and SEP contributors. The transport-unification track specifically affects local servers currently speaking stdio — the roadmap's direction is to unify these onto Streamable HTTP, which would affect existing stdio-based server/client code going forward. The tool-discovery work targets servers with large tool catalogs (the post cites the "hundred tools" case) where context cost and tool-selection accuracy degrade as the list grows.

What to do

For contributors: identify which of the five priority areas a proposal belongs to and engage the matching Working Group first, since review bandwidth is allocated to these areas. For teams planning server work, the practical signal is the push toward one unified HTTP transport (including local/stdio deployments) and toward smaller initial tool surfaces with progressive discovery rather than exposing a full tool catalog upfront — both are design directions to anticipate rather than shipped behavior today.

Caveats

This is a direction-setting roadmap, not a shipped spec change — the four non-security tracks (messaging primitives, transport unification, improved primitives, SDK DX) are stated priorities with no dates, SEP numbers, or version targets given for completion.

Organisations named here

  • DPoP
  • ID-JAG
  • IETF OAuth working group
  • WIMSE working group

Technologies named here

  • Client ID Metadata Documents
  • Model Context Protocol
  • Enterprise-Managed Authorization
  • Demonstrating Proof of Possession
  • OAuth
  • Workload Identity Federation

Techniques named here

  • Issuer validation
  • Issuer-bound client credentials