Claude✓ ReviewedTry itChecked 3 September 2026MCP grew up: stateless, versioned and wired for enterprise identity.
The MCP 2026-07-28 update moves the protocol to a stateless request-response core, versions its extensions, and aligns auth with OAuth 2.0 and OIDC so connectors can be provisioned through Entra or Okta.
Bit’s takeaway
What changed
Anthropic brought the MCP 2026-07-28 revision to Claude. The protocol's core became stateless request-response, which suits serverless and edge deployment; MCP Apps and Tasks moved under a versioned extensions framework for interactive UI and long-running work; and authorisation now follows production OAuth 2.0 and OIDC, connecting to enterprise identity systems. Claude's connector directory already lists more than 950 MCP servers.
Why it matters
MCP is becoming the plumbing every agent shares, and plumbing standards decide security posture for everyone downstream. Identity-integrated auth means connector access can finally follow your organisation's real permission structure instead of pasted API keys, for teams that actually wire it up.
Who should care
- Teams building or operating MCP servers for agents
- IT admins provisioning connectors through Entra or Okta
What to do
If you run MCP servers, plan the move to the stateless revision and OAuth-based auth deliberately rather than on failure. If you administer Claude, review which connectors your organisation trusts now that provisioning can go through your identity provider.
The human take
Tools change fast. Your judgment matters more.
A person still decides which connectors the organisation trusts; the protocol only makes that decision enforceable.
Affected guidance
Put this to work
Verified facts
- Anthropic brought the MCP 2026-07-28 revision to Claude: a stateless request-response core, versioned Apps and Tasks extensions, and authorisation aligned with OAuth 2.0 and OIDC for enterprise identity systems.Checked
Sources and method