> With the 2026-07-28 release, a remote MCP server is now no different from any other HTTP workload
Good. Introducing a bespoke new protocol was one of the more bone-headed things MCP did on initial release.
I am very curious how many MCP servers will actually implement all of this:
"MCP authorization today is built around a person approving access in a browser. That works well for interactive clients, but more and more of the callers are agents running as cloud workloads with their own identity, acting on behalf of a user who isn’t present, or delegating narrower authority to sub-agents. We want MCP servers to have a standardized way to recognize and trust those agent identities, built on existing standards rather than pasted API keys and long-lived tokens.
The work here covers finalizing Demonstrating Proof of Possession (DPoP) and driving its adoption, and defining an opinionated path for agent identity and delegation through Workload Identity Federation, the ID-JAG grant behind Enterprise-Managed Authorization, and standard token exchange. We will also continue to grow our engagement with the OAuth standards bodies, including the IETF OAuth and WIMSE working groups, to help the underlying standards evolve with the building blocks that agent identity needs."
Even now, the mcp server itself doesn't have to implement all of the possible security options. You can use something like agentgateway to act as an auth proxy for your mcp servers.
> We’re starting a progressive discovery effort so a server can offer a small entry point and reveal more of its catalog as the conversation narrows.
Kind of late to the party. I've had to implement lazy loading of mcps in a couple of harnesses now but am moving to implement everything as code mode instead.
What do you mean "as code mode"?
Basically https://blog.cloudflare.com/code-mode/
I was getting fed up with AWS mcp telling me it is eol.
Raise your hand if you have never touched MCP and are missing nothing.
I probably build more novel AI software than anyone at FAANG (can the employees who weren’t laid off even code anymore?) and never needed this hype.
Why do people think they need this
This reminds me of the actor model[1]
[1] https://doc.akka.io/libraries/akka-core/current/typed/actors...
Sometimes I really respect senior developers. When specs change, you obviously have to update existing work too. Looking at this MCP change, it seems like it's becoming stateless—I'm already wondering how to adapt.
Senior programmers always advised me to only use things that have been around for at least three years. Now I finally understand why.
[flagged]