MCP Spec Overhaul Drops Stateless HTTP, New Auth Standards, and Enterprise Identity Controls in July 2026 Revision
Summary
The July 2026 MCP spec revision delivers breaking changes including stateless HTTP transport, new enterprise identity controls, and six authorization standards, fundamentally reshaping how AI agents authenticate, scale, and operate across organizations.
Key Points
- The July 2026 MCP spec revision introduces breaking changes including stateless HTTP transport, removal of initialization handshakes, and Multi Round-Trip Requests (MRTR), making servers easier to scale and load balance while shifting identity and session security responsibilities directly onto server implementations.
- Six new authorization SEPs formalize best practices for mature authorization servers, covering issuer validation, OIDC client types, credential binding, refresh tokens, scope step-up, and discovery, while Dynamic Client Registration is officially deprecated in favor of Client ID Metadata Documents.
- Enterprise-Managed Authorization (EMA) makes its official spec debut, replacing consent sprawl with enterprise IdP-driven access control using Cross-App Access and Identity Assertion JWTs, giving admins centralized governance over agent permissions across their organizations.