The New MCP Roadmap

> With the 2026-07-28 release, a remote MCP server is now no different from any other HTTP workload

Good. Introducing a bespoke new protocol was one of the more bone-headed things MCP did on initial release.

I am very curious how many MCP servers will actually implement all of this:

"MCP authorization today is built around a person approving access in a browser. That works well for interactive clients, but more and more of the callers are agents running as cloud workloads with their own identity, acting on behalf of a user who isn’t present, or delegating narrower authority to sub-agents. We want MCP servers to have a standardized way to recognize and trust those agent identities, built on existing standards rather than pasted API keys and long-lived tokens.

The work here covers finalizing Demonstrating Proof of Possession (DPoP) and driving its adoption, and defining an opinionated path for agent identity and delegation through Workload Identity Federation, the ID-JAG grant behind Enterprise-Managed Authorization, and standard token exchange. We will also continue to grow our engagement with the OAuth standards bodies, including the IETF OAuth and WIMSE working groups, to help the underlying standards evolve with the building blocks that agent identity needs."

Raise your hand if you have never touched MCP and are missing nothing.

I probably build more novel AI software than anyone at FAANG (can the employees who weren’t laid off even code anymore?) and never needed this hype.

Why do people think they need this

In v.1 making MCP stateful was such a deployment-unfriendly way to do it - you need a complicated persistence layer for it to work.

All while it is just a fancy way make your OpenSchema PAI visible to AI.

> We’re starting a progressive discovery effort so a server can offer a small entry point and reveal more of its catalog as the conversation narrows.

Kind of late to the party. I've had to implement lazy loading of mcps in a couple of harnesses now but am moving to implement everything as code mode instead.

This reminds me of the actor model[1]

[1] https://doc.akka.io/libraries/akka-core/current/typed/actors...

Half the battle is just knowing this exists

Sometimes I really respect senior developers. When specs change, you obviously have to update existing work too. Looking at this MCP change, it seems like it's becoming stateless—I'm already wondering how to adapt.

Senior programmers always advised me to only use things that have been around for at least three years. Now I finally understand why.

> With the 2026-07-28 release, a remote MCP server is now no different from any other HTTP workload

Good. Introducing a bespoke new protocol was one of the more bone-headed things MCP did on initial release.

In v.1 making MCP stateful was such a deployment-unfriendly way to do it - you need a complicated persistence layer for it to work.

All while it is just a fancy way make your OpenSchema PAI visible to AI.

This reminds me of the actor model[1]

[1] https://doc.akka.io/libraries/akka-core/current/typed/actors...

Half the battle is just knowing this exists

Senior programmers always advised me to only use things that have been around for at least three years. Now I finally understand why.

I am very curious how many MCP servers will actually implement all of this:

Raise your hand if you have never touched MCP and are missing nothing.

I probably build more novel AI software than anyone at FAANG (can the employees who weren’t laid off even code anymore?) and never needed this hype.

Why do people think they need this

> We’re starting a progressive discovery effort so a server can offer a small entry point and reveal more of its catalog as the conversation narrows.

Kind of late to the party. I've had to implement lazy loading of mcps in a couple of harnesses now but am moving to implement everything as code mode instead.

Hopefully quite a few.

I really love the idea of fully enabled agents and being able to cut down on human in the loop moments.

Things like https://projects.dev/ for example.

A ton of security problems and others to solve but it's still where I want the future of all this to go.

Why, directionally all of them. What they say is obviously true. Having to manually click things in the browser is a bottleneck and will be less and less acceptable for serious users.

And the individual work attached to making that transition will be done by agents.

agree. it seems there are two streams and they could diverge or converge?

1. workloads use existing credentials support RFC 7523 and OIDC discovery, 'trust the trust (credentials) which has already been established'. basically extend current dominant NHI paradigm.

2. DPoP mandate a signed proof for each request. so tie credential to a client-held key and specific request detail or context. viable to do at scale with #1, or does it diverge (e.g. because most #1 methods as most are not designed for DPoP?

Such an example of overengineering, why not just use OAuth?

Even now, the mcp server itself doesn't have to implement all of the possible security options. You can use something like agentgateway to act as an auth proxy for your mcp servers.

I use Pi and I’m coming to the conclusion that mostly all I need is a bash tool.

I agree, I've found MCP to be a waste of time. Any HTTP API + OpenAPI spec is sufficient to get my agents to do anything they need to do. Bonus that it just uses regular HTTP semantics and all the tools and infrastructure that have been developed around that for decades. Instead of some inscrutable json RPC POST-only payload that needs tons of custom tooling for introspection, logging, etc.

So I’ve been working on a personal finance app, and I added an MCP to it. Connected my Claude to it, mainly for testing purposes.

The other day I was heading to Home Depot to buy some gardening stuff and I was asking some some questions around what I could plant at this time and still harvest before winter.

It answers me, then brings up how my home improvement budget is nearing its limit for the month. I then ask it how I’m doing on my wider retirement plan and it mentions I’m a few thousand dollars ahead of schedule for the plan. So I decided it’s okay to go over budget on that category this month.

This type of emergent behavior of agents you work with having more context about you, it’s very useful in ways I didn’t expect.

If you need to give access to your CRM/ERP system from ChatGPT / Claude desktop for non-tech users, MCP is the way.

I build integration for DollarDeploy but it was tricky.

Because you're a dev thinking for devs. No 60 year old is going to use Claude skills with the CLI. If my customers want their AI to interact with my product and MCP is the best way about it.

What do you mean "as code mode"?