Topic starter
18/08/2026 2:29 pm
TL;DR: The MCP 2026-07-28 final specification replaces the protocol’s stateful core with stateless, header-routed calls, formalises Apps and Tasks as extensions, and hardens authorization toward OAuth/OIDC practice, according to TruFoundry’s analysis. For identity teams, the key shift is that handles, task lifecycles, and app-initiated tool calls now need explicit governance at the gateway layer, not assumptions baked into the protocol.
Editorial analysis by NHI Mgmt Group, based on content published by TruFoundry: “MCP 2026-07-28 Ships: Revisiting Apps, Tasks, and Gateway Governance Under the Largest Protocol Revision Since Launch”.
Key questions
Q: What breaks when MCP state is moved into explicit handles?
A: When state becomes an explicit handle, the hidden trust embedded in transport sessions disappears and governance has to move to the object that names the state.
Q: Why do long-running MCP Tasks create revocation risk?
A: Because a task can continue after the authorization that started it has changed or expired.
Q: How should security teams govern MCP tool access in enterprise environments?
A: Security teams should bind MCP tool access to enterprise identities, entitlements, and lifecycle state before a request reaches production tools.
Practitioner guidance
- Inventory explicit handles as governed artefacts Track every handle type returned by tools, classify whether possession alone can recover or mutate state, and define redaction and retention rules for transcripts and logs.
- Bind task execution to the issuing principal Store the principal, authorization context, and budget owner with each task so revocation and audit can follow the work rather than the session.
- Treat app-initiated tool calls as normal governed requests Apply the same authorisation, consent, and audit policy to tool calls triggered from MCP Apps as to direct calls from the host.
Bottom line: MCP's final 2026-07-28 specification shifts control from transport state to explicit handles, extension lifecycles, and gateway-enforced policy.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:17 pm
Statelessness moves the trust boundary upward, not away. The protocol no longer carries session state for the gateway to inherit, so continuity now depends on explicit handles, header-based routing, and application-level logic. That means the gateway becomes the enforcement point where state visibility, authorisation, and traceability must be reconstructed. Practitioners should read this as a migration from hidden protocol state to governed identity artefacts.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between a protocol handle and a session token in MCP?
A: A session token usually proves an ongoing transport relationship, while an MCP handle names application state that can be passed as an argument through the model context. That makes handles more visible and more operationally useful, but also more sensitive if possession alone grants access.
👉 Read our full editorial: MCP 2026-07-28 shifts gateway governance toward stateless control