Notifications
Clear all
Topic starter
18/08/2026 2:29 pm
TL;DR: The MCP 2026-07-28 final specification replaces the protocol’s stateful core with stateless, header-routed calls, formalises Apps and Tasks as extensions, and hardens authorization toward OAuth/OIDC practice, according to TruFoundry’s analysis. For identity teams, the key shift is that handles, task lifecycles, and app-initiated tool calls now need explicit governance at the gateway layer, not assumptions baked into the protocol.
NHIMG editorial — based on content published by TruFoundry: MCP 2026-07-28 Ships: Revisiting Apps, Tasks, and Gateway Governance Under the Largest Protocol Revision Since Launch
By the numbers:
- While 71% of IT teams have been advised on AI agent data access, only 47% of compliance teams, 39% of legal teams, and 34% of executives have the same visibility.
Questions worth separating out
Q: How should security teams govern explicit handles in stateless MCP workflows?
A: Security teams should treat explicit handles as capability-bearing artefacts, not as harmless reference strings.
Q: Why do AI coding tools increase governance risk for IAM and NHI teams?
A: AI coding tools increase governance risk because they obscure who created the logic, which identities executed it, and whether the resulting automation has the right access scope.
Q: What do organisations get wrong about MCP Apps and trusted client chrome?
A: They often confuse a trusted interface with trusted content.
Practitioner guidance
- Inventory MCP clients by protocol version and feature use Capture client identity, protocol version, and active feature flags at the gateway so teams can see which consumers still depend on legacy sessions, experimental Tasks, or deprecated transports.
- Treat handles as security-sensitive capability artefacts Authorize each handle use against the current principal, avoid embedding secrets in handle values, and log or redact handle strings according to policy.
- Bind every task to a principal and authorization context Persist the creator identity, task budget, and revocation state for each long-running workflow so tasks/get and cooperative tasks/cancel do not become blind continuation paths.
What's in the full article
TruFoundry's full analysis covers the operational detail this post intentionally leaves for the source:
- Spec-by-spec migration implications for teams still running against the 2025-11-25 experimental Tasks API
- Gateway implementation detail for protocol version inventory, caller tracing, and deprecation tracking
- Deeper examples of how MCP Apps forward tool calls while keeping ui/* traffic host-side
- The full breakdown of which spec deltas change host, client, and gateway responsibilities in production
👉 Read TruFoundry's analysis of the MCP 2026-07-28 specification changes →
MCP 2026-07-28 revision: what changes for gateway governance?
Explore further
18/08/2026 3:17 pm
Stateless protocol design does not remove the governance problem, it relocates it. The final MCP revision makes the gateway, headers, and application-layer handles the real control plane. That is a better fit for enterprise enforcement, but only if teams stop assuming the protocol itself carries stateful security guarantees. The practitioner conclusion is that state visibility has become the new governance boundary.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How should teams retire deprecated MCP features without creating migration surprises?
A: Teams should build a live inventory of callers, feature dependencies, and protocol versions before setting retirement dates. Deprecation policy only works when it is tied to actual usage. Without that visibility, removal windows become incident windows, especially for legacy transports and experimental APIs.
👉 Read our full editorial: MCP 2026-07-28 shifts gateway governance toward stateless control
