Week of July 25 – August 1, 2026
MCP Went Stateless, and the Whole Network Shipped It in Three Days
Last week I closed this newsletter by telling you to plan for the protocol to move under you. It moved eight days later. On July 28th the Model Context Protocol shipped a new revision that deletes protocol-level sessions, the initialize handshake, the GET stream endpoint, and SSE resumability, and starts a twelve-month clock on Roots, Sampling, and Logging. A client speaking the new revision cannot talk to a server speaking the old one, and the reverse fails too. There is no clever upgrade path. You support both, or you break something.
What I did not predict was the speed of the response. Cloudflare, Netlify, Vercel, Postman, WorkOS, Unified.to, Appwrite, Buildkite, AWS, Microsoft, and a dozen more had support, guides, or migration checklists out inside seventy-two hours. I have watched API specifications take three years to get that kind of coverage. And underneath the stateless headline sat the change that actually matters to anyone who has ever operated an API: six SEPs hardening the OAuth layer. Take the session away and you cannot hide identity in it anymore. Every request has to carry its own answer to “who is calling?” — which is the question I ended on last week, and which the entire industry spent this week answering with money.
8,862 posts went out in the last seven days across the 5,204 API-bearing providers I track, and 6,571 of them carried an API-related signal in the title. That is a slightly smaller pull than last week off a slightly larger catalog, and the composition changed more than the volume did: one protocol revision accounted for a startling share of everything worth reading.
MCP Went Stateless, and Everyone Shipped It in Three Days
The 2026-07-28 specification landed on Tuesday. By Friday it was in production at companies that do not usually agree on anything.
- The clearest technical accounting of the change came from Hashnode: MCP is going stateless, and the upgrade breaks in both directions — sessions gone, handshake gone, resumability gone, every request now carrying its own protocol version and capabilities, and a twelve-month deprecation clock on three features. Read that one first if you read only one.
- Arcade did the practitioner work in three parts: an MCP ‘26 migration checklist for your server, a step-by-step guide for clients, and — the best thing published all week — an interview with the MCP maintainers who broke the protocol, where Caitie McCaffrey and Sam Morrow explain why they did it and what adopting it costs.
- The platforms shipped, fast: Cloudflare’s MCP servers, Vercel’s mcp-handler and Vercel MCP, Netlify, Postman, Unified.to in production, Appwrite, Buildkite, AWS AgentCore Gateway, Microsoft’s official MCP C# SDK v2.0, Pydantic’s MCP Python SDK v2 beta, and Open Liberty.
- The explainers followed within a day: New Relic, Solo.io on the engineering details, and CData’s enterprise read.
- The rest of the ecosystem kept moving underneath it: SmartBear pointed ReadyAPI’s MCP at agent-driven test code, the Solana Foundation rebuilt its developer docs around CI-tested code and an MCP server, Google shipped Agent Skills into Genkit Go, and Checkly re-ran the “CLIs are more token-efficient than MCP” claim now that deferred tool loading and resource links exist — the answer changed.
- And two people looked past the migration to what stateless enables. Svix argues fully event-driven MCP is now coming, because a protocol without a session is a protocol you can put a queue behind. Appwrite went remote with one URL and no API keys — the same hosted-and-default move I flagged last week, now easier because there is no session to keep alive.
Here is what I want you to take from the speed. This was not the industry being agile. This was the industry discovering how much it had already built on top of a protocol that was still willing to break itself. Seventy-two hours of coordinated shipping is what a dependency looks like when it moves. The 2026-07-28 revision is a good change — stateless is the right shape for something that has to survive load balancers, serverless functions, and retries — but the reason everyone dropped what they were doing is that they had no choice. That is worth remembering the next time somebody tells you MCP is stable enough to build a business on. It is stable enough to build a business on and it will break you again. Both things are true.
The Quieter Half of the Release
The stateless headline ate the coverage. The auth work is the part that will still matter in a year.
- Calico/Tigera wrote the definitive piece: MCP’s auth hardening, what the six new OAuth SEPs fix, and what they still don’t — issuer validation, credential binding, client type declaration, and three more. The “what they still don’t” half is the honest part.
- SlashID published the two-part attack paper the space needed. When the MCP server is the payload makes the point that nothing in the protocol separates a description that documents a tool from one that commands the model. Then Breaking MCP at the identity layer assumes you patched all of that and walks the confused-deputy attack straight through the new 2026-07-28 authorization spec — where every token is valid, nothing in the OAuth stack fires, and the server does exactly what it was told by the wrong person.
- DZone named it best: the lethal trifecta is hiding in your MCP server. Trusted tools, untrusted inputs, and no amount of prompting takes them apart.
- The vendors converted it into operations: Imperva on MCP server security as the blind spot in your AI stack (short version — it is an API endpoint, put your API security in front of it), and Mailtrap’s developer checklist for vetting an MCP server before you install it, built from six real incidents.
- Meanwhile Arcade asked for zero consent screens and made the case that A2A vs. MCP is a layering decision, not a debate — MCP is the execution layer, A2A is coordination you add only when you have multiple agents. That framing is correct and I wish it had arrived a year ago.
Notice what removing the session did to the security conversation. When state lived in a session ID, you could pretend authorization was something you established once at the handshake. Stateless makes that impossible — every single request has to prove itself. That is strictly better security architecture and it is also strictly more work, and the six SEPs exist because the first draft of MCP auth assumed a world with sessions in it. This is API management history repeating on fast-forward. We learned the same lesson with cookies and then with bearer tokens, and both times it took years. MCP is doing it in quarters.
“Who Is Calling?” Got an Answer, and It Was Identity Infrastructure
Last week I wrote that the host in between an agent and your tool is a gap the specification itself acknowledges. This week that gap got a market.
- The big one: Snowflake launched Cortex AI Gateway to control AI agents and prevent runaway enterprise costs, announced at Black Hat alongside enterprise agentic controls and MCP governance. Read the vendor list on that launch: 1Password, Aembit, Linx Security, SailPoint, and Saviynt — five identity companies who compete with each other, lined up behind one trust model for autonomous agents. Competitors do not stand on the same stage unless the category is real and none of them can hold it alone.
- 1Password had the loudest week of anyone: Credential Broker in public preview, Privileged Access with zero standing privileges for every identity, and survey research finding that AI agent adoption is outpacing governance across 500 IT/security professionals and 500 developers. Agents acting without oversight, is the finding. From the company selling the oversight, is the caveat.
- Gravitee shipped MCP credential brokering to keep API keys away from AI agents — the same insight, from the API management side of the house.
- Even the plumbing moved: Cloudflare added static OAuth client credentials for MCP server portals, which is the least glamorous item in this newsletter and the one most likely to be in your stack by Christmas.
- And Flexera named the thing everyone else is dancing around: cost tools cannot tell you who spent what, because we built a generation of autonomous spenders without deciding who governs the identities they spend against. The meter sees the pool.
The through-line from the top of this newsletter to here is one sentence: you cannot keep identity in a session that no longer exists. MCP going stateless is not a separate story from agent identity becoming a product category — it is the cause. Once every request has to carry its own authorization, somebody has to issue, broker, scope, rotate, and audit those credentials at machine speed, and that somebody is not going to be your application code. It is going to be a broker. Which is exactly what an API gateway was for the last fifteen years, sold again to a buyer who has not yet realized they already own one.
Governance Became a SKU
I have spent two weeks writing that there is no platform for API governance. This week the vendors heard the word “governance” and shipped it as a product line — for AI, not for APIs, because that is where the budget is.
- Vanta introduced AI Governance. Qualys shipped AI governance across shadow GenAI, MCP, and agentic workloads in TotalAI. Cequence added LLM governance to its AI Gateway to close the agent’s direct connection to the model. LangChain launched the LangSmith LLM Gateway as runtime governance built into the agent lifecycle.
- Endor Labs shipped a whole category in one day — AI coding agent governance using hooks for visibility into the agentic SDLC, plus the design rationale and a solution brief.
- The survey wing supplied the fear: Kiteworks found the AI governance gap did not close, it widened, across 459 respondents, and separately that agents are reaching data nobody approved. An untested kill switch is not a control, is their line, and it is a good one.
- And the AI gateway kept becoming an ordinary piece of infrastructure while nobody was looking. Vercel shipped team and project spend budgets, a dedicated logs page, regional inference, and WebSocket support for the OpenAI Responses API — that is rate limiting, logging, data residency, and protocol support, which is to say an API gateway. Traefik hardened the image itself with Distro Zero, and Nango wrote the piece explaining MCP gateway vs. MCP proxy for people now shopping for one.
Every one of these products is API governance with the word “AI” on the box. I am not being cynical about that — I wrote a post this week arguing you should absolutely disguise your API project as an AI project if that is what gets it funded. Take the money. Do the real work. But notice who is not in this list: nobody shipped API governance this week. They shipped AI governance, for agents, priced for a 2026 budget line — governing the same endpoints, with the same policies, that could not get funded eighteen months ago under their own name.
From My Desk: I Forked Spectral
On July 14th somebody filed an issue on the Spectral repository titled “SUPPLY CHAIN ATTACK — @stoplight/spectral pulls in compromised dependencies.” Ten days later one other person asked whether anything had been done. Nobody answered. It is still open.
Sit with who is downstream of that. The Dutch government’s REST API Design Rules — a mandatory comply-or-explain standard its agencies must meet — are written as Spectral rulesets. Enterprises run the engine millions of times a day in CI behind an internal facade where their developers never learn it is there. All of them are downstream of an unanswered security question in a repository with 241 open issues.
- So I did it: I am forking Spectral. Two repositories, live now —
api-commons/spotlight-spec(the ruleset format as a standalone specification with a portable JSON Schema) andapi-commons/spotlight-tools(a maintained build at v6.16.2, full history, telemetry stripped, issues open). The part I actually care about is the least dramatic: your rules are the durable thing, not the linter. I collapsed five draft-07 meta-schemas coupled to the linter’s runtime into one self-contained JSON Schema 2020-12 document with a stable$id, so a ruleset can be authored, validated, published, and consumed by any tool. Then Forking Is the Easy Part — copying a repo took an afternoon; working out how anyone actually switches is the hard problem, and it is written up as the first two issues either repo has ever had. My invitation to SmartBear to donate Spectral to the OpenAPI Initiative still stands. I would rather they took it. - The agent cards got graded. Most published agent cards are not actually A2A. We probed 22,341 unique hosts across the catalog; 20,185 answered; 65 serve an agent card, and only 10 pass every structural check in the A2A 1.0.0
AgentCardobject. Fifteen are still on the pre-0.3/.well-known/agent.jsonpath where a compliant client will never look. And the finding I keep chewing on: the conformant ones mostly point at MCP endpoints. Providers want the manifest; the protocol is incidental. The apis.io A2A section grades rather than counts, because “65 adopters” is a headline no integration would survive. - The API sprawl series landed its argument: why sprawl is actually a problem (security, cost, consistency — organizations fixate on the first and lose the most to the other two), then reducing sprawl through governance and through API management. Alongside it, control moved from the database to the API gateway — the DBA guarded the store, the gateway guards the door, and in 2026 the door is where the fight is.
- Universities, with my intern Emily Barton: universities are building AI infrastructure worth having and not publishing the contract, ZotGPT as what it looks like when a university owns its AI infrastructure, and Emily’s own essay, Professors Became the AI Police, about a part of this I am not qualified to write. Then the demonstration: I rebuilt their OpenAPI from nine web pages — just publish it. Every fact in that spec was already public, in nine different places, written for humans. Withholding the definition withheld nothing except machine-readability.
- Overlays, still: batch and reusable modifications across many specs, stripping internal endpoints before you publish, and governance as an artifact, not enforcement.
- Onboarding, scored instead of solved: I stopped building the onboarding fix; now I keep score — thirty-six hand-written onboarding scripts taught me I was subsidizing bad front doors for free. This week’s provider reviews: Auth0 has the right endpoint and still makes you ask permission, Microsoft Entra ID, AWS Cognito has the credentials, just not the front door, and Ping Identity’s two roads to a programmatic client.
- Also: the outside-in view is what agents will see (now 25,439 providers and 106,926 APIs), driving toward capabilities with API tag groupings, and the government authorization pieces — DPoP and sender-constraining and who decides policy-based authorization.
The Spectral fork and the agent card grading are the same post written twice. In both cases the thing the industry actually depends on — a ruleset format, a discovery manifest — was left as a side effect of somebody’s tool or somebody’s protocol, with no independent home, no validator in anyone’s pipeline, and no feedback loop telling publishers whether what they shipped works. Forty-one broken agent cards and an unanswered supply-chain issue are the same failure. The artifact has to stand on its own, or it decays quietly while everyone assumes somebody else is minding it.
Two Conversations: Governance Left, and the Gateway as Runtime Governance
I published two this week, and read together they are a nice argument about where governance actually lives.
Rose Misseur works where product and engineering meet, bringing governance into every phase of the lifecycle at everything from startups to large banks. Her argument: AI has not changed governance at its core, it has turned heavy centralized processes into a copilot sitting beside every team — which is what finally makes the federated model workable, guidance from the top and autonomy below. Governance is a people and mindset problem. And the next hard problem, in a world of shadow APIs and a SaaS apocalypse, is discoverability, because you cannot govern what you cannot see.
Sudeep Goswami, CEO of Traefik Labs, reframes the gateway from first principles as runtime governance: write granular policy, enforce it in real time, observe what actually happened. We get into how that one job now has to stretch across three personalities — API gateway, AI gateway, MCP gateway — without fragmenting an enterprise into three vendors and three operating models, why Kubernetes-native discovery makes shadow APIs disappear, and what agents experience when a guardrail blocks them.
Put those next to this week’s news and the shape is obvious. Rose says you cannot govern what you cannot see; my probe found 65 agent cards in a catalog of 22,341 hosts. Sudeep says the gateway is runtime governance; Snowflake, Cequence, LangChain, and Vercel all shipped one this week and called it something else. The vocabulary keeps changing. The job has not changed since 2010.
See you next week.
