Because I'm never allowed to be done with The Book, a new roadmap for MCP has just dropped. Luckily for all of us who are still catching up with the changes introduced in the 07-28-2026 spec, the roadmap update is not a change to the protocol, but a document stating the areas of emphasis for the protocol going forward.

In today's issue, we'll cover what changed in the roadmap, and how it shows that MCP is becoming real infrastructure operated by platform teams

The Roadmap's Five Priorities

The first priority is improving agentic messaging primitives, like requests. The latest spec release removed server-initiated requests in favor of multi round-trip requests (MRTRs) to enable full statelessness. The MCP roadmap announcement claims "Modern agentic workloads no longer fit the standard request-and-response pattern" - perhaps a hint of a bigger move away from request-and-response?

For now, though, this priority area will include:

• promoting server-initiated events like webhooks and channels into the protocol
• reviewing composition across Working Groups to ensure messaging primitives are truly composable
• promoting the Tasks extension into the protocol specification

The next priority is more protocol streamlining: the July MCP spec turned remote server connections into ordinary HTTP workloads. Now, the roadmap proposes allowing local servers to "speak" Streamable HTTP over stdio, unifying how users connect to servers. It's not clear yet what the future of plain stdio or custom transports would be, but it's far too early to start panicking (he tells himself, eyeing the latest review copy of his book nervously).

Next is a continued focus on upgrading and hardening enterprise security. Last month's spec release brought a much-needed security update to OAuth in MCP by deprecating Dynamic Client Registration in favor of OAuth Client Identification Metadata Documents (CIMD). This priority will focus on defining standards with bodies like the IETF to enable agents to identify themselves without human intervention, while evolving Enterprise-Managed Authorization.

The next priority is maturing the MCP primitives: tools, prompts, and resources. Some challenges the Working Groups involved here will focus on are result handling and improving the scalability of primitives, like progressive discovery of tools. The tool usability horizon for agents is well-known, with most losing tool-call accuracy with only a handful of tools. This is something that would be huge to fix on-protocol, because it is a very common complaint for new users and MCP developers, and methods like code mode have provided viable alternatives.

The final priority is SDK UX. There will be more emphasis on conformance testing and building better ergonomics within each SDK, ensuring that SDKs support the full specification and that they are easy to use. V2 of the Python SDK showed us what that ergonomics focus could bring us, and I'm excited to see how the SDKs mature over the next year.

What Does This Tell Us?

I think there are two things we can infer from this roadmap: the first is that there is a continued focus on serving the enterprise. Maturation of security and auth, better handling of large tool catalogs, and further work on statelessness all point to supporting larger remotely hosted servers run by vendors.

The second is an acknowledgement of the sometimes difficult UX that faces both SDK developers and developers building with MCP by improving ergonomics and testing for conformance against the MCP spec. These are exciting updates, and they give us a lot of information about the direction MCP wants to go: more focus on DevEx, the enterprise, and streamlining the protocol.

AI Agents with MCP ends with a discussion of the roadmap as it existed prior to this week, discussing transport evolution, agent communication, governance maturation, and enterprise readiness. I also talked about areas of interest without formal working groups: event-driven updates, more client control over the model context, and auth improvements. Much faster than I could've anticipated, these are now official priorities.

Quick Signals

• Thomson Reuters dropped a continual learning technique for LLMs, and were able to approach frontier performance by applying it to open-weight models (in this case, the Qwen family of models) at a final training cost of only around $450,000 with no distillation. While coding was a weak spot with a 39.9 score on their coding benchmark, a non-hyperscaler able to train their own large model at the cost of a midsize consulting engagement is potentially paradigm-busting.
• Some blockbuster acquisitions have just been announced, too. Stripe is acquiring OpenRouter, and now Nvidia has agreed to acquire HuggingFace for $12.9B. Who is next?
• Linus Torvalds, the creator of Linux, has long been a user of LLMs for coding. Recently, he credited his coding agent with solving a stubborn kernel VRAM bug. If it's good enough for Linus, it's probably good enough for the rest of us mortals.
• I talked to Sheamus at the ODSC Podcast all about MCP and AI Agents with MCP, along with the challenges that come with writing a book on a rapidly evolving protocol. [YouTube]