MCP News: September 2026 Roundup

The current spec at a glance

Source: the 2026-07-28 changelog.

Timeline, newest first

September 2026

• 30 September. Arcade rescans the ecosystem. Arcade's ToolBench now scores more than 90,000 open-source MCP servers and 630,000 tools. It gives an A to 260 of them, or 0.28%. Stateless handling from the new spec shows up on 5.8% of servers. Among servers that ship a destructive or irreversible tool, 14% declare safety annotations. This is a vendor's own benchmark, and the vendor sells tool governance. Arcade
• 28 September. Cisco Investments backs Arcade.dev. The investment extends Arcade's Series A. Arcade is the company that bought Smithery in August. Arcade

The MCP blog's most recent post is still the 22 August roadmap.

August 2026

• 22 August. New MCP roadmap. It names five priority areas: agentic messaging primitives, HTTP-native transport unification and hardening, agent identity and enterprise-ready security, improved primitives, and improved SDK developer experience. One planned piece is progressive discovery, so a server with a hundred tools can offer a small entry point first. MCP blog
• 5 August. Arcade.dev acquires Smithery. Smithery co-founder Anirudh Kamath joins Arcade. Arcade calls Smithery a leading public registry and hosting platform for MCP. The announcement gives no price and still sends developers to smithery.ai to sign up free. Arcade. See also PopMCP vs Smithery.
• 5 August. Azure DevOps Remote MCP Server is generally available. It is hosted by the Azure DevOps service and covers work items, pull requests, repositories and pipelines. Your organization must be backed by a Microsoft Entra tenant. Microsoft

July 2026

• 28 July. Spec 2026-07-28 released. A stateless core, MRTR, header-based routing, cacheable list results and stricter authorization checks. The TypeScript, Python, Go and C# SDKs supported it on release day, and the Rust SDK in beta. A server can now sit behind a plain round-robin load balancer, and code that depends on session IDs has to migrate. MCP blog
• 27 July. The official Ruby SDK reaches 1.0. It is the first stable release of the mcp gem. It implements the 2025-06-18 and 2025-11-25 revisions. MCP blog
• 1 July. DuneSlide: two critical flaws in Cursor. Cato AI Labs published CVE-2026-50548 and CVE-2026-50549, both rated 9.8 by NVD. A prompt injection delivered through an MCP server request or a poisoned web result could write files outside the workspace and escape Cursor's sandbox. Both are fixed in Cursor 3.0. Cato Networks, Cursor advisory

June 2026

• 29 June. Beta SDKs for the release candidate. Python, TypeScript, Go and C#. MCP blog
• 18 June. Enterprise-Managed Authorization is stable. The extension lets a company grant MCP server access through its identity provider, so users skip the per-server consent screen. Okta is the first supported identity provider. Claude and VS Code support it as clients. Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase support it as servers. MCP blog
• 3 June. Snowflake completes its Natoma acquisition. Snowflake announced the deal on 27 May. Its quarterly filing puts the preliminary purchase consideration at $128.3 million and describes Natoma as an enterprise MCP platform for AI agents. Snowflake announcement, 10-Q

May 2026

• 21 May. Release candidate for 2026-07-28. The first public look at stateless MCP. MCP blog
• 6 May. The AWS MCP Server is generally available. It is a managed remote server. Its call_aws tool runs AWS API operations with your existing IAM credentials, and a new run_script tool runs a short Python script in a sandbox with no network access. AWS

April 2026

• 29 April. Salesforce Hosted MCP Servers are generally available, for Enterprise Edition orgs and above. Salesforce
• 15 April. OX Security reports a design-level STDIO risk. OX says that passing untrusted input into the configuration that launches a stdio server allows command execution, and lists 10 CVEs in downstream projects. By OX's account, Anthropic called the behavior expected and declined to change the protocol. OX Security
• 15 April. "MCPwn" in nginx-ui, CVE-2026-33032. nginx-ui's /mcp_message endpoint skipped authentication, so any network attacker could call its MCP tools and take over Nginx. CVSS 9.8. Pluto Security, which found it, says the fix shipped in v2.3.4 and that the flaw has been exploited in the wild. Pluto Security, nginx-ui advisory
• 13 April. HubSpot's remote MCP server is generally available. The release adds write access for contacts, companies, deals, tickets and activities. HubSpot
• 8 April. The maintainer team expands. Den Delimarsky becomes a Lead Maintainer alongside David Soria Parra. Clare Liguori of AWS joins the Core Maintainers. MCP blog

January to March 2026

• 9 March. The 2026 MCP roadmap. Four priority areas: transport evolution and scalability, agent communication, governance maturation and enterprise readiness. MCP blog
• 26 January. MCP Apps, the first official extension. Tools can return interactive UI that renders in the conversation. At launch it was supported in Claude and Goose, in VS Code Insiders, and in ChatGPT from that week. MCP blog

Late 2025

• 11 December 2025. Google announces fully managed remote MCP servers, starting with Google Maps, BigQuery, Compute Engine and Kubernetes Engine. Google Cloud
• 9 December 2025. MCP joins the Agentic AI Foundation. Anthropic donated MCP to the foundation, a directed fund under the Linux Foundation. MCP blog
• 4 December 2025. Workday closes its Pipedream acquisition, announced on 19 November. Pipedream on X, Workday. See also PopMCP vs Pipedream.
• 25 November 2025. Spec 2025-11-25 released. Experimental tasks, URL mode elicitation and Client ID Metadata Documents. MCP blog
• 8 September 2025. The official MCP Registry launches in preview. Its documentation still says preview. MCP blog, registry status

What to do about it

If you build MCP servers

1. Plan the move off sessions. The new revision drops Mcp-Session-Id, the initialize handshake and the HTTP GET stream. There is no switch-off date: the maintainers say existing clients and servers keep working, and a server may support both eras at once.
2. Keep deprecated features out of new code. That means Roots, Sampling, Logging and HTTP+SSE. Dynamic Client Registration still works for backwards compatibility, with Client ID Metadata Documents now preferred.
3. Put authentication on every MCP endpoint. The nginx-ui flaw was one endpoint that skipped it. MCP security best practices has a checklist.
4. Treat tool output as untrusted input. DuneSlide needed no click from the user, only text the model read.

If you use MCP servers

1. Ask which revision a provider's endpoint negotiates. The spec's compatibility table says a client that speaks only 2026-07-28 fails against a legacy-only server, and a legacy client fails against a modern-only server.
2. Re-read the terms if you rely on Smithery, Pipedream or Natoma. Each has a new owner.
3. Check a community server before you connect it. Arcade's 0.28% is one vendor's grading, but the direction matches the advisories above. Remote vs local MCP servers covers what to look for.

Where PopMCP stands

PopMCP's endpoint is built on the official TypeScript SDK and negotiates MCP revisions up to 2025-11-25. It does not implement 2026-07-28. It uses Streamable HTTP only, with no SSE transport.