Stateless, Secure, and Extendable. MCP release and what it means for MACH.
Aug 5 2026 - By Alliance
By MACH Alliance - Kerrigan Baron, Delivery Lead for AI Exchange and CEO & Founder of Fidget Labs
I spent last Wednesday evening at AI House Amsterdam for the Model Context Protocol, or MCP, Release Party, one of a handful the Agentic AI Foundation (AAIF) ran across London, Seattle, San Francisco and Amsterdam to mark the 2026-07-28 MCP specification. Three talks, one panel, and a room full of the people who maintain this protocol rather than sell it.
Most coverage of this release is a feature list, which is the wrong lens for anyone signing budgets. What changed is what an enterprise can now do with agents that it could not responsibly do a week ago. There are four of those, and each removes a specific reason your agent program has been stuck in pilot.
You can now scale agent traffic on infrastructure you already own
Sam Morrow, a software engineer at GitHub and an MCP maintainer, opened on the change everyone came for. Sessions are gone.
Think about what containerization did to freight. The standard box was not the innovation. Interchangeability was. Once every load looked identical from the outside, any crane could put any box on any ship at any port, and capacity became something you bought rather than something you engineered.
MCP just did that to the request. Every call now carries its own protocol version, identity and capabilities, so any server instance can answer any request. Morrow was direct about what the old model cost: for anyone hosting other people's MCP servers, horizontal scaling was effectively impossible without forcing customers onto a bespoke architecture, which is not something you ask a paying client to accept.
What you get is unglamorous and immediately bankable. Your MCP layer runs behind ordinary load balancers, on the same infrastructure, the same runbooks and the same on-call rota as everything else you operate. GitHub has been running the new version in production for around three weeks, and Morrow said they had already served on the order of half a million requests from clients on the new protocol before the specification was formally announced. Their session store came out of the critical path entirely, which bought them lower latency and one fewer external dependency between a user and a working answer.
Your security team can finally see agent traffic without opening it
The second change reads as plumbing and behaves like governance. Protocol methods are now duplicated into HTTP headers, which means the address is on the outside of the envelope. Your gateway can route, meter, log and screen agent traffic without parsing the payload, the same way your mail room sorts post without reading letters.
Underneath that, six specification enhancement proposals landed to harden OAuth and OpenID Connect. The one worth understanding at board level requires the client to validate which authorisation server actually issued a response, closing off mix-up attacks in environments running more than one identity provider. Until now the equivalent control was trusting the letterhead on a wire instruction, and most large enterprises run several identity providers whether they intended to or not.
Enterprise-Managed Authorization arrives as an official extension and your people will feel it on day one. Your staff do not negotiate access with the receptionist on every floor, because IT issues a badge once. This puts agent access on the same footing, so users log in once and their work MCP servers connect automatically. Consent fatigue has always been a security failure dressed as a user experience complaint, because a person clicking "allow" for the fortieth time this week has stopped reading. Removing that decision from them removes the failure.
Human approval stops being an architecture problem
This is the one I would put in front of a risk committee. Until this release, an agent stopping mid-task to ask a person for a decision required holding a connection open between server and client. That worked on a laptop and fell apart at scale, which is precisely why so many enterprise agents are still restricted to reading things. Approving, transferring, provisioning and purchasing all need a human in the loop, and the loop was the expensive part.
The new pattern is the returned form. The server responds that input is required, the person authorises in their browser, and the client resubmits the same call with the answer attached. Nothing stays on the line. Peder Holdgaard Pedersen pointed out that the concept is not novel at all, because it is how web applications have worked for twenty years, and that familiarity is exactly the argument. You are not being asked to trust a new idea. You are being asked to stop paying for a workaround.
One related control deserves naming. Because client capabilities now travel in every message, a server can decide what to offer based on what the client can actually handle. Pedersen's example was a bank with a transfer money tool: if the client cannot render a confirmation screen, the server never advertises the tool at all. The guardrail moves out of the policy document and into the protocol.
You can adopt without betting on a frozen standard
Pedersen's framing was the sharpest thing said all evening. A release is not a feature list. It is a snapshot of a metabolism.
Four things happen at once in a healthy standard. The core moves slowly, legacy leaves through deprecation, the SDKs catch up, and new capability enters through extensions that incubate, land, and eventually either settle into the core, stay modular forever, or get abandoned. Interceptors, Skills, and Triggers and Events are incubating now, while MCP Apps and Enterprise-Managed Authorization have landed.
Then Pedersen showed the move that actually matters. Tasks, the mechanism for long-running tool calls, went the other way this release. It came out of the core and into an extension. The framework is not only an on-ramp, it is an off-ramp, which means the core can shrink. Almost no standard in this industry can do that. Most only accrete, get heavier, and eventually collapse under the weight of everything nobody was willing to remove.
For you that translates into a procurement position. There is now a formal twelve month minimum deprecation window on roots, sampling, logging, Dynamic Client Registration and the legacy HTTP and SSE transport. Nothing you run today breaks, because old clients keep speaking the old protocol and servers can support both, and the panel's honest advice was that if you are doing ordinary tool calling and resource serving there is no reason to wait. You have a published timetable instead of a rumour, and you can budget against it.
What this means for MACH
It is Open in the only way that counts, because MCP now sits inside the Agentic AI Foundation at the Linux Foundation alongside goose and AGENTS.md, with Anthropic, Block, OpenAI, AWS, Bloomberg, Cloudflare, Google and Microsoft at the same table. Direct competitors co-governing a standard is the least exciting and most durable form of vendor neutrality available to you. It is Composable, because stripping state out of the server turns a swappable-in-principle agent layer into a swappable-in-practice one. And it is Connected, because hardened authorization and header-level routing are what let agent traffic cross a real enterprise boundary without a bespoke integration and an act of faith.
Ask your architecture team three questions this month. Where are we still pinned to sessions, what on our estate is on the twelve-month clock, and who owns the agent traffic our gateway currently cannot see. If those answers come back quickly, you are ahead of this. If they come back as a project, you have just found your next quarter, and AGNTCon and MCPCon Europe lands in Amsterdam September 17-18 with the people who wrote all of it.
Two weeks after AGNTCon and MCPCon Europe, MACH Alliance brings its own flagship European event to the same city. MACH X: Amsterdam runs September 29–30, 2026, bringing together enterprise teams building on open, composable, and connected architecture. Registration is open for both events. Come find me at both events.
For additional information and to learn more: