title: "MCP maintainers chart protocol's next phase with agent auth work" slug: "mcp-maintainers-chart-protocols-next-phase-with-agent-auth-work" published: "2026-09-22" beat: "Tools" tags: ["Tools", "Business"] creator: "Agentry Newsroom" editor: "Susanne Sperling, Editor — Human in the Loop" tools: ["Claude (Anthropic)", "Perplexity Sonar"] creativeWorkStatus: "verified" dateReviewed: "2026-09-22" aiActArticle50: "compliant" humanView: "https://agentry.news/tools/mcp-maintainers-chart-protocols-next-phase-with-agent-auth-work" agentView: "https://agentry.news/agent/mcp-maintainers-chart-protocols-next-phase-with-agent-auth-work"
David Soria Parra and Den Delimarsky, lead maintainers of the Model Context Protocol, published a roadmap on August 22, 2026, outlining five priority areas for the standard's evolution, including prog
Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. AI policy.
MCP maintainers David Soria Parra and Den Delimarsky published a roadmap on August 22, 2026, charting the Model Context Protocol's priorities beyond its July stateless overhaul, focusing on agent authorization, progressive tool discovery, and enterprise identity standards Developers Digest.
The roadmap identifies five priority areas: agentic messaging primitives, HTTP-native transport unification and hardening, agent identity and enterprise security, improved primitives, and enhanced SDK developer experience NXCode. These targets address operational friction points that emerge when organizations deploy agents across multiple tools and data sources at scale.
One centerpiece is progressive discovery, which allows an MCP server to expose a small entry point first, then reveal more of its tool catalog as the conversation narrows Developers Digest. This reduces initial tool namespace bloat and lets agents discover relevant capabilities incrementally—critical for systems managing hundreds of tools or permissions-gated resources.
The roadmap's security strand targets standardized agent identity verification. "We want MCP servers to have a standardized way to identify and trust these agent identities—built on existing standards rather than relying on pasted API keys and long-lived tokens," according to the maintainers' post YAge. Planned mechanisms include DPoP (Demonstration of Proof-of-Possession), Workload Identity Federation, the ID-JAG grant, and token exchange protocols—all aimed at replacing manual credential injection with cryptographic and federated identity flows Mer.vin.
These identity changes reflect a shift in how agents operate at enterprise scale: rather than embedding long-lived secrets in agent configurations, the protocol is moving toward caller verification and credential binding tied to specific workloads or agents.
The roadmap builds on the July 28, 2026 specification revision, which made MCP servers stateless and introduced a server/discover handshake—a foundational change that enabled the progressive discovery work now outlined Mind Pattern. That statelessness removed server-side session overhead, making MCP more suitable for ephemeral agent deployments and cloud-native architectures.
The timing reflects growing production adoption of agentic patterns: as more enterprises connect agents to CRM platforms, data warehouses, and internal tools via MCP, protocol-level primitives for discovery, authorization, and identity have moved from nice-to-have to blocking issues.