Today is the day, MCP is launching the next version of the spec! The 2026-07-28 version brings a bunch of exciting changes like statelessness, but I'm focused on the boring auth side of things that nobody wants to deal with!
• Issuer validation (RFC 9207)
• Refresh token and offline_access recommendations
• Scope clarifications
• Syncing with RFC 8414 .well-known URI
In the mean time, there's been a ton of excitement around MCP's Enterprise-Managed Auth extension, with a beta program running in Claude and Okta and new MCP servers shipping support by the day!
Join me at the MCP spec release party in London tonight to learn about what's new in enterprise MCP security!
https://luma.com/klu2tegz
WeChat ID
aaronpk_tv
