In this post 8 sections
There was no new Model Context Protocol (MCP) specification release in October 2026. The current version is 2026-07-28, which made the protocol stateless, and the news from MCPCon North America (San Jose, 22 and 23 October) was about security and identity work around it. If your team uses MCP connectors for ads, analytics or a CMS, the practical questions are who can authorize them and what they can write.
Key Takeaways
- The latest MCP spec is 2026-07-28, published on 28 July 2026; the MCP blog describes it as retiring the session handshake so any server instance can handle any request.
- The same release moved Tasks and MCP Apps into a formal extensions framework and deprecated Roots, Sampling and Logging, which keep working for at least twelve months.
- At MCPCon, per InfoQ, the lead maintainer said enterprise-managed authorization is live in Claude, while proof-of-possession tokens and workload identity federation are still drafts.
- InfoQ reports about a third of 116 conformance scenarios now test security, and cumulative SDK downloads of 4.17 billion; the article notes several figures were stage claims without published data.
- Anthropic says support for the new spec is "being rolled out across Claude products" with no per-product dates, per its Claude blog post.
- Ad platforms already run MCP servers (Google Ads read-only, Meta with write access from launch), according to one trade-press summary I could not corroborate elsewhere.
- Marketing teams should inventory connectors, start read-only and treat any write permission as a decision that needs a named owner.
What the 2026-07-28 spec changed
MCP is the open standard that lets an AI assistant call outside tools. The July release was the fifth spec version, and the first since November 2025 according to the MCP team. The official release post lists these changes:
| Area | What changed |
|---|---|
| Sessions | The initialize handshake and Mcp-Session-Id header are retired; each request carries its own version, client identity and capabilities |
| Server prompts | Mid-call questions use a new "input required" result and a retry, rather than a held-open stream |
| Routing | Streamable HTTP requests carry Mcp-Method and Mcp-Name headers so gateways can route without reading the JSON body |
| Caching | List responses include ttlMs and cacheScope |
| Tasks | Moved into an extension with poll-based tasks/get and a new tasks/update |
| Authorization | Clients validate the iss parameter; Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents |
| Deprecations | Roots, Sampling, Logging and the legacy HTTP+SSE transport, with at least a twelve-month window |
The TypeScript, Python, Go and C# SDKs support the new version, and the Rust SDK has it in beta. A trade report on ad tech, PPC Land, adds one detail the release post does not stress: the tasks/list method was removed, so anyone who built on the November 2025 experimental Tasks needs to migrate. It also notes a changed error code for missing resources.
What MCPCon added: security and identity
InfoQ's report on the 22 to 23 October conference says the Agentic AI Foundation (AAIF), which hosts MCP under the Linux Foundation, grew from three projects to ten in its first year. Its CTO named the open problems as identity, attestation, audit and payments. The items I would flag for non-engineers:
- Enterprise-managed authorization is live in Claude, according to Anthropic's Den Delimarsky as quoted by InfoQ. His roadmap marks it stable. In plain terms, a company's identity provider can decide which people and agents may connect to which servers.
- Proof-of-possession tokens and workload identity federation are drafts. They aim to stop a stolen token from being reused elsewhere.
- Conformance tests: about a third of 116 scenarios now test security.
- Prompt injection: Chrome's WebMCP proposal uses read-only and untrusted-content hints, and OpenAI requires tool annotations for plugin submissions.
- Tool schemas: OpenAI's Thomas Sarlandie reported that about three in four schemas in the ChatGPT plugin directory are under 1 kB, while the largest single tool schema is about 260 kB. Only 56% of plugins use server instructions.
InfoQ is careful to say that some numbers, such as 4.17 billion cumulative SDK downloads and a claim that some platforms see about 70% of traffic in stateless mode, were stage claims without published data. The 70% figure is not attributed to anyone. I would not quote it.
Who actually runs MCP servers in marketing
The ad-tech summary from PPC Land lists Google Ads (open-sourced 7 October 2025, read-only), Amazon Ads (closed beta in November 2025, open beta 2 February 2026), Meta (connectors on 29 April 2026, with write access from launch), Microsoft Advertising (read-only) and several others. That list comes from one trade publication, and I did not confirm each date against the platforms' own announcements, so treat it as a pointer for your own check, not a reference table.
The pattern still matters. Read-only servers are low risk: the worst outcome is a wrong summary. A server that can change bids, budgets or posts is a different class of risk, because an instruction hidden in a webpage or a tool description can steer an agent that holds those permissions. That is the same failure shape I covered in AI agent security for marketing teams.
What this means for marketers and founders
- Inventory your connectors this week. List every MCP connector in Claude, ChatGPT or an IDE: name, owner, read or write, and which account it uses. Most teams cannot do this from memory.
- Default to read-only. For reporting and audits, a read-only Search Console, GA4 or ads connector does the job. Add write access only for a named workflow with a named owner.
- Use the identity provider if you have one. If your company runs Okta or Entra, ask IT whether enterprise-managed authorization can gate connectors, as the Claude blog describes OAuth and OIDC alignment for providers like those.
- Do not rebuild anything because of the spec. If you consume servers, the stateless change is the server author's problem. If you built a custom server, check the migration notes and the Tasks change.
- Ignore "MCP SEO" claims. MCP serves tools to agents you connect to. It is not a ranking signal. For where it does and does not touch visibility, see llms.txt, MCP and schema.
- Test how agents see your site. Agents that visit your pages can fail in ways a human visit never shows; what breaks when an AI agent visits your website is the checklist I use.
If you build a connector for your own product and want it listed, the process is in the Claude plugin directory guide.
Caveats
- Anthropic's own page says Claude support for 2026-07-28 is rolling out, with no per-product dates. I could not confirm which Claude surfaces support it today.
- The conference figures come from talks as reported by one outlet. I did not find the slides.
- I did not open the AAIF roadmap itself. Secondary summaries disagree on how many roadmap areas it has, so I have left them out.
- None of this changes how well your site ranks in AI answers. For that, see agentic commerce: what actually works.
FAQ
Did MCP release a new version in October 2026?
No. The most recent spec version is 2026-07-28, published on 28 July 2026. October's news came from MCPCon North America, which covered security, identity and the foundation's growth, not a new spec.
What does stateless MCP mean in plain English?
The old protocol opened a session and remembered it. Under 2026-07-28, each request carries everything the server needs, so any server instance can answer it. That makes servers easier to run behind ordinary load balancers and cheaper to host.
Is MCP safe for marketing teams to use?
It depends on permissions, not on the protocol alone. A read-only analytics connector carries little risk. A connector that can edit ads or publish content needs an owner, logging and a tested rollback, because prompt injection can steer an agent that has write access.
What is enterprise-managed authorization?
It is an MCP extension that lets a company's identity system control which users and agents may connect to which servers. At MCPCon, Anthropic's lead maintainer said it is live in Claude. Ask your IT team whether it is enabled for your organization.
Do I need to update my MCP server because of the July spec?
If you wrote a custom server, probably yes. Session handling, the removed tasks/list method and the deprecations need review. If you only use servers other people maintain, you wait for their updates.
Does MCP help my site appear in ChatGPT or Claude answers?
I found no evidence that it does. MCP lets an assistant call tools you connect, such as your analytics. Visibility in answers still comes from crawlable, citable pages.
How many MCP servers exist?
I do not have a verified total. InfoQ's conference report gives no server count, and I did not find an official one. Be wary of any single number.
Want help with this?
I'm Younus Fardeen, an organic growth, SEO and AEO strategist with 4+ years of marketing experience across edtech and startup teams. If you want help auditing the connectors and agent permissions your marketing team relies on, see my work and reach me through the contact form at younusfardeen.com.
Found this useful? Pass it on.