MCP Is Getting Its Biggest Update Ever (No One's Ready)

[00:00:00]On July 28th, MCP [music] ships the biggest rewrite of its 16-month life. To compensate for the production failures, they've decided to make the protocol dumber. The handshake, deleted. [music] Session ID, deleted. Three of the original features, deprecated. 110 million SDK downloads a month, and foundation [music] under all of them is about to get simpler than the day it launched. You don't really take the core out of your product at 16 months in because everything is going great. So before you look at the change log, tell me this: Is the fastest adopted standard of the decade still winning or hanging on for dear life? Back in March, the internet [music] declared MCP dead.

[00:00:44]Coding agents were doing their best work through plain CLI tools, >> [music] >> and a protocol layer started to look like overhead. Under the co-creator's own keynote sits a comment from a developer saying they dropped MCP completely [music] and moved to skills and CLI tools, conveniently ignored by the project.

[00:01:04]Then there's the readiness problem. Two weeks before the release, an engineer probed every reachable remote server in the official MCP registry to see who could [music] speak the new spec. 4,356 servers answered the door. The number ready for July 28th was one. Just one single server. The flagship protocol of the AI era is rewriting its foundation, and the thousands of servers standing on it haven't even RSVP'd. Exhibit A is the design itself. Original MCP [music] was stateful. Every connection opened with a handshake. The server minted a session ID, and every request after that had to land on the exact machine holding that session in memory. On your laptop, harmless. In production, that one decision poisoned everything above it.

[00:01:57]Load balancers needed sticky sessions.

[00:02:00]Teams stood up Redis clusters just to store protocol plumbing. API gateways had to crack open JSON bodies to figure out where a request should even go, and serverless was off the table completely because there was no long-lived process left to do the remembering. In April, MCP's co-creator stood on a conference stage and said the new transport exists because people with real phone insurance told the team they got parts of it wrong.

[00:02:28]His words, near enough, "Hopefully, we're still humble enough to say, 'Okay, we got it wrong. Let's go fix it together.'" Credit where it's due.

[00:02:37]Standards usually die defending their mistakes, but still it took 110 million SDK downloads a month before a flaw this basic became impossible to ignore. MCP [music] was designed for laptops, and the world deployed it to data centers.

[00:02:52]What they built instead is a wire with no memory. Every request now carries everything the server needs to answer [music] it. Protocol version, client identity, capabilities. Any instance can serve any call.

[00:03:06]>> [music] >> So, round-robin load balancing, auto scaling, and serverless deploys work the way they do for every other web service on Earth. Multi-step work survives through a trick as old as the signed cookie. When a server needs more input halfway through a job, >> [music] >> it hands back a sealed blob of its own state. The client collects the answer and resends the original request with the blob echoed back, and whichever replica catches [music] it picks up where the last one stopped. The state made a round trip through the client and came home. Looks pretty clever. The state management didn't vanish, of course. That's [music] now your problem.

[00:03:44]If your server tracked anything across calls, an open transaction, a live browser session, that's now an explicit handle your tools mint [music] and your storage keeps alive. And the courier for that handle is a language model, [music] a non-deterministic text generator that can drop or mangle an ID for any reason it likes. Also, a handle is a key.

[00:04:06]Accept one back without checking it belongs to the caller [music] and you've handed out a textbook authorization hole. At MCP's own conference, a vendor was already on stage selling a state [music] sidecar to hold everything the protocol just evicted. Isn't that just beautiful? Exhibit B is what the rewrite leaves untouched. Ask server authors about the main issues with MCP. Sessions barely make the list. Authorization tops it every single time. Every major client implements MCP auth its own way.

[00:04:39]Anthropic's API wants you to bring your own bearer token, while Claude AI insists on running the whole OAuth flow itself. ChatGPT rejects machine-to-machine credentials. Google Cloud requires them. VS Code still speaks a spec revision from over a year ago. Build a server against one client and it can fail in [music] the next one without a sound. And hear me out on this one. MCP mandates OAuth 2.1 and OAuth 2.1 has never been finished. It's still a draft at the standards body years in.

[00:05:14]A protocol that keeps rewriting itself standing on a standard that was never finished. July's release does harden authorization. Six separate proposals worth of hardening. But hardening and unifying are different jobs and the thing developers complain about most walks out of this release alive. It's not all drama, though. 110 million SDK downloads a month. React needed 3 years to hit that base. MCP got there in 16 months. The loudest deployments were never on Twitter to begin with. Behind corporate [music] firewalls, MCP is wired into Salesforce, Jira, Snowflake, and HR systems all day long, which the co-creator calls the biggest deployment service to protocol has. You'll never see it trending, but it pays the bills.

[00:06:03]The famous context bloat complaint, it's true and aimed at the wrong layer. Cloud code once burned 22% [music] of a 200,000 token window on tool definitions nobody had asked for yet.

[00:06:17]>> [music] >> The fix was loading tools on demand inside the client. The protocol never changed and the problem left. Even the skills and CLI defectors are running a play straight off MCP's own road map.

[00:06:29]Let the model write code and let that code call [music] the tools. And if you're bracing for the 28th, relax. Old versions keep negotiating. Deprecated features get a 12-month floor, if not [music] longer. The scariest release in MCP's history is for most servers running today. So, the verdict, is MCP losing? The scoreboard says no. Every major platform vendor [music] sits in the same foundation. The download curve is still climbing and no rival standard is shipping anything today. This rewrite is survival behavior and I mean that as a compliment. Admit the mistake in public, cut the dead weight, and force the rule [music] everyone was supposed to be following anyway. Whether it works is measurable. That one server auto 4,000 number is the before picture.

[00:07:18]Let's check back around Christmas. Watch whether the auth story converges or keeps forking per client. And if you maintain a server yourself, your July 28th checklist fits on a sticky note.

[00:07:30]>> [music] >> Stop string matching error code minus 32002 because it becomes minus 32602. [music] Make sure your proxy passes the new MCP routing headers instead of stripping them. Send a strict JSON content type.

[00:07:47]>> [music] >> MCP made itself dumber on purpose because dumber survives longer.