MCP Adoption and the July 2026 Spec — what changed under you while you weren't looking

By mid-2026 MCP is no longer a small Anthropic project: it has a multi-vendor governance body, a July 28, 2026 spec release that removes protocol-level sessions, and adoption numbers large enough that "does this host support MCP" is now the exception question, not the rule. If you are about to connect a client or ship a server (the goal of this wiki), the two things that actually change your work are the stateless core and the hardened auth requirements below — everything else here is context for prioritizing what to build.

Scale metrics: servers, downloads, registry size

- 97 million monthly SDK downloads across Python and TypeScript as of December 2025 — reached in about 13 months since MCP's November 2024 launch — FONTE: https://www.digitalapplied.com/blog/mcp-adoption-statistics-2026-model-context-protocol - 10,000+ active public servers reported in December 2025 (official Anthropic figure) — FONTE: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/ - Official MCP Registry API snapshot, May 24, 2026: 9,652 latest server records, 28,959 total server/version records — FONTE: https://www.digitalapplied.com/blog/mcp-adoption-statistics-2026-model-context-protocol - GitHub Search API, same date: 15,926 repositories tagged mcp-server — a wider number because it includes community implementations never published to the official registry — FONTE: https://www.digitalapplied.com/blog/mcp-adoption-statistics-2026-model-context-protocol

Numbers to distrust

the widely repeated "78% of enterprise AI teams run MCP-backed agents in production" and "28% of Fortune 500 run MCP servers" figures trace to a single secondary source (https://andrew.ooo/answers/mcp-model-context-protocol-enterprise-adoption-july-2026/) that has not been checked against primary documentation — treat as unverified. The Stacklok 2026 survey figure below is the one the notes' own source calls "source-safe."

Who ships MCP natively today

- Claude Desktop is the reference host implementation — FONTE: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/ - Claude Code has extensive MCP integration — FONTE: https://nimbalyst.com/blog/best-mcp-clients-2026/ - ChatGPT supports MCP with beta write-action support in Business, Enterprise, and Edu workspaces (developer mode, announced March 2025); its implementation is remote-first, architecturally different from Claude's local-first default — FONTE: https://chatforest.com/guides/mcp-across-ai-platforms/ - VS Code has had native MCP support since early 2026, surfaced through GitHub Copilot Chat — FONTE: https://nimbalyst.com/blog/best-mcp-clients-2026/ - Cursor IDE ships a "polished multi-agent" native MCP integration — FONTE: https://nimbalyst.com/blog/best-mcp-clients-2026/ - Microsoft Copilot Studio reached general availability for MCP in May 2026, with federated connectors from LSEG, Moody's, HubSpot, and Notion — FONTE: https://www.microsoft.com/en-us/microsoft-copilot/blog/copilot-studio/new-and-improved-computer-using-agents-a-new-workflows-experience-and-real-time-voice-experiences/ - Google Gemini supports MCP tool calls, plus fully managed remote MCP servers for Cloud Run and Cloud Storage (March–April 2026) — FONTE: https://chatforest.com/guides/mcp-across-ai-platforms/ - Also shipping: Windsurf, Cline, Goose, Nimbalyst — FONTE: https://nimbalyst.com/blog/best-mcp-clients-2026/

See MCP Clients and Hosts: Claude, Cursor, VS Code, ChatGPT, Gemini — What 'Any Client' Actually Means for how these hosts differ in configuration surface once you actually try to connect one.

Enterprise adoption: production figures and what was blocking it

- Stacklok's 2026 survey: 45% of surveyed software-industry organizations run MCP servers in some form of production, versus 41% across the broader all-software respondent pool — FONTE: https://www.digitalapplied.com/blog/mcp-adoption-statistics-2026-model-context-protocol and https://nimbalyst.com/blog/best-mcp-clients-2026/ - More than 40% of retailers use MCP in production per Stacklok's 2026 retail survey — FONTE: https://stacklok.com/resources/state-of-mcp-in-retail-2026/ - What was blocking rollout in 2025: authorization complexity was the primary blocker for production deployments; the 2026 spec cycle responded with a standardized enterprise auth layer (OAuth, RBAC, audit logging) — see Authorization in MCP: OAuth 2.1, Token Scoping, and the Confused-Deputy Problem — securing a remote server on the first attempt — FONTE: https://andrew.ooo/answers/mcp-model-context-protocol-enterprise-adoption-july-2026/ - The Agentic AI Foundation reached 170 member organizations within four months of MCP's donation (December 2025) — FONTE: https://www.digitalapplied.com/blog/mcp-dev-summit-2026-readout-protocol-roadmap-analysis

Which enterprises connect what, and the gateway they put in front of it, is Enterprise MCP Integration Patterns — the Gateway Layer and the Build-vs-Buy Call Before You Ship a Server — not repeated here.

Full pattern catalogue (gateway/proxy governance, vendor vs in-house servers) belongs in Enterprise MCP Integration Patterns — the Gateway Layer and the Build-vs-Buy Call Before You Ship a Server.

The July 28, 2026 spec release candidate: what actually breaks your build

This is the part with direct consequences if you are implementing a server or client today. Release candidate locked May 21, 2026; final spec scheduled for July 28, 2026; a ten-week validation window let SDK maintainers and client implementers test against production workloads before that date, and Tier 1 SDKs are expected to ship support inside that window — FONTE: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/

Stateless core

the Mcp-Session-Id header and protocol-level session are removed. Client info and capabilities now travel in request metadata (_meta fields) on *every* request rather than being negotiated once at initialize/initialized (that handshake is also removed). This is what enables a "plain round-robin load balancer" instead of sticky sessions or a shared session store. A new server/discover method lets clients fetch server capabilities without any session binding — FONTE: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/. This directly rewrites MCP Session Lifecycle: the Handshake a Client Must Get Right — and the One Being Removed in 2026-07-28 and the operational trade-offs in MCP Transports: stdio for Local Servers, Streamable HTTP for Remote Ones.

Auth hardening

issuer validation per RFC 9207 is now mandatory — clients must validate the iss parameter and declare application_type during Dynamic Client Registration. Resource Indicators (RFC 8707) are required: clients must state explicitly which MCP server a token is intended for, closing the path where a malicious server could obtain a token meant for a different server. Protected Resource Metadata (RFC 9728) lets servers publish OAuth metadata so clients can auto-discover the correct authorization server. Clients must bind registered credentials to the issuing authorization server's issuer, and re-register when the resource migrates. Authorization itself remains optional in the spec but is "strongly recommended" whenever a server touches user-specific data or needs an audit trail — FONTE: https://workos.com/blog/mcp-2026-spec-agent-authentication and https://modelcontextprotocol.io/docs/tutorials/security/authorization. Detail lives in Authorization in MCP: OAuth 2.1, Token Scoping, and the Confused-Deputy Problem — securing a remote server on the first attempt.

Other breaking/operational changes

the "resource missing" error code changes from -32002 to -32602; Streamable HTTP now requires Mcp-Method and Mcp-Name headers so load balancers can route without inspecting the body; list/resource-read results now carry ttlMs and cacheScope so clients know result freshness and whether a result is safe to share across users; tool schemas support full JSON Schema 2020-12 (composition, conditionals, references) with unrestricted output schemas; W3C Trace Context propagation is now formally documented for distributed tracing across SDKs — FONTE: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/

Deprecated, 12-month removal window (Active → Deprecated → Removed, wire behavior unchanged during deprecation, per SEP-2577): Roots (replaced by tool parameters or config), Sampling (replaced by calling the LLM provider API directly), and Logging (replaced by stderr for stdio transport, OpenTelemetry for structured observability) — FONTE: https://modelcontextprotocol.io/seps/2577-deprecate-roots-sampling-and-logging. Don't build new servers against these three.

New extensions shipping alongside the spec

MCP Apps (first official MCP extension, launched January 26, 2026) lets tools declare interactive HTML interfaces rendered in sandboxed iframes via the ui:// URI scheme and _meta.ui.resourceUri, communicating bidirectionally over JSON-RPC via postMessage with optional user consent per tool call; use cases are dashboards, forms, visualizations, workflows, real-time monitoring; shipping clients are ChatGPT, Claude, Goose, and VS Code, with the @modelcontextprotocol/ext-apps npm package providing working examples — FONTE: https://blog.modelcontextprotocol.io/posts/2026-01-26-mcp-apps/. Full detail in MCP Apps: Server-Rendered UI Extensions — how a tool call returns an interactive interface the host renders inside the conversation, and what keeps that iframe from taking over. Tasks graduated from an experimental core feature (SEP-1686) to a formal extension: servers return durable task handles instead of blocking, with lifecycle states working, input_required, completed, failed, cancelled; clients poll via tasks/get respecting pollIntervalMs, or receive pushed updates via notifications/tasks through a subscriptions/listen mechanism; intended uses are CI/batch jobs, human-in-the-loop approval gates, external job systems, unreliable/mobile connections, and partial-progress batch processing — FONTE: https://modelcontextprotocol.io/extensions/tasks/overview. Full detail in MCP Tasks — running batch jobs, CI pipelines and human approvals without blocking the connection.

Roadmap under Agentic AI Foundation governance

MCP was donated to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, in December 2025. Mazin Gilbert was appointed Executive Director around April 2026, following Jim Zemlin's interim tenure — FONTE: https://www.digitalapplied.com/blog/mcp-dev-summit-2026-readout-protocol-roadmap-analysis. Governance runs on a Feature Lifecycle Policy (Active/Deprecated/Removed, ≥12 months between deprecation and removal — the same policy applied to Roots, Sampling, and Logging above); Standards Track SEPs must have matching scenarios in the conformance suite before reaching Final status; an Extensions Framework governs experimental capabilities outside the core spec using reverse-DNS identifiers and delegated maintainers — FONTE: https://aaif.io/blog/mcp-is-growing-up/. See From Anthropic Project to Linux Foundation Standard: How MCP Left Vendor Control for how MCP got here.

2026 roadmap priorities, per AAIF

Streamable HTTP as the primary transport, with SSE being deprecated and no new official transport planned this cycle; the Tasks primitive as the answer to async agent job tracking; governance maturation (contributor ladder, delegation model, SEPs as the formal change mechanism); and enterprise readiness — auth is called out as both the "most evolved" area and the "top concern" for organizations evaluating MCP, with audit trails, OAuth 2.1, gateway behavior, and configuration portability as stated priorities — FONTE: https://aaif.io/blog/mcp-is-growing-up/. Anthropic-specific product moves in 2026: self-hosted sandboxes (public beta, May 2026) and MCP tunnels (research preview, May 2026) for running agents inside a customer's perimeter over encrypted outbound-only connections — FONTE: https://www.digitalapplied.com/blog/mcp-dev-summit-2026-readout-protocol-roadmap-analysis. AAIF's own framing: "MCP is the Linux of agents. We're going to keep going" — FONTE: https://www.digitalapplied.com/blog/mcp-dev-summit-2026-readout-protocol-roadmap-analysis. The events program (AGNTCon + MCPCon in Amsterdam, Sept 17–18, and San Jose, Oct 22–23, plus MCP Dev Summits across ten cities, April–November 2026) explicitly frames its mandate as turning "standards into real systems that run in production at scale" — FONTE: https://www.linuxfoundation.org/press/agentic-ai-foundation-announces-global-2026-events-program-anchored-by-agntcon-mcpcon-north-america-and-europe.

Why this page matters for the wiki's objective

before you connect a client or stand up a remote server, you need to know two things this page settles — which hosts actually support the primitives you plan to use, and which parts of the spec you'd be building against are about to become stateless/harder-auth by July 28, 2026. Building against Roots, Sampling, or Logging today means building against a feature already on a 12-month removal clock.

Related

- MCP Transports: stdio for Local Servers, Streamable HTTP for Remote Ones — the stateless-core change above rewrites why Streamable HTTP now needs no sticky sessions; read this before choosing a transport for a new server. - Authorization in MCP: OAuth 2.1, Token Scoping, and the Confused-Deputy Problem — securing a remote server on the first attempt — the auth-hardening SEPs summarized here (issuer validation, Resource Indicators, Protected Resource Metadata) are the actual mechanics a working OAuth flow must implement. - MCP Clients and Hosts: Claude, Cursor, VS Code, ChatGPT, Gemini — What 'Any Client' Actually Means — the host-by-host adoption list here is the summary; that page is where configuration differences between hosts live. - MCP Apps: Server-Rendered UI Extensions — how a tool call returns an interactive interface the host renders inside the conversation, and what keeps that iframe from taking over and MCP Tasks — running batch jobs, CI pipelines and human approvals without blocking the connection — the two extensions introduced alongside the July 2026 spec, each detailed in full there. - Enterprise MCP Integration Patterns — the Gateway Layer and the Build-vs-Buy Call Before You Ship a Server — where the production adoption numbers above turn into gateway/proxy and governance decisions. - MCP Limits: Registry Trust and Supply Chain Risks — why 'it's in the registry' is not a safety guarantee before you connect a client — the registry scale numbers here (9,652 servers, 28,959 versions) are exactly the surface that page's vetting-gap concerns apply to. - From Anthropic Project to Linux Foundation Standard: How MCP Left Vendor Control — how MCP arrived at AAIF governance, narrated in full.