MCP ships biggest update yet: stateless architecture and hardened OAuth

On September 28, 2026, the Agentic AI Foundation (a Linux Foundation directed fund) released the largest update in MCP's history: a finalized stateless architecture, mandatory OAuth issuer (iss) validation, a formal 12-month deprecation policy, and MCP Apps and MCP Tasks graduated to official extensions. AAIF membership grew from about 40 to 240.

• Stateless design removes protocol-level sessions and sticky routing, letting clients talk to any server via a load balancer
• Mandatory OAuth iss validation closes a class of mix-up attacks; no known exploitation, vendor calls it preventive
• MCP Apps and MCP Tasks are now official extensions, plus multi-round-trip requests
• Nothing in the July 28, 2026 cohort can be removed before July 2027