The MCP 2026-07-28 release candidate makes a few changes to authorization that affect code already in production. We have been working through the RC to understand what it means for anyone running an MCP client or server. Protocol sessions are removed, so servers that validate a token once at initialize and trust the session afterward need rework — there is no longer a session to trust. And Dynamic Client Registration is deprecated: clients now identify themselves with a metadata document at a URL they host.
The remaining changes are smaller but worth knowing: resource indicators and issuer validation become mandatory, and 403 responses now carry machine-readable scope challenges that make incremental authorization a protocol feature rather than a UX hack.
The full write-up covers each change and the reasoning behind it, what the spec deliberately leaves undefined — including how OAuth scopes should relate to a tenant's admin-managed entitlements — and a migration checklist split by role: client builder, server builder, authorization-server operator. With step-through diagrams of the new flows.
Background, if you want the OAuth mechanics from scratch: our interactive primers on OAuth 2.0 & OIDC, Headless OAuth 2.0, and MCP Authorization.