What Is the New MCP Update? September 2026's Biggest-Ever Release, With Receipts
What Is the New MCP Update? September 2026's Biggest-Ever Release, With Receipts The short answer: on September 28, 2026, the Agentic AI Foundation (a Linux Foundation directed fund) shipped the biggest release in MCP's history — finalized stateless architecture, hardened OAuth authorization, a formal 12-month deprecation policy, and MCP Apps + MCP Tasks graduated to official extensions.…
September 28, 2026 marks the release of the biggest update in the MCP (Multi-Modal Communications Protocol) history, according to the Agentic AI Foundation, a Linux Foundation directed fund. This release includes a stateless architecture, hardened OAuth authorization, and a 12-month deprecation policy. Co-creator David Soria Parra stated that this update is similar to a v2 in spirit.
One key aspect of this update is statelessness, which allows for cheaper running of large server farms as tool calls are billed per call. This distinction is often overlooked, as searches for "MCP update" today may bring up July stories about MCP migrations, deprecation, and API changes. The September 28 release, however, is a different update that finalizes the long arc of enterprise-ready agentic AI.
The release includes a distinction in OAuth authorization, where the issuer (iss) parameter is now mandatory for validation, closing a class of mix-up attacks. Furthermore, Enterprise Managed Authorization, built with Okta, allows corporate IdPs to become the authoritative gatekeeper for MCP server access, replacing personal credentials. MCP Apps and MCP Tasks have also been upgraded to official extensions, and multi-round-trip requests are now supported.
The governance of the protocol has expanded, with the AAIF growing from 40 members in December 2025 to 240 members, making it the fastest-growing foundation in Linux Foundation history. The deprecation policy now requires a 12-month feedback period before any removal of features introduced in the 2026-07-28 cohort.
The updated release brings significant changes to the payment aspect of MCP. The protocol now requires a scored decision for each paid tool call, with thresholds of ≥0.80 for auto-execute, 0.50-0.79 for holding, and 0.50 or lower for blocking. The server-rendered "Pay now" form and resumable paid jobs are examples of payment decisions within the protocol, highlighting the importance of the payment gate at stateless scale.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
