What changed for MCP servers and the agents that use them.

1. Lior Aharonov · 7 October 2026

   MCP server cards are now Final. They list no tools, on purpose.

   What happened

   On Tuesday, 6 October 2026, SEP-2127 was merged into the MCP repository with status Final, on the Extensions Track. A remote server can now describe itself before anyone connects (name, version, transports and protocol versions) at <streamable-http-url>/server-card, with an optional AI Catalog at /.well-known/ai-catalog.json.

   What to do

   If you run a remote MCP server, publish a card at /server-card next to your endpoint and bump its version with every release.

   The card tells an agent who you are. It can not tell it whether you answered a minute ago. That part still has to be measured.

   • SEP-2127: MCP Server Cards, HTTP Server Discovery (Final) github.com

   mcpserver-cardsdiscoveryspec

2. Lior Aharonov · 7 October 2026

   The MCP docs now say it plainly. The protocol can not vouch for a local server.

   What happened

   On Monday, 5 October 2026, the MCP project merged a security guide for servers that run on your own machine. It names five threats (malicious servers, overcollecting servers, compromised dependencies, poisoned tool catalogs and vulnerable components) and calls running third-party servers in containers the most effective control.

   What to do

   Pin every local server to an exact version, give each one its own narrow token, and run third-party ones in a container that mounts only the project folder.

   Every npx line in your config is a stranger you let in with your keys. Treat it like one.

   • MCP pull request 3072: local server security guide github.com
   • MCP docs: Local server security github.com

   mcpsecuritylocal-serverssupply-chain

3. Lior Aharonov · 6 October 2026

   MCP has a draft for events. Agents may stop asking and start listening.

   What happened

   On Monday, 5 October, SEP-3415 was opened as a draft Events extension for MCP. Servers would list event types with events/list and deliver them by polling, streaming, or webhooks signed with Standard Webhooks. The draft lists eight open questions and has no reference SDK yet.

   What to do

   If your server already emits webhooks, read the draft and comment on the open questions now; hold off on shipping until a reference SDK lands.

   Events turn a tool list into an agent that reacts. I'd watch the replay rules closely, because that is where a missed event goes unnoticed.

   • SEP-3415: Events Extension (modelcontextprotocol pull request) github.com

   sepeventswebhooksspec

4. Lior Aharonov · 6 October 2026

   Cloudflare lets sellers price each MCP call. No checkout page involved.

   What happened

   On Wednesday, 30 September, Cloudflare opened a closed beta of Monetization Gateway. Sellers can charge agents for sites, APIs, MCP tools or datasets through HTTP 402 and x402, settled in USDC on Base via Coinbase's x402 facilitator. For now the beta is limited to eligible U.S. participants on both sides of the payment.

   What to do

   If you sell API or MCP access to U.S. customers and already proxy through Cloudflare, apply from the dashboard and price one tool per call before you price the whole server.

   Per-call pricing changes tool design. A tool that needs five calls to finish one job now costs the agent five times as much, so merge your chatty tools.

   • Monetization Gateway beta: charge AI agents for consumption with HTTP 402 blog.cloudflare.com

   x402paymentscloudflaremonetization

5. Lior Aharonov · 5 October 2026

   Two MetaMCP flaws scored 9.8 and 9.1. The newest release is still 2.4.22.

   What happened

   CVE records published on Tuesday, 29 September 2026 cover MetaMCP up to and including 2.4.22. CVE-2026-79538 (CVSS 9.8 per CISA) allows code execution through /mcp-proxy/server/stdio. CVE-2026-79537 (9.1) lets a caller use another tenant's session; the record says /metamcp/health/sessions hands out the session ids without authentication.

   What to do

   If you run MetaMCP, block /mcp-proxy/ at your reverse proxy, turn off open sign-up, keep it off the public internet and rotate the secrets in its environment.

   A gateway is the one box that knows every key. Patch it like one, and when there is no patch, hide it like one.

   • CVE-2026-79538 (CVE Program) cve.org
   • CVE-2026-79537 record (CVE Program) cveawg.mitre.org
   • CVE-2026-79537 advisory (Traceforce) traceforce.ai
   • CVE-2026-79538 advisory (Traceforce) traceforce.ai
   • MetaMCP releases (GitHub) github.com

   securitygateways

6. Lior Aharonov · 5 October 2026

   MCP extensions get three maturity levels. The next spec release may wait for March 2027.

   What happened

   SEP-3392, filed 25 September 2026, sorts MCP extensions into experimental-ext-, beta-ext- and ext- names. Apps and auth would start as stable, skills and tasks as beta. A second proposal, SEP-3398, proposes releases every March and September, starting in March 2027.

   What to do

   List the extensions your server and client advertise today, and note which would land as experimental, so a rename does not break clients overnight.

   Labels are cheap until a client trusts them. Then a renamed extension is an outage.

   • SEP-3392: Extension Lifecycle (GitHub) github.com
   • SEP-3398: Release Cycle Updates (GitHub) github.com

   specificationextensions

7. Lior Aharonov · 5 October 2026

   A draft MCP proposal wants servers to show a signed pass before any tool runs.

   What happened

   SEP-2809 is a draft that still has no sponsor; it had new review activity on 30 September 2026. A server would publish an Ed25519-signed document at /.well-known/mcp-attestation, and the host would check it against a trust root it pinned before allowing tools. Every admission and denial would go into a hash-chained, append-only audit log.

   What to do

   Nothing to do yet; watch for SEP-2809 to find a sponsor.

   Every protocol ends up rebuilding the passport office. The only open question is who holds the stamp.

   • SEP-2809: Attested Tool-Server Admission (GitHub) github.com

   specificationtrust

8. Lior Aharonov · 2 October 2026

   Only 7 of 72 MCP endpoints answered on the newest revision. The other 65 used older ones.

   What happened

   An independent count published on 2 October 2026 sent an initialize request to 186 remote MCP endpoints from the official registry on 1 and 2 October. Of the 72 that returned a protocol version, 7 (9.7%) negotiated the newest revision, 2026-07-28, and the rest answered with one of four older ones; 86 sat behind a sign-in.

   What to do

   Send your own server an initialize request right now and see which revision it answers with. Keep the older revisions working until your clients have actually moved.

   The newest spec gets the blog posts. The older ones still do most of the talking.

   • The MCP Ecosystem Is Speaking Five Revisions at Once. Here Is the Dated Count. (Pennyforge, DEV Community) dev.to

   protocolresearch

9. Lior Aharonov · 1 October 2026

   MCP server cards may not live at a fixed address after all. A catalog would point to them.

   What happened

   In SEP-2127 (MCP Server Cards, metadata a client reads before it connects), a 24 September comment said the card is not at a generic well-known address and needs an AI Catalog to point to it. SEP-1913 (trust and sensitivity annotations) is being split into small extensions in an experimental repository, with an optional evidenceRef field that carries a digest, a canonicalization and a schema; both proposals are still open.

   What to do

   Nothing to do yet; watch for where SEP-2127 settles the card before you publish one at a fixed address.

   The rules for who gets found are being written right now in a GitHub thread. I'd rather read it this week than learn the result later.

   • SEP-2127: MCP Server Cards, HTTP Server Discovery (GitHub) github.com
   • SEP-1913: Trust and Sensitivity Annotations (GitHub) github.com

   specificationdiscoverytrust

10. Lior Aharonov · 30 September 2026

    Microsoft Copilot now imports Agent Plugins. The commands may still change under you.

    What happened

    Microsoft introduced Work IQ Developer Tools (WIQD) on 30 September 2026: a plugin in the Agent Plugins format, which packages skills and MCP server configurations, can be imported, validated and packaged for Microsoft Copilot. From there it can be shared with named users or a whole tenant, or sent through Partner Center for certification.

    What to do

    If your plugin uses the Agent Plugins format, run it through the WIQD import and validate steps this week and fix what they flag. Then call your MCP server from Copilot yourself, because a package that validates is not the same as a server that answers.

    A new client is a new chance to be found, and a new way to fail in public. I'd test before I'd announce.

    • Bring your plugin to Microsoft Copilot with Work IQ Developer Tools (Microsoft 365 Developer Blog) devblogs.microsoft.com

    pluginsmicrosoft

11. Lior Aharonov · 29 September 2026

    ChatGPT quietly changed the rules. Some companies just lost a channel and don't know it.

    What happened

    At DevDay on 29 September 2026, OpenAI said ChatGPT can suggest a relevant plugin during a conversation and let people connect it on the spot. Its plugin guidelines say plugins with strong real-world utility and high user satisfaction may get enhanced distribution, such as directory placement or proactive suggestions.

    What to do

    Measure how fast your MCP server answers and how often its calls fail, and fix the worst tool this week. Satisfaction is one of the stated signals, and nobody is satisfied by a timeout.

    Google gave you a page two. ChatGPT doesn't. You're either recommended, or you don't exist.

    • Plugin guidelines (OpenAI developers) developers.openai.com
    • OpenAI DevDay 2026: what matters for plugin builders (MCPJam) mcpjam.com
    • OpenAI expands ChatGPT's plug-ins with app-like interfaces and automations (TechCrunch) techcrunch.com

    distributionopenai

12. Lior Aharonov · 25 September 2026

    The Claude plugin directory now takes submissions. The scan starts the second you submit.

    What happened

    On 25 September 2026 Anthropic opened its directory submission portal to developers on paid Claude plans. You can submit a single MCP connector or a plugin bundle of MCP servers and skills hosted on GitHub; each submission is checked and safety-scanned as soon as you submit, and after launch you see installs by product surface and version.

    What to do

    If people already use your MCP server, call each tool once from a clean client today and fix anything slow or broken. Then submit it as a connector or a plugin bundle and let the scan tell you what else to fix.

    A directory listing gets you the first click. Only a server that answers gets you the second.

    • Build plugins for Claude (Claude blog) claude.com

    pluginsanthropic

Every fact is checked against the source linked under it; the wording is ours. A correction: lior@7it.co.il. 7Maps by 7IT.