On Tuesday 20 October 2026 Microsoft introduced retrieve, a new MCP tool in Work IQ that searches a user's email, files, meetings, Teams messages and people. Microsoft says it evolves the Copilot Retrieval API for agents. Each hit carries fields such as webUrl, contentProtection and sensitivityLabel, next to a markdown answer to ground on.
What to do
If you sell an MCP server to Microsoft 365 customers, read the strategy section: grounding limits search to SharePoint, OneDrive, Teams and Outlook, so plan for customers who turn your source off.
Enterprise agents will not open twenty connections to find a file. They will ask one tool, and that tool decides which sources are in the room.
On Friday 23 October 2026 the official MCP TypeScript SDK shipped 2.4.0 with support for Skills over MCP (SEP-2640). A server publishes a folder of skills with loadSkills(folder) and skills.attach(server); a client lists, reads and verifies them with SkillsClient. The release notes mark attach as experimental.
What to do
If your server is on the TypeScript SDK, upgrade to 2.4.0 in a branch, attach one skill that explains your main tool, and pin the version, since attach may still change in a minor release.
Tools without instructions are a box of parts. A server that ships its own manual gets used correctly the first time.
On 22 October 2026 Anthropic said it is donating Agent Skills to the Agentic AI Foundation, part of the Linux Foundation, which already hosts MCP. The gift covers the name and logo, the GitHub organization and the agentskills.io domain. Anthropic cites more than 70 agent platforms, 1 million published skills and nearly 280 million installs.
What to do
Read the proposed roadmap (versioned releases, a formal proposal process, security guidance for skill authors) and send feedback while it is still a proposal.
MCP tells an agent what it can reach. Skills tell it how to do the work. One house for both was overdue.
On 21 October 2026 Cloudflare said Commerce.com turned on WebMCP for almost 100,000 of its domains through Cloudflare's edge, with no theme edits by merchants. Agents find a store's tools on document.modelContext in the browser and call them directly. Cloudflare describes WebMCP as an experimental, proposed standard in early preview.
What to do
If you build agents that shop or browse, test calling page tools on document.modelContext in a Chrome build with the WebMCP flag on, and keep your MCP server as the fallback.
Two doors into the same shop: one on the server, one in the browser. Agents will try both.
On 21 October 2026 the MCP Inspector project published nine security advisories. Two are Critical at CVSS 9.6: a malicious remote server could run local commands through the OAuth callback (versions 0.13.0 to 1.0.2) or through its MCP App (0.20.0 to 1.0.2). Version 1.0.3 fixes both, and 2.12.0 fixes the issues in the 2.x line.
What to do
Update to Inspector 2.12.0, or 1.0.3 if you stay on the 1.x line, before you connect it to any server you did not write. Remove older copies pinned in scripts.
The debugger is part of your attack surface. Treat every unknown server like an email attachment.
Claude Code 2.1.307, published to npm on 21 October 2026 at 20:47 UTC, fixes HTTP MCP tool calls that were sent twice when the connection closed mid-call. Per the changelog, only read-only or idempotent tools are now retried, and servers no longer stay failed in headless runs after a macOS or Linux computer slept while they were connecting.
What to do
Check the readOnlyHint and idempotentHint annotations on every tool you publish, and set them only where a repeated call is truly harmless.
A retry is a second request with your name on it. Only promise idempotent if you mean it.
As of 21 October 2026, Claude Code 2.1.305 is the latest tag on npm. Its changelog says allowedMcpServers no longer filters managed-mcp.json stdio servers that use ${VAR} only in env, so a server the allowlist left out now loads on upgrade. Another fix stops a same-named server from your own settings replacing one passed by a cloud session or setMcpServers.
What to do
If you manage Claude Code settings, add deniedMcpServers entries for any managed-mcp.json stdio server that must stay off, then retest after upgrading to 2.1.305.
An allowlist that quietly changes meaning is not a wall. Read the changelog before you trust the fence.
On 20 October 2026 the MCP specification repository merged PR 3440. It renames the Triggers and Events working group to Tasks and Events, moves the Tasks scope into it, and converts the Agents working group to an interest group. The Agents charter says the group will recommend how to evolve the protocol, create extensions or document how existing primitives should be used.
What to do
Read the two charters before you design a long-running agent tool, and follow the Tasks and Events group for the path of Tasks into the core protocol.
Interest groups talk. Working groups ship. Know which one your feature depends on.
Claude Code 2.1.304 shipped on 19 October 2026 and is now the latest, next and stable release on npm. In cloud sessions, a new conversation's first turn no longer waits for the local (stdio) MCP servers of plugins synced from claude.ai, unless a server sets alwaysLoad: true. The same release lets a mod's tool.check answer with decider: "person".
What to do
If your plugin's stdio server must answer on the very first turn, set alwaysLoad: true on it and test a fresh cloud session. Otherwise make sure your skill still works when the tool arrives a turn later.
Startup time is now a feature someone else trims for you. Decide whether your server is worth the wait, before the client decides it isn't.
On 16 October 2026 Cloudflare described a system that checks over time whether Verified bots honor site preferences: it compares bot traffic with robots.txt rules and watches whether a bot slows down after an HTTP 429. Each bot gets an explainable trust band. Cloudflare uses it internally for now and says it will share the scores publicly on Radar.
What to do
Check that your agent's HTTP client backs off on every 429 and reads robots.txt before it fetches a site. Count the 429s your agents received this week.
Politeness just became a score. The agents that back off at the first 429 are the ones sites will keep letting in.
Microsoft's September 2026 Foundry roundup, posted on 15 October, confirms Tool Search is generally available, as announced on 24 September. Instead of sending every tool definition with each model request, a Toolbox exposes discovery and invocation through tool_search and call_tool. Toolboxes for prompt agents entered public preview.
What to do
Rewrite each tool description so its first line names the task and the object it acts on, then test whether a plain-language search finds it.
Tool search turns every description into a search listing. Write it for the query, not for the README.
Microsoft released Azure MCP Server 3.0 on 12 October 2026 and announced it on 14 October. It uses the stateless MCP protocol 2026-07-28, so clients on that version must send Mcp-Method and Mcp-Name headers on every POST, while clients on 2025-11-25 keep a negotiated fallback. Tool prefixes moved from resilience_* to resiliency_*, and unknown parameters now produce errors.
What to do
If you run an MCP server, test it against a 2026-07-28 client that sends Mcp-Method and Mcp-Name headers. If you rename a tool, ship the old name as an alias for one release and say so in your changelog.
A tool name is an API. Renaming it is a breaking change, even when the code behind it is identical.
Anthropic put OpenTelemetry traces on the Claude Platform into public beta on 14 October 2026. Its docs say the API adds a tool span for each use of a server tool or an MCP connector tool that the API runs. The default Metadata only mode carries identifiers, timing, status, token counts and the names of MCP servers; Full content adds prompts and responses.
What to do
Give your MCP server a clear, stable name, and check your own latency and error rate before a customer's trace shows it to them.
Your customers just got a stopwatch. I'd rather know my numbers before they read them to me.
Claude Code 2.1.299 is the latest release. Its changelog says an MCP allow rule now reaches only the server it names, so mcp__a no longer allows a server named a__b or a_. Deny and ask rules for server names that contain __ are fixed too, and agent tools lists follow the same exact-name rule.
What to do
Check whether your server name contains __. If it does, tell users to write mcp__<server>__* with the whole normalized name, or rename the server.
A server name is part of your permission surface. Pick one that cannot be confused with a prefix of another.
On 13 October 2026 Microsoft announced the SharePoint Embedded MCP server in public preview, run with npx @microsoft/spe-mcp. It creates and manages container types and containers, provisions apps, configures billing and uploads content, and Microsoft names GitHub Copilot, Claude, Cursor and Azure AI Foundry as clients. On npm the latest tag is 0.2.0-alpha.4, published 9 September.
What to do
If you try it, pin the exact version in your client config, use a test tenant first, and require a person to approve any billing or provisioning call.
A tool that can configure billing deserves a pinned version and a human click. Preview is a label. The version string is the truth.
On Friday 9 October 2026, Claude Code 2.1.296 raised the default limit on MCP tool descriptions sent up front, and on MCP server instructions, from 2,048 to 4,096 characters. On npm it is the latest release, while the stable channel still points to 2.1.287.
What to do
Measure every tool description and your server instructions today. Keep warnings and limits inside the first 2,048 characters, because users on the stable channel still run a release from before this change.
Write the description for the smallest window your users run. The bigger window is a bonus, never the plan.
On Wednesday 7 October 2026 at 23:57 UTC, @modelcontextprotocol/inspector 2.10.0 shipped with two bins, mcpdo and mcp-inspector, and npx @modelcontextprotocol/inspector stopped working. Version 2.10.1 followed at 05:22 UTC on Thursday 8 October with an inspector bin alias, and npm now marks 2.10.0 deprecated.
What to do
If users start your MCP server with npx, keep one bin named exactly like the unscoped package name before you add a second one. Then test the plain npx your-package command in CI, not only the bin by name.
Your install line is part of your API. I would test it like one, on every release.
On Thursday 8 October 2026, Google Cloud introduced the Gemini agent at Gemini at Work 2026. Google says it can connect securely with any MCP server inside or outside a company network, and offers an enterprise tools registry where teams publish tools for the rest of the company.
What to do
If you run a remote MCP server for business users, check that it works with standard OAuth and write one plain paragraph per tool on what it reads and what it changes.
Every big platform wants its own tool shelf now. I'd make my server the easiest one on the shelf to approve.
On Friday 2 October 2026, the official TypeScript SDK shipped @modelcontextprotocol/server 2.3.0 as a minor release, then 2.3.1 on Monday 5 October. A server object now serves one connection at a time. Reuse one McpServer across stateless HTTP requests and the second request can fail with ALREADY_CONNECTED.
What to do
Search your code for an McpServer created outside the request handler. Move it inside, upgrade to 2.3.1, and send two requests at once before you ship.
Minor version. Major surprise. I'd test request number two before I trust request number one.
On Wednesday 7 October 2026, GitHub made local sandboxing generally available in Copilot CLI, the Copilot app and VS Code sessions using Agent Host. Tools and commands Copilot starts run with restricted access to files, network and credentials. GitHub says this covers local MCP servers where supported, and enterprises can enforce policies developers cannot weaken.
What to do
If you ship a local MCP server, list every path, host and credential it needs in your README, then run it under a Copilot local sandbox before your users do.
A local server used to inherit the whole laptop. Now it gets what the policy allows. Write down what you need, or expect to get nothing.
On Tuesday, 6 October 2026, SEP-2127 was merged into the MCP repository with status Final, on the Extensions Track. A remote server can now describe itself before anyone connects (name, version, transports and protocol versions) at <streamable-http-url>/server-card, with an optional AI Catalog at /.well-known/ai-catalog.json.
What to do
If you run a remote MCP server, publish a card at /server-card next to your endpoint and bump its version with every release.
The card tells an agent who you are. It can not tell it whether you answered a minute ago. That part still has to be measured.
On Monday, 5 October 2026, the MCP project merged a security guide for servers that run on your own machine. It names five threats (malicious servers, overcollecting servers, compromised dependencies, poisoned tool catalogs and vulnerable components) and calls running third-party servers in containers the most effective control.
What to do
Pin every local server to an exact version, give each one its own narrow token, and run third-party ones in a container that mounts only the project folder.
Every npx line in your config is a stranger you let in with your keys. Treat it like one.
On 6 October 2026 the MCP TypeScript SDK maintainers published CVE-2026-104850, rated High at CVSS 7.5. The OAuth client could send credentials to an authorization server chosen by the MCP server. Affected: @modelcontextprotocol/sdk 1.12.0 to 1.30.1 and @modelcontextprotocol/client 2.0.0 to 2.1.0; fixed in 1.31.0 and 2.2.0.
What to do
Upgrade to sdk 1.31.0 or client 2.2.0, pass expectedIssuer to the bundled providers, and rotate the client secret and revoke tokens for any client that may have touched an untrusted MCP server.
An OAuth client that lets the server choose the login page is a client that hands out keys on request.
On Monday, 5 October, SEP-3415 was opened as a draft Events extension for MCP. Servers would list event types with events/list and deliver them by polling, streaming, or webhooks signed with Standard Webhooks. The draft lists eight open questions and has no reference SDK yet.
What to do
If your server already emits webhooks, read the draft and comment on the open questions now; hold off on shipping until a reference SDK lands.
Events turn a tool list into an agent that reacts. I'd watch the replay rules closely, because that is where a missed event goes unnoticed.
On Wednesday, 30 September, Cloudflare opened a closed beta of Monetization Gateway. Sellers can charge agents for sites, APIs, MCP tools or datasets through HTTP 402 and x402, settled in USDC on Base via Coinbase's x402 facilitator. For now the beta is limited to eligible U.S. participants on both sides of the payment.
What to do
If you sell API or MCP access to U.S. customers and already proxy through Cloudflare, apply from the dashboard and price one tool per call before you price the whole server.
Per-call pricing changes tool design. A tool that needs five calls to finish one job now costs the agent five times as much, so merge your chatty tools.
CVE records published on Tuesday, 29 September 2026 cover MetaMCP up to and including 2.4.22. CVE-2026-79538 (CVSS 9.8 per CISA) allows code execution through /mcp-proxy/server/stdio. CVE-2026-79537 (9.1) lets a caller use another tenant's session; the record says /metamcp/health/sessions hands out the session ids without authentication.
What to do
If you run MetaMCP, block /mcp-proxy/ at your reverse proxy, turn off open sign-up, keep it off the public internet and rotate the secrets in its environment.
A gateway is the one box that knows every key. Patch it like one, and when there is no patch, hide it like one.
SEP-3392, filed 25 September 2026, sorts MCP extensions into experimental-ext-, beta-ext- and ext- names. Apps and auth would start as stable, skills and tasks as beta. A second proposal, SEP-3398, proposes releases every March and September, starting in March 2027.
What to do
List the extensions your server and client advertise today, and note which would land as experimental, so a rename does not break clients overnight.
Labels are cheap until a client trusts them. Then a renamed extension is an outage.
SEP-2809 is a draft that still has no sponsor; it had new review activity on 30 September 2026. A server would publish an Ed25519-signed document at /.well-known/mcp-attestation, and the host would check it against a trust root it pinned before allowing tools. Every admission and denial would go into a hash-chained, append-only audit log.
What to do
Nothing to do yet; watch for SEP-2809 to find a sponsor.
Every protocol ends up rebuilding the passport office. The only open question is who holds the stamp.
An independent count published on 2 October 2026 sent an initialize request to 186 remote MCP endpoints from the official registry on 1 and 2 October. Of the 72 that returned a protocol version, 7 (9.7%) negotiated the newest revision, 2026-07-28, and the rest answered with one of four older ones; 86 sat behind a sign-in.
What to do
Send your own server an initialize request right now and see which revision it answers with. Keep the older revisions working until your clients have actually moved.
The newest spec gets the blog posts. The older ones still do most of the talking.
In SEP-2127 (MCP Server Cards, metadata a client reads before it connects), a 24 September comment said the card is not at a generic well-known address and needs an AI Catalog to point to it. SEP-1913 (trust and sensitivity annotations) is being split into small extensions in an experimental repository, with an optional evidenceRef field that carries a digest, a canonicalization and a schema; both proposals are still open.
What to do
Nothing to do yet; watch for where SEP-2127 settles the card before you publish one at a fixed address.
The rules for who gets found are being written right now in a GitHub thread. I'd rather read it this week than learn the result later.
Microsoft introduced Work IQ Developer Tools (WIQD) on 30 September 2026: a plugin in the Agent Plugins format, which packages skills and MCP server configurations, can be imported, validated and packaged for Microsoft Copilot. From there it can be shared with named users or a whole tenant, or sent through Partner Center for certification.
What to do
If your plugin uses the Agent Plugins format, run it through the WIQD import and validate steps this week and fix what they flag. Then call your MCP server from Copilot yourself, because a package that validates is not the same as a server that answers.
A new client is a new chance to be found, and a new way to fail in public. I'd test before I'd announce.
At DevDay on 29 September 2026, OpenAI said ChatGPT can suggest a relevant plugin during a conversation and let people connect it on the spot. Its plugin guidelines say plugins with strong real-world utility and high user satisfaction may get enhanced distribution, such as directory placement or proactive suggestions.
What to do
Measure how fast your MCP server answers and how often its calls fail, and fix the worst tool this week. Satisfaction is one of the stated signals, and nobody is satisfied by a timeout.
Google gave you a page two. ChatGPT doesn't. You're either recommended, or you don't exist.
On 25 September 2026 Anthropic opened its directory submission portal to developers on paid Claude plans. You can submit a single MCP connector or a plugin bundle of MCP servers and skills hosted on GitHub; each submission is checked and safety-scanned as soon as you submit, and after launch you see installs by product surface and version.
What to do
If people already use your MCP server, call each tool once from a clean client today and fix anything slow or broken. Then submit it as a connector or a plugin bundle and let the scan tell you what else to fix.
A directory listing gets you the first click. Only a server that answers gets you the second.
Lior Aharonov · my take