MCP specification 2026-07-28: stateless core and CIMD

What changed in the specification?

The Model Context Protocol published a new specification dated 2026-07-28. Four changes stand out.

• The core became stateless.
• Header routing was added to help gateways.
• Client ID Metadata Documents replaced Dynamic Client Registration.
• Extensions were introduced, including Enterprise-Managed Authorization.

Why does a stateless core matter for identity?

Stateful sessions tied identity to a long connection. A stateless core means each request stands on its own. That fits per-call authorization well. Each call can carry its own credential and be checked on its own.

It also makes it easier to put many servers behind one gateway. Requests do not need to stick to one server.

What does header routing do?

Gateways sit between agents and MCP servers. Header routing gives them a standard way to send each request to the right server without parsing the body.

That lowers the cost of running an MCP gateway. Several scored platforms run one. Aembit has the MCP Identity Gateway. Silverfort has the MCP Gateway. NewCore routes every agent tool call through its gateway. Idira's Identity Broker proxy plays the same role.

Why replace Dynamic Client Registration?

Dynamic Client Registration let any client register itself with an API call. On open MCP servers, that filled authorization servers with unknown clients. Nobody could tell which were legitimate.

CIMD changes the model. A client uses an HTTPS URL as its client ID. A JSON document at that URL describes the client. The authorization server fetches it and checks it.

So each client is tied to a domain someone controls. That is a real identity for an MCP client, before any token is issued.

Which platforms name CIMD?

Descope names CIMD. Descope and Idira also name DCR, which CIMD replaces. We did not find CIMD named by the other scored platforms. See the CIMD tracker.

What is Enterprise-Managed Authorization?

It is an MCP extension that grew out of Cross App Access. A company's identity provider decides which MCP servers an agent may reach. Anthropic, Microsoft and Okta adopted it. Okta shipped it as Agent SSO on 24 August 2026.

See the Enterprise-Managed Authorization tracker.

What should builders do?

If you run MCP servers, plan the move from DCR to CIMD. Check that your authorization server can fetch and validate metadata documents.

If you run a gateway, adopt header routing. It simplifies configuration.

If you buy an agent identity platform, ask which version of the MCP specification it supports. Ask specifically about CIMD and Enterprise-Managed Authorization.

Our read

This is the most consequential MCP release for identity so far. CIMD gives clients a real identity. Header routing makes gateways cheaper to run. Enterprise-Managed Authorization gives identity providers a seat at the table.

Our standards criterion will track adoption. Vendors who name these in public material will score higher at the next review.