August 28, 2026
In this edition
Keep MCP access tokens valid through restarts
Signed OAuth access tokens are now stateless and survive server restarts and deployments.
Read moreRead less
- Refresh grants allow a bounded 60-second replay grace window with up to five concurrent replays.
- Streamable HTTP negotiates on
POST /mcp. - By default,
GET /mcpreturns 405 withAllow: POST, DELETE;DELETE /mcpreturns a stateless 204 acknowledgement. - Legacy SSE remains available on
GET /sse.
Start Capability changes from the canonical graph
Capability traversal and proposal-first change tools now use the canonical graph.
Read moreRead less
- Changes begin as proposals instead of being applied directly.
- App-owned contracts and human approval remain required.