MCP Just Published a New Roadmap: Agent Identity, DPoP, and Streamable HTTP Everywhere
MCP Just Published a New Roadmap: Agent Identity, DPoP, and Streamable HTTP Everywhere
On August 22, the Model Context Protocol team published an updated roadmap covering the next spec release and beyond. It's the clearest signal yet that MCP is moving from "client calls a tool" to "agent talks to agent."
"Modern agentic workloads no longer fit the standard request-and-response pattern."
That's the official line. Let's unpack it.
What problem is this roadmap solving?
MCP's biggest win over the past year was making "let an LLM call tools" a de facto standard. But agentic workloads have changed: loops run for hours, servers need to push streamed results, and work needs to be steered mid-flight. The old request-and-response pattern doesn't fit anymore.
The Core Maintainers built the roadmap together with community Working Groups, and organized it into five priority areas — each with named maintainers and at least one Working Group.
The five priority areas, side by side
| Area | Core content | Key moves |
|---|---|---|
| Agentic messaging primitives | Long loops, streamed pushes, mid-flight steering | Mature Tasks extension (SEP-2663) into the spec |
| HTTP-native transport unification | Remote and local servers on one transport | Streamable HTTP over stdio |
| Agent identity & enterprise security | Cloud agents with their own identity | Finalize DPoP + Workload Identity Federation |
| Improved primitives | Unified tool result contract, progressive discovery | Standardize tools/call output |
| SDK developer experience | Cross-language SDKs, spec conformance | Better conformance testing |
Agentic messaging: from "one question, one answer" to full supervision
This is the most substantive change on the roadmap. The official quote:
"We want to make sure that we not only offer the right primitives for the job, but also that they work well together."
Three concrete moves: server-initiated events (webhooks and channels, so clients stop polling for results), maturing the Tasks extension (SEP-2663, moving from experimental into the specification), and a composition review across the Agents, Transports, and Triggers & Events Working Groups.
The direct impact for developers: MCP servers can push events to clients instead of waiting to be asked "are we there yet?" Long-running tasks shift from polling to subscription.
Agent identity: the most "enterprise" piece of the roadmap
Today, MCP authorization is "a human clicks approve in a browser." That works for interactive clients — but more and more callers are agents running as cloud workloads: they have their own identity, act on behalf of a user who isn't present, or delegate narrower authority to sub-agents.
The plan: finalize Demonstrating Proof of Possession (DPoP, RFC 9449) and drive adoption, plus Workload Identity Federation (modelcontextprotocol/modelcontextprotocol PR #1933) and Enterprise-Managed Authorization (ID-JAG grant) — built on standard token exchange instead of pasted API keys and long-lived tokens.
In one sentence: agents get ID cards, not keychains.
Improved primitives: servers with a hundred tools make the model pay full price up front
Here's a sharp detail: connecting to a server with a hundred tools means the model pays for the entire surface before the user has asked a single question — and tool selection gets worse as the list grows.
The fix is progressive discovery: a server offers a small entry point and reveals more of its catalog as the conversation narrows. For servers with huge tool surfaces (cloud platforms, databases), this is a real optimization.
The counterargument: the roadmap is complete, but how long until it ships?
Optimistic view: SEP-2663, DPoP, and Workload Identity Federation aren't new proposals — they matured enough to become priorities. Pessimistic view: the previous roadmap (early 2026) listed server-initiated events, result type improvements, and agent identity as "on the horizon," and only now have they become priorities. Spec evolution is slower than the community hopes.
One more thing: SEPs inside the priority areas get expedited review; proposals outside aren't rejected outright, but "maintainer review time is scarce and goes to these areas first." If you're writing a SEP, pick your lane carefully.
What you can do today
- Read https://modelcontextprotocol.io/development/roadmap and find the Core Maintainers and Working Groups for the area you care about.
- If you build MCP servers: watch the Streamable HTTP unification — local servers running over stdio should eventually switch to HTTP seamlessly.
- If your server has a big tool surface: track progressive discovery, because it will change how you organize tools.
Pick the area that touches your stack and start following its Working Group — the spec is being written right now, with or without you.
FAQ
Q: When was the new MCP roadmap published? A: August 22, 2026, on the official MCP blog, with the full roadmap updated at modelcontextprotocol.io/development/roadmap.
Q: What are the five priority areas? A: Agentic messaging primitives, HTTP-native transport unification and hardening, agent identity and enterprise-ready security, improved primitives (tool result contract + progressive discovery), and SDK developer experience.
Q: What's the direct impact for regular MCP developers? A: Short term, server-initiated events and the Tasks extension turn long tasks from polling into subscription. Medium term, Streamable HTTP unifies local and remote transports. On security, DPoP and Workload Identity Federation replace pasted API keys.
✨ 本文由 DeepSeek 生成初稿，Claude 审核润色。
Sources:
- MCP Official Blog: The New MCP Roadmap
- Roadmap page: MCP Development Roadmap