{
  "post": {
    "title": "MCP specification changes, explained",
    "url": "https://bardak.ai/posts/mcp-specification-changes",
    "updated": "2026-10-29T15:31:53.517Z"
  },
  "citation": "MCP specification changes, explained, Ivan Bardak, bardak.ai, https://bardak.ai/posts/mcp-specification-changes",
  "datasets": [
    {
      "key": "mcp-versions-in-one-sentence-each",
      "title": "MCP versions in one sentence each",
      "type": "benchmarkTable",
      "source": "Model Context Protocol changelogs, 2025-03-26 to 2026-07-28",
      "caption": "Each version keeps what the previous one required and adds to it.",
      "csv": "https://bardak.ai/data/mcp-specification-changes/mcp-versions-in-one-sentence-each.csv",
      "header": [
        "Version",
        "In one sentence",
        "What to check in your servers"
      ],
      "rows": [
        [
          "March 2025 (2025-03-26)",
          "MCP gets a standard sign-in, and tools can say whether they only read data or also change it",
          "Users sign in as themselves; tools that change data are labelled"
        ],
        [
          "June 2025 (2025-06-18)",
          "Access tokens are locked to one server, so a stolen token cannot be used elsewhere, and tool results can follow a declared structure",
          "Tokens for other servers are rejected; the user's token is never forwarded"
        ],
        [
          "November 2025 (2025-11-25)",
          "Agents start with the minimum permissions and ask the user for more only when a task needs them",
          "Permissions are small and specific; extra rights need the user's consent"
        ],
        [
          "July 2026 (2026-07-28)",
          "Stricter checks on who issued a token, tool lists that depend on the user's permissions, and a simpler protocol",
          "Clients verify the token issuer; users see only the tools they may use"
        ]
      ]
    },
    {
      "key": "mcp-and-oauth-terms-in-plain-language",
      "title": "MCP and OAuth terms in plain language",
      "type": "benchmarkTable",
      "source": "",
      "caption": "",
      "csv": "https://bardak.ai/data/mcp-specification-changes/mcp-and-oauth-terms-in-plain-language.csv",
      "header": [
        "Term",
        "Meaning"
      ],
      "rows": [
        [
          "OAuth 2.1",
          "The standard way for an app to get permission to act for a user without seeing their password. Still an IETF draft, but widely implemented"
        ],
        [
          "PKCE",
          "An extra check during sign-in that stops a stolen login code from being used by someone else"
        ],
        [
          "Access token",
          "A short-lived digital key that says who the holder acts for and what they may do"
        ],
        [
          "Scope",
          "One permission inside a token, such as read invoices or send email"
        ],
        [
          "Identity provider (authorization server)",
          "The system that signs users in and issues tokens"
        ],
        [
          "Resource server",
          "A system that accepts tokens and serves data or actions; MCP servers are resource servers"
        ],
        [
          "Token audience",
          "The server a token was issued for; any other server must reject it"
        ],
        [
          "Token passthrough",
          "Forwarding a user's token to another system; forbidden in MCP"
        ],
        [
          "Step-up",
          "Asking the user for an extra permission at the moment a task needs it"
        ],
        [
          "Tool annotations",
          "Labels that describe what a tool does to the world, such as read-only or destructive"
        ],
        [
          "Output schema",
          "A declared structure for a tool's result, so the client can check it"
        ],
        [
          "Stateless",
          "The server keeps no session between requests, so any instance can answer any call"
        ]
      ]
    }
  ]
}