Direct answer
MCP is not secure by default. Your scopes, identity binding, and sandboxing are the security boundary. The 2026-07-28 spec hardens auth (RFC 9207 iss validation, CIMD over DCR) and makes the core stateless for HTTP scale. Treat tool metadata as untrusted. See Model Context Protocol.
What changed in 2026-07-28
- Stateless request/response core for ordinary HTTP infrastructure
- Authorization hardening with issuer validation
- Client ID Metadata Documents preferred; Dynamic Client Registration deprecated
- Tasks extension for long-running tool work
- MCP Apps for sandboxed server-rendered UIs
Permission model that holds
- Deny by default. Allow list tools per environment.
- Bind every call to a user or service principal.
- Separate credentials for dev, staging, and production.
- Version tool contracts and contract-test them in CI.
- Sandbox Apps. Same audit path as direct tool calls.
Failure mode: admin tokens for demos that become production integration tokens. Start read-only.
