MCP Protocol News - October 30, 2026

Week of: October 30, 2026

---

Overview

This week's MCP activity centered on formalizing extension and release processes, shipping a security-focused servers release, and expanding SDK and client support across Ruby, enterprise auth, Skills, Tasks, and MCP Apps. The specification repository also continued tightening documentation around extension lifecycle and enterprise managed authorization.

Stories

1. MCP Servers v2.2.0 released with security and CA certificate updates

Source: MCP Servers Link: https://github.com/modelcontextprotocol/servers/releases/tag/v2.2.0

The MCP Servers repository published v2.2.0 as a security release covering Node.js runtime and CA certificate updates for October 2026. The notes describe eMudhra's October 20 disclosure that private keys for eight intermediate CA certificates could be recovered from public certificates, followed by Node.js security releases on October 21 and certifi 2026.10.23 removing two eMudhra roots on October 23. The release notes also explain how the TypeScript servers rely on the Node.js runtime for certificate checks, with further server-by-server status in the source.

For MCP server operators, this is a trust-store and runtime patch event, not just a version bump. TypeScript deployments inherit Node's CA handling, while Python deployments may depend on certifi's root removals, so operators need to verify both runtime CVEs and certificate trust after upgrading.

Impact Analysis: Update MCP server runtimes and CA bundles promptly, then re-test TLS connections to affected services.

2. SEP-3392 Extension Lifecycle marked Final

Source: MCP Specification Link: https://github.com/modelcontextprotocol/modelcontextprotocol/commit/a1e969d3b3d327ab31f2b41637b76c94b954b329

SEP-3392 Extension Lifecycle was marked Final in the MCP specification repository, confirming the proposal is accepted. The commit states that the documentation changes required by the SEP land in the same pull request and that, as a Process SEP, it has no conformance requirement.

A formal lifecycle gives SDK and server maintainers a clearer process marker for extension proposals, separate from protocol conformance. The "no conformance requirement" note also distinguishes process changes from protocol behavior that implementations must satisfy.

Impact Analysis: Track extension SEP status and documentation separately from protocol conformance work.

3. SEP-3398 Release Cycle Updates merged into MCP specification repo

Source: MCP Specification Link: https://github.com/modelcontextprotocol/modelcontextprotocol/commit/ccaf9102ec5eb656eab50ca8333ef49dcd259c26

SEP-3398 Release Cycle Updates was merged into the MCP specification repository. The commit records the merge of the release-cycle pull request; see the source for the full proposal text and applied documentation.

Changes to the spec release cycle can affect when SDKs and server implementations need to target new revisions. Builders should watch how this SEP is reflected in the spec's versioning and release documentation.

Impact Analysis: Review the merged release-cycle SEP before planning the next MCP version upgrade.

4. Ruby SDK Tier 1 blog post added to MCP specification repository

Source: MCP Specification Link: https://github.com/modelcontextprotocol/modelcontextprotocol/commit/1aca59bd76408843d235f8a2cf09be68cc9fc3aa

A merge to the MCP specification repository added a blog post announcing the Ruby SDK as Tier 1. The commit message identifies PR #3400 from koic and the post's subject: Ruby SDK Tier 1.

Tier 1 status is an ecosystem maturity signal for Ruby developers building MCP clients or servers. It can affect expectations around maintenance, feature coverage, and where teams look for official SDK guidance; see the blog post for the tier criteria and commitments.

Impact Analysis: Ruby teams should review the new Tier 1 post for support and compatibility details.

5. Enterprise managed auth docs add identity provider support matrix

Source: MCP Specification Link: https://github.com/modelcontextprotocol/modelcontextprotocol/commit/710a132f56a6928b245a030376981ea73614677b

The MCP specification docs added identity provider support details for enterprise managed authorization. The change merges IdP and authorization-server tables with per-role columns, corrects statuses against vendor release notes as of 2026-08-30, and covers vendors including Okta, PingFederate, Descope, WorkOS, Scalekit, Stytch, Keycloak, and Janssen. It notes that Okta XAA is GA in Identity Engine 2026.08.1, while WorkOS and Scalekit are gated early access rather than shipped.

Enterprise MCP deployments increasingly depend on OAuth and managed authorization, so accurate IdP status matters for architecture and security reviews. The update helps builders distinguish GA capabilities from early-access or partial support when selecting an identity provider.

Impact Analysis: Verify current vendor status before relying on any IdP row in the enterprise auth matrix.

6. Tasks support marked for Claude Code and Claude.ai

Source: MCP Specification Link: https://github.com/modelcontextprotocol/modelcontextprotocol/commit/f44325dc6718e974b90159df84996f03bf26a3d8

The MCP extension support matrix was updated to mark Tasks support for Claude Code and Claude.ai. The commit is a documentation status change for those clients.

Support-matrix entries are how builders check which clients implement specific MCP extensions. Marking Claude Code and Claude.ai gives Tasks-focused developers two more listed targets, though the exact extension scope and version should be confirmed in the source.

Impact Analysis: Use the support matrix to confirm Tasks compatibility before building client-specific workflows.

7. MCPJam Inspector adds Skills over MCP support

Source: MCP Specification Link: https://github.com/modelcontextprotocol/modelcontextprotocol/commit/05456131a785fdac60c575636da8e33bdc80f317

The extension matrix now marks Skills support for MCPJam. The commit notes that MCPJam Inspector v3.17.0 (2026-10-26) aligns its Skills over MCP host with the released extension, including skills/list and skills/get, per-file size and digest checks, frontmatter verification, and per-server namespacing across the app, CLI, and SDK.

An inspector with Skills support gives developers a way to test skill manifests and server behavior against the released extension. The emphasis on size and digest checks plus frontmatter verification points to packaging and validation concerns that matter as Skills are adopted in real hosts.

Impact Analysis: Use MCPJam Inspector to validate Skills-over-MCP manifests, namespacing, and per-file integrity checks.

8. Kiro Crew added to MCP Apps extension support matrix

Source: MCP Specification Link: https://github.com/modelcontextprotocol/modelcontextprotocol/commit/f66b955ef9c42b87c856c5640ac09b425cbb4d44

The extension support matrix added Kiro Crew after PostHog Code with MCP Apps support. The commit says Kiro Crew renders MCP Apps (io.modelcontextprotocol/ui, 2026-01-26 stable) for stdio servers routed through its gateway, and it notes no OAuth Client Credentials or Enterprise-Managed Authorization support based on a 2026-10-28 check.

More hosts rendering MCP Apps expands the UI extension's practical footprint, but the same entry shows partial enterprise-auth support. Builders should separate UI rendering capability from auth and security features when evaluating Kiro Crew as a host.

Impact Analysis: Account for stdio gateway routing and missing enterprise auth extensions when targeting Kiro Crew with MCP Apps.

Source Links

• MCP Servers - MCP Servers v2.2.0 released with security and CA certificate updates
• MCP Specification - SEP-3392 Extension Lifecycle marked Final
• MCP Specification - SEP-3398 Release Cycle Updates merged into MCP specification repo
• MCP Specification - Ruby SDK Tier 1 blog post added to MCP specification repository
• MCP Specification - Enterprise managed auth docs add identity provider support matrix
• MCP Specification - Tasks support marked for Claude Code and Claude.ai
• MCP Specification - MCPJam Inspector adds Skills over MCP support
• MCP Specification - Kiro Crew added to MCP Apps extension support matrix