State of MCP: October 2026

October 2026 was a quiet month for the Model Context Protocol (MCP) spec itself, and a loud month for security fixes. No new spec version shipped: the latest is still 2026-07-28. But the project moved its next release to March 2027, and the official repos published 31 security advisories in 28 days.

This is our first monthly "State of MCP" report. Every item links to the page we opened, and every number says how we got it. Facts are as of 28 October 2026. If you are new to MCP, start with what MCP is and come back.

The month in one paragraph

The spec stayed on version 2026-07-28, and the work shifted to making it safe and predictable. Maintainers set a fixed release calendar, finalized Server Cards for discovery, and formed a new Tasks and Events working group. SDK teams spent the month on fixes: memory limits, session cleanup, and OAuth bugs. Many of those fixes came with public advisories. Outside the protocol, AAIF announced new members and projects at its San Jose conference, and Smithery wound down its hosted services.

Spec and governance

No new spec version, and the next one moves to March 2027

The latest MCP specification is still 2026-07-28. Its big changes, such as removing sessions and the initialize handshake, are covered in our 2026-07-28 changes guide and the specification changelog.

The bigger October news is about timing. SEP-3398, "Release Cycle Updates" was accepted on 14 October 2026 and merged on 27 October. It says spec releases will happen every six months, "generally on the last Tuesday of March and September." It also says the proposed transition "moves the December 2026 release target to late March 2027."

What this means for you: plan on 2026-07-28 being the current version through the winter. Our guide to MCP versioning and deprecation explains how long older features keep working.

Server Cards are Final

SEP-2127, "MCP Server Cards" was merged on 6 October 2026 with status Final. A Server Card is a small metadata file that describes a remote server: its transports, protocol versions and connection guidance. The PR describes a .well-known/ai-catalog.json endpoint for this "pre-connection discovery."

In plain terms, an app can learn how to talk to your server before it connects. If you run a public server, read our MCP server discovery explainer and watch for SDK support.

Working groups and docs

• On 20 October, the maintainers merged a change that forms a Tasks and Events Working Group and turns the Agents Working Group into an Interest Group. Tasks are covered in our Tasks extension guide.
• On 5 October, the project added a Local Server Security guide to its docs. It covers what a local server can reach on your machine, and notes that the stdio transport "is not a sandbox."

AAIF and MCPA

MCP has lived at the Agentic AI Foundation under the Linux Foundation since December 2025. On 22 October 2026, at AGNTCon + MCPCon North America in San Jose, AAIF made two announcements:

• It passed 300 members, reporting 305 member organizations. New Gold Members include MongoDB, Vercel and Royal Bank of Canada.
• It added four projects: Agent Skills (from Anthropic), Open Responses (from OpenAI), OpenEnv (from Hugging Face) and OpenSandbox (from Alibaba). AAIF now hosts 10 projects, up from three at launch.

In that release, David Soria Parra, MCP co-creator at Anthropic, thanked AAIF for "giving the Model Context Protocol (MCP) a neutral home." The MCPA certification, launched in September, is still the only official MCP exam. AAIF's news page lists its launch announcement on 13 September 2026.

Registry and ecosystem numbers

We counted the official MCP Registry ourselves. The method is in the Methodology section below. These are our observations, not numbers published by the MCP project.

Two notes on reading this table. First, "latest version published in October" counts servers that were added or updated this month. The registry does not show which listings are brand new without a much slower crawl of every version. Second, a listing is not a quality signal. The registry stores metadata and does not vet code, which is why we wrote a guide on how to choose MCP servers.

The registry software itself had a busy month. Its maintainers shipped five releases between 23 and 27 October. Version 1.8.6 focuses on search speed, and searches now need at least three characters.

For older, sourced figures such as SDK downloads, see our MCP statistics page.

SDK releases in October

Here are the October releases we found on each official SDK's GitHub releases page. See our official SDKs guide for what each SDK is.

The Go SDK's 1.8.0 landed a little earlier, on 14 September. Its notes say it hardens transports "against resource exhaustion" and keeps 2026-07-28 as the newest version it supports. A theme runs through all of these: SDKs are adding hard limits on request size, session counts and memory.

The developer tool MCP Inspector shipped often too, from 2.10.0 on 7 October to 2.13.0 on 28 October, plus a 1.0.3 security release on 21 October.

Clients

These are the MCP-related client changes we could confirm from each vendor's own changelog or help page.

• Claude: Anthropic's help article on custom connectors now puts them under "Customize > Connectors" for Pro and Max. Free accounts can add one custom connector. On the developer side, the Claude Code changelog shows many MCP fixes in October. One stops HTTP MCP tool calls from being sent twice: "only read-only or idempotent tools are now retried."
• ChatGPT: OpenAI's help article on connecting custom MCP servers describes a Plugins flow for Business and Enterprise/Edu workspaces on the web, with no Developer Mode needed. We recorded this on 27 to 28 October; the page blocked our automated check today. For an example, see our guide to connecting ChatGPT to Zapier's MCP server.
• Google Gemini CLI: The v0.66.0 release on 27 October adds opt-in support for private network endpoints in MCP OAuth flows. We found no larger Gemini MCP announcement this month.
• OpenAI Codex CLI: Release 0.164.0 on 23 October adds sign-in for enterprise MCP connections and prefers "resource-specific scopes during MCP OAuth discovery."
• VS Code: Version 1.144, released 28 October, previews Copilot connectors, which Microsoft describes as "GitHub-managed MCP servers." It also adds /mcp show, /mcp enable and /mcp disable commands.
• GitHub MCP server: Version 2.0.0 on 6 October adds structured outputs and output schemas, shown only to clients that support the 2026-07-28 spec. Read our GitHub MCP server profile.
• Cursor: The Cursor changelog lists an Agent SDK on 20 October that can add "tools from MCP servers." Cursor has been part of SpaceX since August.

For a side-by-side view of which apps support what, see best MCP clients.

Companies and deals

• Smithery winds down hosted services (31 October). Smithery's own notice says it is "shutting down Smithery's connection management services" on 31 October 2026. That covers hosted server URLs, the API, accounts, API keys, the CLI and SDKs. smithery.ai stays up "as a public directory of MCP servers, now powered by Arcade.dev," and the page is signed "Smithery (now part of Arcade)." Paid users are refunded for charges since 5 August. If you call a Smithery-hosted URL, switch to the vendor's own URL now. See our Arcade profile and best MCP directories.
• MintMCP is now Mintive. mintmcp.com now permanently redirects to mintive.com. Our Mintive profile has the details.
• Earlier deals still settling in. Boomi acquired Lunar.dev in July 2026, and Lunar's gateway docs now point to Boomi. See our Lunar.dev profile and the MCP companies hub.

Security

October was the busiest month for MCP security advisories we have tracked. We counted 31 advisories published between 1 and 28 October 2026 across the official MCP GitHub repos: 2 critical, 10 high, 14 medium and 5 low. The method is below.

What to do this week:

1. Update MCP Inspector to 1.0.3 or later. The critical advisory GHSA-6x67-4w4w-9f3w says a "Remote MCP App can steal proxy auth token and execute arbitrary local commands." It affects versions 0.20.0 to 1.0.2.
2. Update your SDKs. For example, the TypeScript advisory GHSA-jm63-cq47-j5jp is fixed in @modelcontextprotocol/server 2.3.0. The Python OAuth advisory GHSA-qx49-fqc8-xw99 is fixed in mcp 2.2.0 and 1.30.0.
3. Update the reference servers if you run the filesystem, fetch or git servers.

Many of these bugs match known patterns: resource exhaustion, DNS rebinding, SSRF and OAuth misconfiguration. Our security hub explains each one.

The OWASP MCP Top 10 did not visibly change. The project page still lists the same ten "2025" items and says the project is in its beta and pilot testing phase.

What to watch in November

• The March 2027 release calendar. SEP-3398 says each release has a published calendar. Watch for the first one, with soft freeze and SDK beta dates.
• Server Cards in SDKs and clients. The SEP is Final. The next step is SDK and client support.
• Roadmap items. The August roadmap post lists server-initiated events, HTTP transport for local servers and agent identity as priorities.
• More advisories. Expect more fixes as the SDKs keep adding limits. Subscribe to GitHub security alerts for every MCP package you use.
• Smithery URL breakage after 31 October. Any setup still pointing at run.tools or server.smithery.ai will stop working.

Methodology

We built this report on 28 October 2026 from primary sources only. We did not test any product named here.

• Registry counts: We paged through the public registry API at https://registry.modelcontextprotocol.io/v0.1/servers?version=latest&limit=100 until no nextCursor came back. The crawl ran on 28 October 2026 (6:32 to 6:36 pm US Pacific time, 01:32 to 01:36 UTC on 29 October, 522 pages). We counted entries, the status field, entries with remotes or packages, and entries whose publishedAt falls in October 2026.
• Security advisories: We listed every repo in the modelcontextprotocol GitHub org and read each repo's published security advisories through the GitHub API on 28 October 2026 (about 6:30 pm US Pacific). We counted advisories with a publish date from 1 to 28 October 2026. Third-party package advisories are not included.
• Releases: Dates come from each repo's GitHub releases page, not from package registries.
• What we left out: Anything we could not confirm on a primary page, including third-party "MCP news" roundups.

Next step

If October's advisories leave you unsure what your team is running, start with an inventory. Our MCP readiness audit checks which servers and clients you use, what they can access and what needs updating. You can also browse the full MCP Guide or the MCP security checklist.

Frequently asked questions