You know MCP — Model Context Protocol, the universal plug standard that lets AI tools connect to databases, APIs, and services the way USB-C connects your devices. Over the past year, MCP became the default way AI agents talk to the outside world. Every major AI company supports it. Dozens of MCP servers exist for everything from GitHub to Slack to your company's internal wiki. Life is good.
Except when you try to run it at enterprise scale. Then the plumbing leaks.
The MCP team updated their official 2026 roadmap on March 5, and it reads less like a feature announcement and more like an infrastructure repair manual. Four pillars: transport scalability, agent communication, governance maturation, and enterprise readiness. In plain terms — MCP graduated from the garage and realized the wiring isn't up to code.
The biggest overhaul targets Streamable HTTP — the transport layer that lets MCP servers run as remote cloud services instead of processes sitting on your laptop. In production deployments, this transport hit real walls. Stateful sessions — where the server remembers who you are between requests — collide with load balancers (the traffic cops that distribute requests across multiple servers). Horizontal scaling — spinning up more servers to handle more users — requires hacky workarounds. There's no standard way for a registry or crawler to discover what a server offers without actually connecting to it first.
The fix: stateless operation across multiple server instances, proper session management that survives restarts and scale-outs, and transparent behavior behind load balancers and proxies. In other words, MCP needs to work the way every modern web service already works. The fact that it doesn't yet tells you how fast the protocol outgrew its original design.
The Tasks primitive (SEP-1686) — a system that lets agents kick off long-running jobs, check progress, and handle failures as first-class operations — landed as a proposal in October 2025. The team accepted and shipped it as experimental, and is now hardening it for production. Early adopters found the gaps you'd expect: no retry logic when tasks fail temporarily, no expiry policies for how long results stick around after completion. Sounds like footnotes. These are the exact things that matter when you're running 10,000 agent tasks a day.
Then there's enterprise auth — the real gatekeeping ritual. The roadmap calls for "paved paths away from static client secrets and toward SSO-integrated flows." Translation: enterprises want to manage MCP access through their existing login systems — Okta, Azure AD, whatever their IT department already controls. SSO (Single Sign-On) integration means one login for everything. Add audit trails — logs of who accessed what and when — plus gateway behavior and cross-app access management. This is how MCP gets past the security review that kills most promising tools. "Does it support SAML?" "Can we integrate with Okta?" "Where are the audit logs?" These aren't technical questions. They're incantations. MCP is learning to recite them.
The ecosystem is already building on the new primitives. MCP now lives under the Linux Foundation, with Working Groups owning each priority area — Transports, Agents, Governance, and a forthcoming Enterprise WG.
Here's what's buried in this roadmap: MCP already won the feature war. It connects to everything. What it couldn't do was connect to everything reliably, at scale, behind a corporate firewall. The team knows this. They're not shipping shiny new capabilities — they're making the existing ones survive contact with production.
The price is migration pain. Developers will need to update every MCP server written with stateful session assumptions when stateless mode becomes the default. There will be a delightful two-week window where half the ecosystem breaks and developers flood GitHub Issues with indignant bug reports. The SSO overhaul will similarly force teams to rethink auth flows they hacked together with static API keys.
For anyone building with AI tools right now: if you're integrating MCP servers, start reading the stateless transport docs today. If you're in an enterprise evaluating AI agents, this SSO roadmap is your green light to start planning deployments. If you're building MCP servers yourself, brace for breaking changes in the transport layer.
By the end of 2026, nobody will talk about MCP. It will just work — as invisible and boring as HTTP itself. A protocol roadmap about load balancers, session management, and SSO. Peak enterprise software. And the highest compliment a protocol can receive.
