The Updated MCP Spec: The Good, The Bad, The Ugly
Thanks for joining us live — or welcome, if you're catching up on demand. Christian Posta (VP, Global Field CTO) and Lin Sun (Director of Open-Source) broke down what changed in the latest MCP specification, where it genuinely moves the protocol forward, and where it still leaves implementers with hard problems to solve.
What we covered, in three words
A quick recap for anyone who wants the highlights before diving into the resources below.
Stateless-by-design finally arrives
Session dependencies and sticky handshakes are gone. State moves into HTTP headers (SEP-2243), which means MCP servers can finally be load-balanced and scaled horizontally the way any other cloud-native service is.
Authorization hardening raises the bar
Six new SEPs align MCP auth with OAuth 2.0 and OIDC — a good long-term move, but it means clients, servers, and gateways all have real implementation work ahead to stay spec-compliant.
Enterprise gaps are still there
Dynamic Client Registration, resource indicators, and multi-tenant upstream credential handling remain unresolved for many real deployments — the spec describes the pattern, but enterprises still have to engineer around the gaps.
Go deeper on the spec
Blog posts that build on what Christian and Lin covered live.
MCP Stateless Spec Changes: The Engineering Details
The deep-dive companion to the webinar — SEP-2243, elicitation changes, and the authorization SEPs, explained.
Read the post →MCP Authorization Patterns for Upstream API Calls
Five patterns for securing multi-tenant MCP servers that need to call upstream APIs across trust boundaries.
Read the post →Enterprise Challenges With MCP Adoption
Where the spec's authorization recommendations still fall short of what real enterprise deployments need.
Read the post →Put it into practice
Free, self-paced hands-on labs — no cluster of your own required.
Secure Your MCP Servers with OAuth
Apply the authorization patterns from the webinar yourself, in a guided lab environment.
Start the lab →Build, Run & Deploy MCP Servers to Kubernetes
Go from prototype to production MCP server using kmcp, without hand-rolling the infrastructure.
Start the lab →Multiplex MCP Servers & Control Auth Policy
Run multiple MCP servers behind a single gateway with centralized, consistent auth policy.
Start the lab →Want the full set? See all Solo.io Labs for MCP →
Keep watching
Related on-demand workshops, webinars, and videos on MCP and agentgateway.
MCP: From Zero to Production
A full walkthrough of shipping an MCP server to production, end to end.
Watch now →Authentication and Authorization Patterns for Agents and MCP
A closer look at securing agent-to-tool and agent-to-agent traffic, beyond what we covered live.
Watch now →Building an Agent Gateway to Adopt MCP at Scale
See how agentgateway's architecture supports MCP traffic as usage scales across the enterprise.
Watch now →Ready to see agentgateway and MCP working together?
Bring the questions from the webinar to your own environment — request a demo, or dig into the labs with your platform team.