MCP’s New Roadmap Focuses on Agent Events, HTTP Transport, and Identity Security, but SDK Support for Tasks Remains Incomplete

The Model Context Protocol (MCP) maintainers published an updated roadmap on August 22, organizing upcoming specification work into five categories: agent messaging primitives, HTTP-native transport, agent identity and enterprise security, improvements to core primitives, and the SDK developer experience. This is not simply another feature list; it is an engineering schedule that determines which Specification Enhancement Proposals (SEPs) will receive priority review. [Official announcement](https://blog.modelcontextprotocol.io/posts/mcp-roadmap/)

The most immediate change is that MCP is preparing to move beyond the one-request, one-response model of tool invocation. Long-running agents need servers to proactively send events and stream results, while allowing users to change direction while work is underway. The team therefore plans to integrate Tasks, `subscriptions/listen`, progress notifications, and event mechanisms such as webhooks and channels. Another area of work is progressive discovery: a remote server would initially expose a small entry point, then expand the tool catalog as the conversation requires, avoiding the need to load a large schema into the context on every connection.

At the transport layer, the roadmap builds on the stateless HTTP architecture of the 2026-07-28 specification and explores how to extend the same model to local stdio deployments. The security work goes beyond OAuth tokens: it also aims to define identities for agents, workloads, and users on whose behalf agents act, enabling authorization and auditing to be traced across multiple layers of delegation. For MCP gateways, enterprise SSO, and multi-tenant agent platforms, this matters more than adding a few tool fields.

However, the roadmap should not be treated as a set of already delivered APIs. The public Python SDK roadmap still lists Tasks, DPoP, and workload identity as not yet implemented. The TypeScript SDK has also encountered an issue in which `subscriptions/listen` could not carry extended notifications, blocking Tasks updates. [Python SDK roadmap](https://github.com/modelcontextprotocol/python-sdk/blob/main/ROADMAP.md) For now, engineering teams should pin the protocol version, run the conformance suite, and treat Tasks and event notifications as unstable interfaces. The key questions are whether the SDKs can implement these features in sync and whether webhook verification, retry, and revocation semantics are formally incorporated into the specification.