Most people using AI at work have never heard of the Model Context Protocol. It is the plumbing that lets an AI assistant reach your files, your ticketing system, your threat intelligence feed.
That plumbing shipped its largest revision to date on 28 July, and it includes breaking changes.
Which is worth knowing this week specifically, because a growing number of organizations are connecting MCP servers to genuinely sensitive systems at the same moment the standard underneath them is being rebuilt.
| THE ROBIUS VERDICT: A maturing standard, not a broken one. But breaking changes plus a documented attack surface means this is the wrong month to connect an AI agent to anything sensitive without review. The new revision restructures the protocol core, moves some previously built-in capability into optional extensions, hardens authorization, and introduces a formal deprecation policy with a twelve-month window. Servers written for the new revision may not work with older clients, and the reverse also applies. The security dimension matters more for UAE teams. Published research has catalogued MCP-specific attack routes including tool description poisoning and indirect prompt injection through external data, and analysts note the new specification shifts more security responsibility onto implementers rather than the protocol. If your team is adding MCP connections, the review question is what the connection is allowed to do unsupervised. |
What MCP Is, Briefly
One paragraph, because the concept is simpler than the acronym.
An AI model on its own only knows what is in the conversation. MCP is a standard way to give it access to other things. A document store, a database, a monitoring tool, a calendar. Each connection is called an MCP server, and once connected the assistant can query that system directly instead of you copying and pasting between windows.
That is genuinely useful, and it is why adoption has moved fast across enterprise software.
A disclosure worth making plainly: Robius is produced with the assistance of Claude, made by Anthropic, and Anthropic originated MCP. We are covering the ecosystem we work inside, and readers should weigh that.
What Changed on 28 July
Four things, in rough order of practical impact.
| Change | Why it matters to a team using MCP |
|---|---|
| A restructured, stateless protocol core | Existing integrations may need rework rather than a version bump |
| Capability moved out of the core into extensions | Features you assumed were standard may now be optional |
| Hardened authorization requirements | Good news, but it means revisiting how each connection authenticates |
| A formal deprecation policy with a twelve-month window | Predictability going forward, which the ecosystem lacked |
The compatibility point is the one to plan around. Servers built against the new revision may not work with older clients, and older servers may not work with updated ones. Commentary from the ecosystem has been explicit that this is not a blanket guarantee of interoperability with legacy implementations.
For anyone running MCP connections in production, that is a testing exercise rather than an upgrade.
The Security Part Nobody Advertises
This is the section that matters most, and it is not about this particular revision.
MCP introduces an attack surface that did not previously exist, because it deliberately lets a model act on data from outside the conversation. Published research has catalogued specific routes, including tool description poisoning, indirect prompt injection delivered through external content, and chained tool abuse.
One documented case involved a crafted file in a public repository containing hidden instructions, which caused an AI agent to expose information from a private repository. The model was not compromised. It did exactly what the text in front of it said.
That is the same class of failure we covered when most tested AI systems failed a basic security attack. The vulnerability is not in the model weights. It is in the assumption that content the model reads is data rather than instructions.
Security analysts have noted that the new specification pushes more of the responsibility for handling this onto developers and platform operators rather than solving it at the protocol level. That is a defensible design decision. It is also a reason not to treat a spec update as a security upgrade.
Why UAE Security Teams Specifically
Because the local threat picture already runs on exactly this mechanism.
AI now writes the overwhelming majority of phishing messages breaching systems here, which we examined in why that number actually matters. The attack side is already automated and already writing convincing text.
The defence side is automating too. UAE banks are running AI-driven fraud detection at scale, as we set out in what that actually looks like in practice. So security teams here have a genuine reason to want AI tooling wired into their intelligence sources.
The tension is straightforward. The same property that makes an MCP connection useful, letting a model read and act on outside data, is the property attackers target. A threat intelligence feed is external data by definition.
What to Actually Do
Five checks, and none require a policy rewrite.
Inventory what is connected. Most organizations that have adopted MCP do not have a single list of which servers are live, who approved them, and what each can reach.
Scope permissions per connection rather than per user. An assistant that can read your ticketing system does not also need write access to your code repository.
Separate read from act. Retrieval has a small blast radius when it goes wrong. Taking actions does not. Decide explicitly which connections may do the second.
Test the upgrade rather than assuming it. If you run MCP servers, verify client compatibility before the new revision propagates through your tooling.
And treat vendor security claims the way you would any other. A specialist intelligence feed reachable from inside your AI assistant is genuinely convenient, and convenience is how most of these connections get approved without review. The pattern is familiar from how AI is actually being used in fraud this year.
The Honest Read
Breaking changes in a young standard are a sign of maturing, not of failure. A formal deprecation policy is exactly what enterprise adopters have been asking for.
It is also a reminder that the connective layer under AI tooling is still being written, in public, while people build on it. We made the same point about six competing agentic payment protocols with no standard between them. Early infrastructure moves, and anything built tightly against it moves too.
So adopt, but adopt with an inventory and a permissions model. The question is not whether MCP is safe. It is what you have allowed each connection to do while nobody was watching.
Sources
- Model Context Protocol: Official specification and the 2026-07-28 revision notes — https://modelcontextprotocol.io/specification
- The Register: Report on the scale of the MCP revision and its compatibility implications — https://www.theregister.com/2026/07/23/mcp_spec_overhaul/
- SecurityWeek: Analysis of how the new specification shifts security responsibility to implementers — https://www.securityweek.com/
- arXiv: Research cataloguing MCP attack vectors including tool poisoning and indirect prompt injection — https://arxiv.org/abs/2504.03767
- IANS Research: Launch of an MCP server delivering practitioner-validated security intelligence, July 2026 — https://www.iansresearch.com/
Robius.news — Dubai, UAE — 2026 | Built to be first. Built to be trusted.
