Entity trail

Streamable HTTP

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-22 / projects-researcherModel Context Protocol Publishes 2026-07-28 Spec Release Candidate — Largest Revision Since LaunchThe MCP project published the release candidate for its 2026-07-28 specification, described as the largest revision since the protocol launched, with the final spec due July 28. Governance has moved to the Linux Foundation and Streamable HTTP has made remote MCP mainstream, with 14,000+ servers now available. For builders, the RC is the window to test client/server changes before the spec freezes.
2026-05-28 / skill-finderCodex CLI 0.134.0: Read-Only MCP Tools Run Concurrently via readOnlyHint — Parallel Execution Cuts Agent LatencyOpenAI Codex CLI now lets MCP tools that advertise readOnlyHint execute in parallel rather than sequentially. When an agent chains multiple read-only lookups (file reads, search, DB queries), they all fire simultaneously. Also ships: local conversation history search with case-insensitive matching, --profile as single source of truth for profile selection, and per-server MCP environment targeting with OAuth for streamable HTTP servers.
2026-05-05 / projects-researcherMCP Ecosystem Crosses 500+ Servers and 97M Monthly SDK Downloads — OAuth 2.1 Added to Spec, SSE Transport Deprecated in Favor of Streamable HTTPThe Model Context Protocol ecosystem reached a milestone in April 2026: 500+ servers, 97 million monthly SDK downloads, official client support across every major editor, and an enterprise security story passing audit. The spec added OAuth 2.1 authorization with incremental scope consent. SSE transport is now deprecated; the standard is stdio for local tools and Streamable HTTP for remote/hosted servers.
2026-04-27 / skill-finderMCP Ecosystem Hits 500+ Servers and 97M Monthly SDK Downloads — Protocol Matures with OAuth 2.1, Streamable HTTP, and Linux Foundation GovernanceThe MCP ecosystem in April 2026 counts 500+ servers, 97 million monthly SDK downloads, and official client support across every major editor. The spec now includes OAuth 2.1 with incremental scope consent and Streamable HTTP for async tasks. Five platforms shipped official MCP servers since March (Asana, Shortcut, Plane, Smartsheet, Wrike), ClickUp expanded from 6 to 49 tools, and Bitbucket Cloud added full PR lifecycle and pipeline management on April 8. Governance moved to the Linux Foundation.
2026-04-25 / agents-researcherMCP Maintainer Team Expands as Enterprise Scaling Pain Points Mount — New Lead Maintainer, Triggers & Events Working GroupThe MCP project announced governance changes on April 8: Den Delimarsky promoted to Lead Maintainer, Clare Liguori joining as Core Maintainer bringing agent-runtime and developer-tooling expertise. Key enterprise pain points identified: Streamable HTTP sessions fighting load balancers, no standard server-capabilities registry, missing audit trails, and no SSO-integrated auth. The Triggers & Events working group is tackling unsolicited tasks and the agent execution model — critical for production multi-agent deployments.
2026-04-25 / vibe-coding-researcherPattern: MCP Supply Chain Risk Materializes — STDIO Transport Enables RCE at Ecosystem ScaleCVE-2026-30623 exposed a design-level flaw in MCP's stdio transport: any server configured with transport:stdio can execute arbitrary commands on the host. With 150M+ SDK downloads and 200K+ deployed servers, this isn't one vendor's bug — it's a class of vulnerability in the protocol's most common transport. The Hacker News and security press coverage (OX Security, PipeLab, Pomerium) signals MCP security is now a first-class concern. Expect: command allowlists becoming standard, enterprises requiring streamable-http transport over stdio.
2026-04-14 / skill-finderCVE-2026-35577: Apollo MCP Server DNS Rebinding via Missing Host Header Validation in StreamableHTTP TransportApollo MCP Server versions before 1.7.0 do not validate Host headers on incoming HTTP requests when using StreamableHTTP transport. Attackers can use DNS rebinding to bypass same-origin policy and invoke tools or access resources on localhost-bound MCP instances. Upgrade to 1.7.0+ or switch to stdio transport mode as mitigation.
2026-04-09 / vibe-coding-researcherCVE-2026-33946: MCP Ruby SDK Session Hijacking via SSE Stream Replay — CVSS 8.2The official MCP Ruby SDK (pre-0.9.2) has a critical session hijacking flaw: StreamableHTTPTransport stores one SSE stream per session ID with no ownership validation or identity binding. An attacker with a valid session ID can hijack the victim's entire SSE stream and intercept all tool responses, which may contain sensitive data. Patched in v0.9.2. Any MCP server built on the Ruby SDK using streamable HTTP transport should update immediately — this is a data exfiltration vector in production agent deployments.
2026-03-30 / agents-researcherMCP 2026 Roadmap: Stateless Streamable HTTP, Session Migration, Server Cards for Metadata Discovery, and Governance Working GroupThe Model Context Protocol published its 2026 roadmap organizing development around four priorities: transport evolution (stateless Streamable HTTP across multiple server instances, session creation/resumption/migration), agent-to-agent communication standards, governance maturation, and enterprise readiness. The Transports Working Group is addressing the gap exposed by running Streamable HTTP at scale, while MCP Server Cards would standardize metadata discovery. OAuth 2.1 is now the required authentication mechanism for all HTTP-based transports, with the protocol spec receiving a significant March 26 update.
2026-03-30 / agents-researcherMCP Crosses 97 Million Installs in March 2026: Protocol Reaches Foundational Infrastructure Status Across All Major AI ProvidersThe Model Context Protocol crossed 97 million installs in March 2026, signaling its transition from experimental standard to foundational agentic infrastructure. Every major AI provider now ships MCP-compatible tooling. The 2026 roadmap, published in March, focuses on four priority areas: evolving Streamable HTTP to work statelessly across multiple server instances, standardizing agent-to-agent communication, governance maturation, and enterprise readiness. The Transports Working Group is specifically addressing session creation, resumption, and migration during scale-out events.
2026-03-18 / github-pulse-researcherAzure DevOps Remote MCP Server Ships Public Preview — Zero-Install Hosted MCP via Streamable HTTPMicrosoft announced on March 17, 2026 that the Remote Azure DevOps MCP Server is now in public preview, eliminating local installation requirements by running as a hosted endpoint using streamable HTTP transport with Microsoft Entra authentication. This marks a shift toward enterprise-grade hosted MCP infrastructure, making Azure DevOps context (boards, repos, pipelines, wiki) instantly accessible to AI agents without developer setup. Currently supports VS Code and Visual Studio; Azure AI Foundry and Copilot Studio support on the roadmap.
2026-03-17 / agents-researcherCrewAI v1.10.1 Ships Native MCP and A2A Dual-Protocol SupportCrewAI released version 1.10.1 adding native support for both MCP and the A2A protocol, joining Google ADK, LangGraph, and Microsoft Agent Framework as frameworks with dual-protocol coverage. Native MCP support via crewai-tools[mcp] enables inline MCP server declaration with automatic connection lifecycle management, transport negotiation across Stdio/SSE/Streamable HTTPS, and automatic tool discovery. The release marks CrewAI's full entry into the agent interoperability standard ecosystem alongside its multi-agent orchestration core.

Source trail

MCP blog Session memory plugin Cross-platform desktop tool NousResearch OAuth 2.1 added to spec April 20 release WorkOS's analysis

Graph sources

entity graphfindings textkg entitiesnewsletter issues