Pick your MCP auth pattern before the first tool — the 2026-07-28 spec moves to a stateless core with RFC-based authorization

WorkOS·medium signal

The MCP spec landing 2026-07-28 shifts to a stateless core and standardizes authorization so it goes from 'technically possible if you wire it yourself' to 'follow these RFCs and it works' behind enterprise identity providers. The practitioner takeaway is to choose your auth pattern before writing the first tool: retrofitting authentication onto a deployed server with live callers costs two-to-three times building it in. If you're starting an MCP server now, design against the new spec's auth model from day one.