Fetching from the wire…
01
02
03
04
05
06
07
08
Infra2026-08-11 · source-backed
upstash/context7 (60,590 stars) shipped @upstash/[redacted] on August 7 on the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions are gone, which is a real operational simplification for anyone self-hosting MCP at scale. Same release fixed a nasty auth bug: ctx7 setup now writes a standard Authorization: Bearer header instead of a custom CONTEXT7_API_KEY one, because Codex read the custom name as "no credential configured," fell through to a stale OAuth credential, and failed with invalid_grant before the API key was ever sent.
Each link below shares sources, entities, or timing with this story.
PR #29081, merged August 26 and in nightly v0.59.0-nightly.20260827, enforces RFC 9728 §7.7 and RFC 8414 constraints across MCP OAuth metadata discovery, dynamic client registration, and token exchange. It requires HTTPS for remote endpoints with HTTP allowed only for loopback...
4.0.1 and 4.0.2 both landed August 11 cleaning up 4.0.0 fallout: 4.0.1 stopped forcing responseMode: "sse" on the HTTP handler because every response was riding an unreleased SSE stream, and 4.0.2 added a 60s AbortSignal.timeout() after stalled backend calls were inheriting un...
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
Before v4.1.15 on August 23, it only applied to tools also opted in individually, so flipping it appeared to do nothing. Anyone who left it on assuming it was inert has just widened their unattended tool surface across every connected server. (GitHub) Same release train fixed...
Headroom, a context-compression proxy and MCP server at 67,241 stars, shipped a fix on August 22 validating caller-supplied upstreams on every resolution path (PR #3195), closing a gap where some paths didn't. If you route agent traffic through a compression proxy, a caller-co...
The 2026-07-28 Model Context Protocol spec published today, and it removes two things every MCP server currently depends on: the initialize/initialized handshake and the Mcp-Session-Id header. Both are gone. Not deprecated. Gone from the core. (Model Context Protocol Blog) Wha...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.