MCPNews

The Model Context Protocol ecosystem, verified

Current spec 2026-07-28

The MCP ecosystem, verified

MCP News catalogs 752 MCP entities (742 servers, 10 clients) with verified facts: 12 verified on the current spec revision (2026-07-28), 40 verified first-party servers.

security

CVE record published for critical unauthenticated document API in mcp-memory-service, whose GitHub repository has since disappeared

CVE-2026-50027 was published to the National Vulnerability Database on 2026-08-14 with a CVSS score of 9.8, covering mcp-memory-service versions before 10.67.1. All HTTP routes under /api/documents/* were served without authentication even when the server was configured with an API key or OAuth, letting an unauthenticated remote attacker write, read, and delete stored memory content. The underlying GitHub advisory was published 2026-07-02. The project's GitHub repository and maintainer account returned 404 when checked on 2026-08-14, while PyPI releases continued through 11.8.0 on 2026-08-09.

· verified 2026-08-14

server release

C# SDK v2.2.0 adds hybrid HTTP serving so 2025-11-25 and 2026-07-28 clients share one endpoint

The official MCP C# SDK released v2.2.0 on 2026-08-13, adding an HttpServerSessionMode for hybrid stateful/stateless HTTP serving so clients on the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixing a header-decoding edge case in McpHeaderEncoder.DecodeValue.

 security

CVE record published for Flowise remote code execution via the Custom MCP node

CVE-2026-73601 was published to the National Vulnerability Database on 2026-08-13, covering a remote code execution vulnerability in Flowise's Custom MCP node. When CUSTOM_MCP_PROTOCOL is set to stdio, authenticated users of Flowise versions before 3.1.3 can execute arbitrary commands by manipulating environment variables and command arguments. The underlying FlowiseAI advisory, GHSA-g98q-rm45-q9h8, was published 2026-07-29 and rates the flaw critical; the NVD record carries a CVSS score of 9.0.

 security

CVE record published for MCP Atlassian arbitrary file read fixed in 0.22.0

CVE-2026-73498 was published to the National Vulnerability Database on 2026-08-12, covering an arbitrary file read in MCP Atlassian, a widely used community MCP server for Confluence and Jira. Prior to 0.22.0, the confluence_upload_attachment tool passed its client-supplied file_path directly to open() without path validation, letting an authenticated MCP client read any file accessible to the server process and exfiltrate it to Confluence as an attachment. The underlying advisory, GHSA-g5r6-gv6m-f5jv, was published 2026-07-10 and rates the flaw high (CVSS 7.7).

All news →

Every story carries primary sources and a verification date.
12 Verified on 2026-07-28 740 Awaiting verification 40 First-party servers 5 Spec revisions tracked 752 Entities cataloged

More news

governance

MCP publishes the Apps Working Group charter covering the interactive UI extension

The MCP project merged the MCP Apps Working Group charter into its community documentation on 2026-08-12. The group owns the MCP Apps extension specification (SEP-1865) under the io.modelcontextprotocol/ui namespace, the @modelcontextprotocol/ext-apps SDK, the extension's security model, and conformance work, with leads from MCP-UI and Anthropic and a working-group member from OpenAI.

 client release

MCP Inspector 2.2.0 moves to TypeScript SDK 2.0.0 stable and adds a v1 to v2 migration guide

MCP Inspector released 2.2.0 on 2026-08-12, upgrading from TypeScript SDK 2.0.0-beta.5 to the stable 2.0.0 packages, adding a v1 to v2 migration guide, fixing the MCP Apps sandbox proxy so it ships its static assets, and forwarding the negotiated Mcp-Protocol-Version header through the remote proxy. The release also publishes a six-month roadmap running to February 2027.

 industry

Cloudflare Gateway adds MCP traffic detection and an AI Security dashboard

Cloudflare's 2026-08-12 changelog announced that Gateway, part of Cloudflare One, now detects Model Context Protocol traffic by inspecting protocol-specific headers and payload characteristics. A new beta HTTP policy selector named Is MCP (experimental.is_mcp) lets administrators allow, block, or isolate MCP requests, and a new AI Security dashboard reports MCP request volume, unique users, and unique MCP servers observed. A same-day Traffic Source selector adds mcp_portal as a policy-targetable on-ramp.

 client release

Agent Plugins 1.0 reaches general availability in VS Code, Copilot CLI, and the Copilot app

GitHub's 2026-08-12 changelog made Agent Plugins 1.0 generally available in VS Code, Copilot CLI, the GitHub Copilot SDK, and the GitHub Copilot app, across all Copilot plans. Agent Plugins is the vendor-neutral package format announced 2026-08-06 that bundles agent skills with MCP server configurations, stored in mcp.json files inside the plugin. GitHub credits the 1.0.0 specification as an open standard co-developed with AWS, Anysphere, Microsoft, OpenAI, Vercel, and Google.

 security

Blender MCP maintainer's GitHub account hijacked, with access restored two days later

Siddharth Ahuja, maintainer of the 25k-star blender-mcp server, reported on 2026-08-09 that his GitHub account was hacked and his ownership rights stripped, naming Blender MCP and Ableton MCP among the repositories taken away. On 2026-08-11 he posted that GitHub had banned the hacker and restored his account, and that the MCP servers themselves were not compromised. As of 2026-08-13 the repositories resolve back to his account.

 security

Grafana discloses critical SSRF in mcp-grafana after an earlier fix left request destinations unrestricted

Grafana published CVE-2026-19516 on 2026-08-11, a CVSS 9.1 server-side request forgery in the mcp-grafana server. A caller-supplied X-Grafana-URL header controls the destination of outbound requests, and the grafana_api_request tool also lets the caller choose the HTTP method, path, and body, so requests can be directed at internal, loopback, and link-local services including metadata endpoints. The fix for the earlier CVE-2026-15583 stopped token leakage but did not restrict destinations; v1.1.0 fixes the SSRF and adds optional bearer-token caller authentication.

The MCP 500 Full list →

# Server Index Downloads/wk Stars
1 Browser Use MCP Server 100.00 - 109k
2 Playwright MCP 97.54 6.7M 36k
3 GitHub MCP Server 96.62 - 32k
4 Chrome DevTools MCP 94.36 1.6M 49k
5 Context7 93.18 1.0M 61k

Ranked by Adoption Index v1 (measured public adoption, not a quality verdict) · snapshot 2026-08-14 · Movers: io.github.YawLabs/postgres-mcp up 370, mcp up 361, jamgate up 342, Google Workspace up 339

Start here

  1. MCP 2026-07-28 adoption tracker 12 verified on the current revision; the migration worklist for everything else.
  2. The MCP 500 Servers ranked by measured public adoption, methodology published.
  3. First-party MCP servers 40 verified against vendor-controlled sources.
  4. The 2026-07-28 revision What changed in the stateless release, and who ships it.

Verified on 2026-07-28

Cloudflare MCP servers

Current Spec Verified First-party

MCP server · by cloudflare · verified

Cloudflare's product-specific MCP servers, sixteen Cloudflare-hosted endpoints on mcp.cloudflare.com subdomains. Each request runs on a fresh stateless server with no protocol session. Historical /sse URLs survive as aliases to the same Streamable HTTP handler but no longer serve the deprecated HTTP+SSE transport. Authorization is OAuth with scope selection; the docs endpoint answers unauthenticated. A 2026-08-07 probe of docs.mcp.cloudflare.com/mcp answered server/discover at 2026-07-28 over streamable-http.

MCP Inspector

Current Spec Verified

MCP client · by modelcontextprotocol · verified

The protocol project's reference tool for inspecting MCP servers, shipped as the @modelcontextprotocol/inspector npm package with web, CLI, and TUI frontends. The v2 line targets the modern protocol: the README documents the "modern (2026-07-28) protocol era" including MRTR replacing server-to-client elicitation, 2.1.0 shipped SEP-2243 header mirroring, and 2.2.0 runs on the stable TypeScript SDK 2.0.0.

Notion MCP

Current Spec Verified First-party

MCP server · by notion · verified

Notion's hosted MCP server. The developer changelog entry of 2026-08-03 states the Streamable HTTP endpoint at mcp.notion.com/mcp supports protocol version 2026-07-28, and that clients negotiating the earlier 2025-era protocol on the same endpoint continue to work unchanged. Authorization is OAuth 2.0 with mandatory S256 PKCE; Client ID Metadata Documents are supported as an alternative to Dynamic Client Registration.

Verified on an earlier revision

GitLab MCP Server

Earlier Revision First-party

MCP server · by gitlab · verified

GitLab's official MCP server, built into the GitLab application at /api/v4/mcp. GitLab docs state support for the 2025-03-26 and 2025-06-18 MCP protocol specifications was added in GitLab 18.7. Beta on all tiers of GitLab.com, Self-Managed, and Dedicated. No GitLab surface names 2026-07-28 support; a probe on 2026-08-14 answered with an OAuth challenge, so revision behavior is not observable without credentials.

Spec support unverified

ChatGPT

Spec Support Unverified

MCP client · by openai · verified

OpenAI's assistant supports MCP through connectors: deep research and company knowledge require read-only search and fetch tools, while developer mode unlocks custom servers with full tool access. MCP also reaches the Responses API and the prompts dashboard. OpenAI's docs use the SSE streaming interface and link the 2025-11-25 authorization specification, but name no full MCP spec revision, so revision support is unverified.

Claude Code

Spec Support Unverified

MCP client · by anthropic · verified

Anthropic's terminal and IDE coding agent. MCP servers connect over streamable HTTP (recommended; type http, with streamable-http accepted as an alias), stdio, deprecated SSE, and WebSocket for server-push use cases. Supports roots/list with change notifications, list_changed refresh for tools, prompts, and resources, and OAuth on HTTP servers. No Anthropic surface names a supported MCP spec revision for the client as a whole, so revision support is unverified; the connector docs name the 2025-03-26, 2025-06-18, and 2025-11-25 authorization specifications as supported.

Claude Desktop

Spec Support Unverified

MCP client · by anthropic · verified

Anthropic's desktop client and the first shipping MCP client: local MCP server support launched with the protocol in November 2024, and remote connectors run over streamable HTTP (legacy HTTP+SSE deprecated). Claude's connector docs ground tools, prompts, and resources with text, image, and binary content; resource subscriptions and sampling are not yet supported. Authorization specs 2025-03-26, 2025-06-18, and 2025-11-25 are supported with DCR. No full MCP spec revision is named, so revision support stays unverified.

GitHub Copilot CLI

Spec Support Unverified

MCP client · by github · verified

GitHub's terminal coding agent. MCP servers "give Copilot access to different data sources and tools", with the GitHub MCP server as the documented built-in example. Enterprise management is partial: the docs state Copilot CLI cannot yet enforce the "MCP servers in Copilot" and "MCP Registry URL" organization policies. Since 2026-08-12 it also installs Agent Plugins, whose mcp.json files carry MCP server configurations. No MCP spec revision is named.

Windsurf

Spec Support Unverified

MCP client · by cognition · verified

The Windsurf editor line's agent (Cascade, with Devin Local as the current default) is an MCP client supporting tools, resources, and prompts over stdio, streamable HTTP, and SSE, with OAuth on each transport. Configured in ~/.codeium/windsurf/mcp_config.json with a 100-tool ceiling. The docs now live under docs.devin.ai with Devin as the primary product name. No MCP spec revision is named, so revision support is unverified.

What is MCP News?

MCP News is a factual catalog of Model Context Protocol servers and clients plus a primary-sourced news feed for the MCP ecosystem. Every record carries source URLs, a verification date, and a calibrated confidence score, so claims like "first-party server" or "supports the 2026-07-28 stateless revision" can be checked rather than guessed at. Records that fall below the publishing threshold stay in moderation and never appear here.