Blog

Scoring philosophy, MCP security, and what changed this week.

All mcp 31 agents 11 guides 7 security 19 supply-chain 1 oauth 2 a2a 2 api 2 scoring 2 spec 4 testing 2 rag 1 skills 1

MCP observability after logging was deprecated

The 2026-07-28 spec deprecated protocol-level logging and points at OpenTelemetry instead. What to instrument on an MCP server, and what not to log.

mcp spec security 17 Aug 2026 · 7 min read

MCP sampling and roots are both deprecated now

Both client features were deprecated by SEP-2577 in the 2026-07-28 spec. What each one did, why they went, and exactly what to migrate them to.

mcp spec 16 Aug 2026 · 6 min read

MCP elicitation: form mode, URL mode and the risks

How elicitation works in the 2026-07-28 spec, why sensitive data must never go through form mode, and the phishing attack URL mode has to defend against.

mcp security spec 15 Aug 2026 · 8 min read

VerifyMCP now supports MCP 2026-07-28

The 2026-07-28 revision makes MCP stateless, removing the initialize handshake and sessions. What changed, what it means for your server, and which scores move.

mcp spec scoring 28 Jul 2026 · 6 min read