MCP’s July 2026 spec rewrite went stateless and made Client ID Metadata Documents the standard, not audience-bound tokens, which have been mandatory since mid-2025. What actually changed since December 2025, and the checklist that replaces the old one.
First seen on securityboulevard.com
Jump to article: securityboulevard.com/2026/08/the-mcp-security-implementation-playbook-enterprise-authorization-patterns-that-actually-work/
