Issues

Issues

• docs: architecture spec page still presents sampling as a core feature, but is depricated

  modelcontextprotocol/modelcontextprotocol#3548 · opened on Nov 12, 2026

• Runtime enforcement: the Security section's missing layer

  modelcontextprotocol/modelcontextprotocol#3538 · opened on Nov 11, 2026
  4

• Can we move the template out into a separate file on GitHub and just link to it instead of rendering the full content?

  modelcontextprotocol/modelcontextprotocol#3527 · opened on Nov 9, 2026
  1

• Tool annotations: the spec does not say how the untrusted-annotations rule applies to clients that force a tool call

  modelcontextprotocol/modelcontextprotocol#3492 · opened on Nov 1, 2026
  9

• Nine small docs fixes in 2026-07-28: stale wording, a dead link, incomplete lists

  modelcontextprotocol/modelcontextprotocol#3491 · opened on Oct 31, 2026
  2

• Sampling with tools: two small corrections

  modelcontextprotocol/modelcontextprotocol#3490 · opened on Oct 31, 2026
  2

• Client error instructions left over from before MRTR (elicitation and sampling)

  modelcontextprotocol/modelcontextprotocol#3489 · opened on Oct 31, 2026
  4

• Error responses without id: an unstated departure from JSON-RPC 2.0

  modelcontextprotocol/modelcontextprotocol#3488 · opened on Oct 31, 2026
  2

• Notification POSTs: the Note and the POST header rules still disagree after PR #2891

  modelcontextprotocol/modelcontextprotocol#3487 · opened on Oct 31, 2026
  1

• Icon origin guidance differs between basic/index and Icon.src

  modelcontextprotocol/modelcontextprotocol#3486 · opened on Oct 31, 2026
  2

• Embedded prompt resources: MIME type required in the prose, optional in the schema

  modelcontextprotocol/modelcontextprotocol#3485 · opened on Oct 31, 2026
  1

• Streamable HTTP: no precedence between UnsupportedProtocolVersionError (-32022) and HeaderMismatch (-32020) when an unsupported version arrives without the modern headers

  modelcontextprotocol/modelcontextprotocol#3449 · opened on Oct 22, 2026
  3

• Security best practices: SSRF section does not cover local stdio-to-HTTP bridges acting as OAuth clients

  modelcontextprotocol/modelcontextprotocol#3437 · opened on Oct 15, 2026
  4

• Docs: quickstart MCP configs use unpinned npx -y, contradicting the Local Server Security guide

  modelcontextprotocol/modelcontextprotocol#3431 · opened on Oct 13, 2026
  24

• [Spec & Ecosystem] Lack of enforced Server-level routing descriptions breaks LLM tool selection under Lazy/Deferred Loading (especially when paired with Agent Skills)

  modelcontextprotocol/modelcontextprotocol#3430 · opened on Oct 13, 2026
  7

• Client-credentials examples should require issuer binding

  modelcontextprotocol/modelcontextprotocol#3419 · opened on Oct 6, 2026
  2

• Docs: clarify where an MCP server should integrate in an existing application architecture

  Enhancement

  modelcontextprotocol/modelcontextprotocol#3417 · opened on Oct 6, 2026
  3

• Access Token Privilege Restriction: does "MUST NOT pass through" cover an API of the same authorization server/project (Supabase Edge MCP pattern)?

  modelcontextprotocol/modelcontextprotocol#3413 · opened on Oct 4, 2026
  5

• Lost-response retry on a mutating tools/call re-executes external effects — reproduction evidence and a spec-clarification question

  modelcontextprotocol/modelcontextprotocol#3394 · opened on Sep 27, 2026
  53

• Origin validation rejects browser-based MCP clients on authenticated remote servers

  modelcontextprotocol/modelcontextprotocol#3370 · opened on Sep 18, 2026
  11

• Security considerations section can be improved

  modelcontextprotocol/modelcontextprotocol#3361 · opened on Sep 14, 2026
  1

• cancellation.mdx and subscriptions.mdx disagree on how a server ends a subscriptions/listen stream

  modelcontextprotocol/modelcontextprotocol#3348 · opened on Sep 6, 2026
  1

• inputSchema and requestedSchema hard-code JSON Schema keywords into dialect-agnostic slots

  modelcontextprotocol/modelcontextprotocol#3238 · opened on Aug 14, 2026
  5

• Tasks extension (SEP-2663): no interoperable surface for partial output of a running task

  modelcontextprotocol/modelcontextprotocol#3237 · opened on Aug 14, 2026
  2

• Clarify whether notifications/resources/list_changed should be sent if the list of resource templates changes

  modelcontextprotocol/modelcontextprotocol#3226 · opened on Aug 11, 2026