Topic
MCP server and client integration patterns, including protocol version 2025-06-18, capability negotiation, tools/list discovery and HTTP transport.
The new tools spec lets structuredContent be any JSON value. A client hard-coded to read structuredContent.result keeps compiling, keeps passing, and starts finding nothing on the wire.
Reality
Agent OS wires AI agents into live trading through MCP, sub-accounts and payment APIs. The scope a user grants, not the model behind it, is now the control surface.
Reality
The finalized Streamable HTTP transport mirrors tool arguments into Mcp-Param-* headers. A bad suffix, an excluded type, or an unreachable annotation kills the tool definition, so validate before tools/list.
Reality
Wiz says the VS Code extension auto-loaded MCP server configs from the workspace and handed spawned processes the developer's full environment. Fixed in language server 1.65.0.
Reality
Headless Data 360 for MCP lets agents call Salesforce data APIs directly. The integration work shrinks; the question of who is allowed to grant that access does not.
Reality
A dev.to post argues most "read-only" Kubernetes MCP servers filter the tools/list response while the write path stays callable. One such filter is now a CVE at CVSS 8.8.
Reality
Microsoft's agentic retrieval is now callable from any MCP client, so non-Microsoft agent stacks can stop rebuilding chunking, embedding and permissions. The edges are where the work moved.
Reality
A developer built a deliberately dishonest MCP binary so a test could prove it catches a lie. The interesting part is that the same probe now polices the honest server too.
Reality
The 2026-07-28 spec removes protocol-level sessions and the Mcp-Session-Id header, and the TypeScript SDK has split into separate packages. Horizontal scaling is the stated reason.
Reality
Chrome's MCP server can drive a browser with no visible window, or hook onto a Chrome instance you are already logged into. That puts live credentials inside the automation's reach.
Reality
Mads Thines has shipped an open-source memory layer for coding agents that starts on local disk. The design bet is that a record of past mistakes should be inspectable and portable.
Reality
A dev.to walkthrough wires chokidar, tree-sitter, Qdrant and an MCP server into a code search stack. Every part is off the shelf; the unresolved work is reindexing and retrieval quality.
Reality
Google moved MCP Toolbox to the server side of the wire. The client config drops to four lines with no secrets in it, but the security boundary is now one global allowlist.
Reality