Latest from the MCP project

These come from the official MCP blog, written by the protocol's maintainers.

What each roundup covers

  • Flaws in servers we list. What happened, who is affected and what to do, with a link to the server's grade.
  • Flaws elsewhere in MCP. Clients, frameworks and servers we don't list yet.
  • Vendor changes. Deadlines, end-of-life dates and new defaults that can break your setup.
  • Spec and SDKs. New spec versions and fixes in the official SDKs.

Can't wait a month? Registry Watch checks every server in the official MCP Registry daily. For hardening your own setup, see our MCP security best practices.

Where to follow MCP news at the source

Frequently asked questions

What is the latest MCP news?

Our newest issue is MCP Security Roundup (Oct 2026). October's verified MCP security news: advisories for VS Code and n8n, a run of fixes in the official TypeScript, Python and Java SDKs, Stripe's 30 November key deadline, and the end of Salesforce's local MCP server on 2 November.

How often is this page updated?

We publish one roundup a month and add it to this page. The list of project posts is refreshed with each issue.

Does MCP here mean Model Context Protocol?

Yes. The Model Context Protocol is an open standard that lets AI apps connect to outside tools and data. New to it? Read MCP vs API.

How do you check each item?

Every item has a date and a link to a primary source, such as an advisory, a vendor doc or release notes. We search NVD and the GitHub Advisory Database for MCP records each month.

Can I get MCP news by email?

Yes. Sign up for the MCP newsletter. You confirm by email first, and can unsubscribe in one click.

Need an MCP server that stays patched? Tell us what you want to connect.